Detect hardcoded secrets and credentials in a directory. Runs the built-in custom scanner (no extra tools). When include_git_history is true, also scans past git commits for secrets removed from the working tree but still in history — recommended before push/PR. Uses git_history (built-in) and gitleaks (when installed).

Static analysis (SAST) for code vulnerabilities and unsafe patterns. Uses semgrep and bandit when installed; skips missing engines.

Scan lockfiles and manifests for known vulnerable dependencies (SCA). Uses osv-scanner when installed.

Scan Terraform, CloudFormation, Kubernetes, and other IaC for misconfigurations. Uses checkov when installed.

Run every installed scanner (secrets, SAST, dependencies, IaC) and return one unified, deduplicated report. Set include_git_history=true to also scan git commit history for leaked secrets — recommended before push/PR.

List all supported scanners and whether each engine CLI is installed. Call this before scanning to know which tools will run.

Return remediation guidance for a finding rule_id (from any scan result). Recognizes built-in secret rules, bandit test IDs (B###), semgrep rule paths, gitleaks rule names, checkov policies (CKV_*), and dependency advisories (CVE/GHSA/PYSEC), with documentation links where available.