check_auth_strength
Scans Go source files to detect weak authentication violations (hardcoded passwords, short password policies, missing MFA on payment routes) mapped to PCI DSS 8.3.1, 8.3.6, and 8.4.2.
Instructions
Scan Go source files for weak authentication: hardcoded passwords (PCI DSS 8.3.1), password policy with minimum length below 12 (PCI DSS 8.3.6), and payment routes missing MFA middleware (PCI DSS 8.4.2). Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns / min_severity / rule_filter for a filtered flat response. Maps findings to PCI DSS 8.3.1, 8.3.6, 8.4.2.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | required,Path to the Go project directory to scan for authentication strength violations | |
| exclude_patterns | No | Optional glob patterns to exclude. Supports directory patterns (vendor/) and file globs (*.pb.go). Default: vendor/ generated/ *.pb.go testdata/ mocks/ | |
| include_tests | No | Include _test.go files in scan results. Default false excludes test files per industry SAST consensus | |
| include_untracked | No | Scan all files including .gitignored. Default false scans only git-tracked files | |
| cursor | No | Opaque cursor token from a prior check_auth_strength response. When set resumes pagination from the stored session cache (10-minute TTL). Leave empty for a fresh scan. | |
| limit | No | Maximum number of findings to return per call. Default 0 (summary-first response with next_cursor). To fetch more findings than fit in one response, follow next_cursor; do NOT raise this value to fetch all at once (server caps at the per-tool page size and rejects with LIMIT_EXCEEDS_PAGE_SIZE). | |
| min_severity | No | Filter by minimum severity (CRITICAL/HIGH/MEDIUM/LOW/INFO). Setting this forces the flat response shape. | |
| rule_filter | No | Filter by rule ID, comma list or /regex/. Setting this forces the flat response shape. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||