list_rules enumerates audit rules while scan analyzes a config file or directory—two clearly distinct purposes targeting different objects (rule metadata vs. actual files). No overlap or confusion.

list_rules follows a clean verb_noun pattern, but scan is a bare verb without a noun target, a minor deviation from the convention. Still readable and predictable overall.

Two tools is borderline thin for an audit/lint server; listing rules and running a scan are essential, but the surface feels minimal for the apparent scanning domain.

The core discover-then-scan workflow exists, but there's no way to fetch a single rule's detail, filter by severity, or apply/view remediation beyond what list_rules returns. Notable gaps limit deeper audit workflows.