Detect hardcoded secrets and credentials in a directory. Runs the built-in custom scanner (no extra tools). When include_git_history is true, also scans past git commits for secrets removed from the working tree but still in history — recommended before push/PR. Uses git_history (built-in) and gitleaks (when installed).

Static analysis (SAST) for code vulnerabilities and unsafe patterns. Uses semgrep and bandit when installed; skips missing engines.

Scan lockfiles and manifests for known vulnerable dependencies (SCA). Uses osv-scanner when installed.

Scan Terraform, CloudFormation, Kubernetes, and other IaC for misconfigurations. Uses checkov when installed.

Run every installed scanner (secrets, SAST, dependencies, IaC) and return one unified, deduplicated report. Does not enable git history unless you call scan_secrets separately with include_git_history.

List all supported scanners and whether each engine CLI is installed. Call this before scanning to know which tools will run.

Return remediation guidance for a finding rule_id (from any scan result). Covers built-in secret rules; other engines fall back to generic advice.