list_detections
List Harden-Runner security detections for a GitHub organization, filtered by detection type (e.g., 'Action-Uses-Imposter-Commit') and status (new, suppressed, resolved).
Instructions
List Harden-Runner detections for an organization, filtered by detection type and status. Common detection IDs: 'Action-Uses-Imposter-Commit', 'Suspicious-Process-Events' (aggregates Runner-Worker-Memory-Read + Reverse-Shell + Privileged-Container), 'Anomalous-Outbound-Network-Call', 'Source-Code-Overwritten', 'Secret-In-Build-Log', 'Harden-Runner-Config-Changed', 'NPM-Package-Upgrade-To-Suspicious-Version', 'Agent-Tampered'.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"owner": "<owner>",
"detectionId": "<detectionId>"
},
"name": "list_detections"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | GitHub organization | |
| detectionId | Yes | Detection type (see description for common values) — required by the API | |
| status | No | Detection status filter. Defaults to 'new'. | |
| tenantWide | No | Query customer/tenant scope instead of owner scope (default: owner) |