scan_pan_data
Scan a Go project directory for credit card data (PAN, CVV) exposure compliant with PCI DSS v4.0.1. Filter by severity, rule, or exclude patterns. Supports paginated results and taint analysis.
Instructions
Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns for a filtered flat response. Maps findings to PCI DSS 3.3.1, 3.4.1, 3.5.1.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | required,Path to the Go project directory to scan for PAN/CVV data exposure | |
| exclude_patterns | No | Optional glob patterns to exclude. Supports directory patterns (vendor/) and file globs (*.pb.go). Default: vendor/ generated/ *.pb.go testdata/ mocks/ | |
| include_tests | No | Include _test.go files in scan results. Default false excludes test files per industry SAST consensus | |
| include_untracked | No | Scan all files including .gitignored. Default false scans only git-tracked files | |
| include_taint | No | Enable flow-based severity adjustment using go/packages type analysis. When true PAN-KEYWORD/PAN-TYPE findings on transit-only struct fields are downgraded or suppressed. Adds 5-30 seconds. Default false (opt-in for accuracy vs speed) | |
| cursor | No | Opaque cursor token from a prior scan_pan_data response. When set resumes pagination from the stored session cache (10-minute TTL). Leave empty for a fresh scan. | |
| limit | No | Maximum number of findings to return per call. Default 0 (summary-first response with next_cursor). To fetch more findings than fit in one response, follow next_cursor; do NOT raise this value to fetch all at once (server caps at the per-tool page size and rejects with LIMIT_EXCEEDS_PAGE_SIZE). | |
| min_severity | No | Filter by minimum severity (CRITICAL/HIGH/MEDIUM/LOW/INFO). Setting this forces the flat response shape. | |
| rule_filter | No | Filter by rule ID, comma list or /regex/. Setting this forces the flat response shape. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||