Scan source code for security vulnerabilities (SQL injection, XSS, command injection, path traversal) and hardcoded secrets/credentials. Returns a list of findings with severity, type, and remediation guidance.

Check user or agent input for prompt injection attempts. Detects instruction override, role hijacking, system prompt extraction, delimiter abuse, ChatML injection, jailbreak keywords, and encoding evasion.

Check AI-generated output for PII leaks (email, SSN, credit card, phone, IP) and content policy violations (violence, self-harm, illegal activity). PII is automatically redacted in findings.

Dedicated secret and credential detection. Scans text for AWS keys, GitHub tokens, Stripe keys, private keys, JWTs, Slack tokens, passwords, connection strings, Google API keys, and more. All matched secrets are redacted in findings.

Get the current safety profile configuration including scanner settings and blocked content categories.

Switch to a different safety profile. Available profiles: general, education, healthcare, finance, children. Each profile adjusts scanner sensitivity and blocked categories.

Query the security audit log. Returns recent scan events with timestamps, scan types, finding counts, and input hashes.

Retrieve past security findings from the audit database with optional filters by type, severity, or audit ID.

Get GuardianShield health and configuration status including active profile, enabled scanners, and audit statistics.

Scan a single source file for vulnerabilities and secrets. Auto-detects language from file extension. Returns findings with line numbers, severity, CWE IDs, and remediation.

Recursively scan a directory for vulnerabilities and secrets. Supports extension filtering, exclude patterns, and reports progress. Returns all findings across all scanned files.

Test a regex pattern against sample code. Returns match details including positions and matched text. Useful for developing and debugging custom vulnerability patterns.

Check package dependencies for known vulnerabilities using the OSV.dev database. Provide a list of packages with names, versions, and ecosystems (PyPI or npm).

Sync the local OSV vulnerability database for a given ecosystem. Call this to update the cache before checking dependencies.

Parse a dependency manifest file into a structured list of dependencies. Auto-detects format from the filename. Supports: requirements.txt, package.json, pyproject.toml, package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, go.mod, go.sum, composer.json, composer.lock.

Recursively scan a directory for manifest/lockfiles (requirements.txt, package.json, go.mod, composer.json, etc.), parse dependencies, and check them for known vulnerabilities using the OSV.dev database.

Mark a security finding as a false positive. The finding will be flagged in future scans, and similar patterns at other locations will be annotated as potential false positives.

List active false positive records. Shows findings that have been marked as false positives, with optional filtering by scanner.

Remove a false positive record by its fingerprint. The finding will no longer be flagged in future scans.

List available analysis engines with their capabilities and enabled status. Returns each engine's name, whether it is enabled in the current profile, and its capabilities.

Set which analysis engines are active for code scanning. Accepts a list of engine names to enable for the current session. Available engines can be listed with list_engines.

Export scan findings as SARIF 2.1.0 JSON for GitHub Code Scanning, VS Code, and CI integration

Scan code and save the findings as a baseline JSON file. On subsequent scans with scan_with_baseline, only NEW findings (not in the baseline) are reported.

Scan code and compare against a saved baseline, returning only NEW findings that are not in the baseline. Use save_baseline first to create a baseline.

Scan code and evaluate findings against configurable severity thresholds. Returns a pass/fail/warn verdict suitable for CI pipelines. Exit codes: 0=pass, 1=fail.

Scan multiple files in one call. Returns findings grouped by file with a summary of total findings.

Scan a unified diff (e.g. from git diff) for vulnerabilities. Only added lines are scanned; findings have correct line numbers and file paths from the diff context.