Codna

Official

Overview Schema Source Related Servers Discussions Admin

codna_secure

Read-onlyIdempotent

Prove which scanner findings are exploitable and production-reachable by classifying SARIF 2.1.0 reports from CodeQL, Semgrep, Snyk, or Trivy.

Instructions

Prove which scanner findings are reachable. Ingests a SARIF 2.1.0 report (CodeQL / Semgrep / Snyk / Trivy), classifies each finding (exploitable / production-reachable / unreachable / unknown) via the local engine, and reports which are autofix-eligible. Read-only, deterministic, 0 LLM tokens — the SARIF file is the only input read; the repo is never scanned and the agent sidecar never starts.

sarif_path is REQUIRED (see the input schema) — there is no workspace scan or default-path fallback. SARIF provenance (tool name + revision) must be complete or the report is rejected. All failures come back as 'codna_secure error: ...' text — the tool never raises.

Requires the one-time free codna login device authorization (free community license); fully offline thereafter.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`ref`	No	Branch, tag, or commit the SARIF was produced from. Accepted for parity with `codna secure --ref`; informational only in the MCP path — the local SARIF-only classifier does not resolve it. Default ''.
`repo`	No	Repository the findings belong to (a local path or a git URL), echoed as 'repository' in the output for traceability. The classification reads ONLY the SARIF file — repo is never scanned. Default '.': the current directory, or the server default set by `codna mcp start --repo` (env CODNA_MCP_DEFAULT_REPO).	.
`sarif_path`	Yes	Path to the scanner's SARIF 2.1.0 report (CodeQL, Semgrep, Snyk, Trivy, or any other scanner). REQUIRED — there is no auto-discovery: omitting it fails input validation, and an empty string returns 'codna_secure error: sarif_path is required'.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv0.1.5Sep 25, 2026

addedInput schema / properties / ref / description

Added value: +"Branch, tag, or commit the SARIF was produced from. Accepted for parity with `codna secure --ref`; informational only in the MCP path — the local SARIF-only classifier does not resolve it. Default ''."

addedInput schema / properties / repo / description

Added value: +"Repository the findings belong to (a local path or a git URL), echoed as 'repository' in the output for traceability. The classification reads ONLY the SARIF file — repo is never scanned. Default '.': the current directory, or the server default set by `codna mcp start --repo` (env CODNA_MCP_DEFAULT_REPO)."

removedInput schema / properties / sarif_path / default
```
Removed value: -""
```

addedInput schema / properties / sarif_path / description

Added value: +"Path to the scanner's SARIF 2.1.0 report (CodeQL, Semgrep, Snyk, Trivy, or any other scanner). REQUIRED — there is no auto-discovery: omitting it fails input validation, and an empty string returns 'codna_secure error: sarif_path is required'."

addedInput schema / required
```
Added value: +[
+  "sarif_path"
+]
```

First observedv0.1.0Sep 23, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations give readOnlyHint, openWorldHint=false, idempotentHint. The description adds rich context beyond those: deterministic, 0 LLM tokens, repo never scanned, agent sidecar never starts, one-time codna login device authorization required and fully offline thereafter, and all failures returned as 'codna_secure error: ...' text with no raising. No contradiction — read-only matches, openWorld=false matches the no-scan claim, idempotent matches deterministic.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence. Three dense paragraphs each earn their place — core purpose/traits, input requirements/error contract, auth prerequisite — with no dead weight. Slightly verbose but tightly structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return format is covered. The description covers inputs, failure modes, auth, determinism, and absence of side effects. Nothing an agent needs to invoke it correctly is missing; complexity (SARIF ingestion + classification) is well matched by the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds genuine value: sarif_path is REQUIRED with no auto-discovery or fallback, SARIF provenance must be complete or the report is rejected, and repo is echoed only for traceability while never being scanned. These constraints go beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource: 'Prove which scanner findings are reachable,' then details exact mechanics — ingests a SARIF 2.1.0 report (CodeQL/Semgrep/Snyk/Trivy), classifies each finding into four explicit categories, and reports autofix-eligibility. Unambiguous and clearly distinct from the fix/triage/report/recall siblings, establishing this as the read-only analysis step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied ('reports which are autofix-eligible' hints at running before codna_fix) but never explicit. No sibling is named and no when-to-use vs. when-not conditions are given; alternative routing is left to inference. Error behavior and auth prerequisites are documented, but those are behavioral, not selection, guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server