check_encryption
Scan Go source for weak hash algorithms, hardcoded encryption keys, and plain HTTP URLs. Maps findings to PCI DSS 4.0.1 requirements for compliance validation.
Instructions
Scan Go source files for encryption violations: weak hash algorithms (md5/sha1) with context scoring, hardcoded encryption keys/IVs, and plain HTTP URLs. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns / min_severity / rule_filter for a filtered flat response. Maps findings to PCI DSS 6.2.4, 4.2.1.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | required,Path to the Go project directory to scan for encryption violations | |
| exclude_patterns | No | Optional glob patterns to exclude. Supports directory patterns (vendor/) and file globs (*.pb.go). Default: vendor/ generated/ *.pb.go testdata/ mocks/ | |
| include_tests | No | Include _test.go files in scan results. Default false excludes test files per industry SAST consensus | |
| include_untracked | No | Scan all files including .gitignored. Default false scans only git-tracked files | |
| cursor | No | Opaque cursor token from a prior check_encryption response. When set resumes pagination from the stored session cache (10-minute TTL). Leave empty for a fresh scan. | |
| limit | No | Maximum number of findings to return per call. Default 0 (summary-first response with next_cursor). To fetch more findings than fit in one response, follow next_cursor; do NOT raise this value to fetch all at once (server caps at the per-tool page size and rejects with LIMIT_EXCEEDS_PAGE_SIZE). | |
| min_severity | No | Filter by minimum severity (CRITICAL/HIGH/MEDIUM/LOW/INFO). Setting this forces the flat response shape. | |
| rule_filter | No | Filter by rule ID, comma list or /regex/. Setting this forces the flat response shape. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||