codacy_security
Manage security findings across repositories: view dashboards, search vulnerabilities, ignore false positives, and assess supply chain risks with SBOM and OSSF Scorecard.
Instructions
Get the security dashboard summary for a repository.. Select operation via the action parameter. Actions: dashboard, ignore, ossf_scorecard, sbom_search, search_org, search_repo
Workflow:
'dashboard': Get the security dashboard summary for a repository.
'ignore': [INSTRUCTIONS] Use when the user explicitly wants to mark a security finding as ignored. Always provide a reason: FalsePositive, WontFix, or NotRelevant. Common mistakes: (1) Do NOT invent reasons. (2) Ignoring without user confirmation — this is a security decision, always confirm. This action is idempotent — calling it twice with the same srmItemId has no additional effect.
Ignore or unignore a security finding.. Requires: srmItemId, reason [DESTRUCTIVE]
'ossf_scorecard': [INSTRUCTIONS] Accepts either a repository URL (e.g., https://github.com/org/repo) or a purl (e.g., maven:ch.qos.logback:logback-classic:1.2.3). At least one is required. Common mistake: not providing either url or purl — the API requires at least one identifier. Use the purl from SBOM search results.
Get the OSSF Scorecard for a repository or package. Returns security posture score.
'sbom_search': [INSTRUCTIONS] Supply chain security investigation — search SBOM dependencies by name, vulnerability severity, or risk category. Common mistakes: (1) Confusing SBOM search with security findings — SBOM shows dependencies, use codacy_security.search_repo for code-level findings. (2) Risk categories: Forbidden, Risky, Normal — do NOT invent categories. Use purl (Package URL) as the universal identifier for cross-referencing with OSSF Scorecard.
Search SBOM dependencies across the organization. Find vulnerable packages by name, severity, or risk category.
'search_org': [INSTRUCTIONS] Cross-repository security overview at the organization level. For repository-specific findings, use codacy_security.search_repo instead. Scan types: SAST, SCA, Secrets, IaC, CICD (repo-level). DAST and PenTesting are organization-level only. Common mistakes: (1) Using this for code quality issues — use codacy_issues instead. (2) Status values: OnTrack, DueSoon, Overdue (open), ClosedOnTime, ClosedLate, Ignored (closed) — do NOT invent statuses.
Search organization-level security findings across all repositories.
'search_repo': [INSTRUCTIONS] Repository-scoped security search. Uses the organization-level API filtered by this repository. Scan types available at repo level: SAST, SCA, Secrets, IaC, CICD. For DAST and PenTesting, use codacy_security.search_org instead. Common mistake: using DAST or PenTesting scan types here — those are organization-level only.
Search security findings within a specific repository. [Cache-Control: no-store]
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Repository URL (e.g., https://github.com/org/repo). For: ossf_scorecard | |
| purl | No | Package URL in purl format (e.g., maven:ch.qos.logback:logback-classic:1.2.3). For: ossf_scorecard | |
| text | No | Search by dependency name or package URL. For: sbom_search | |
| limit | No | Results per page (max 100). For: sbom_search, search_org, search_repo | |
| action | Yes | Which operation to perform | |
| cursor | No | Pagination cursor. For: sbom_search, search_org, search_repo | |
| reason | No | Reason for ignoring. Required for: ignore | |
| status | No | Filter by status (OnTrack, DueSoon, Overdue, ClosedOnTime, ClosedLate, Ignored). For: search_org, search_repo | |
| comment | No | Optional explanation comment. For: ignore | |
| category | No | Filter by security category (e.g., Injection, XSS, CSRF). For: search_org, search_repo | |
| priority | No | Filter by priority. For: search_org, search_repo | |
| provider | No | Git provider. For: dashboard, ignore, sbom_search, search_org, search_repo | |
| scanType | No | Filter by scan type. For: search_org, search_repo | |
| srmItemId | No | SRM item identifier. Required for: ignore | |
| repository | No | Repository name. For: dashboard, search_repo | |
| organization | No | Organization name. For: dashboard, ignore, sbom_search, search_org, search_repo | |
| riskCategory | No | Filter by risk classification. For: sbom_search | |
| findingSeverity | No | Filter by vulnerability severity. For: sbom_search |