Scan source files for 0day vulnerabilities using 72+ research-calibrated patterns. Returns structured candidate records with CWE, priority, confidence tiers, data-flow, and grounding anchors.

Calculate CVSS v3.1 base score, severity, and metric breakdown from a vector string.

List vulnerability detection patterns with optional filtering by priority, CWE, language, or vulnerability class.

Profile a target project: detect ecosystem, languages, frameworks, entry points, manifest files, and file manifest with hashes and line counts. Phase 0 of the audit pipeline.

Scan a single file for vulnerabilities and return structured candidate records with grounding anchors (file hash + line count).

Verify a scan candidate: check reachability, run 7-class confounder elimination, calibrate CVSS score, and generate per-CWE PoC template. Requires high/medium confidence and cleared confounders for CONFIRMED status.

Trace data flow from entry point to sink for a scan candidate. Returns reachability status, data-flow path, auth gates, sanitizers, and confidence level.

Generate a per-CWE Proof-of-Concept template with setup, trigger, expected output, cleanup, and Dockerfile.

Generate a security report from verified findings. Mode A = internal audit report, Mode B = GHSA advisory draft, Mode C = public writeup.

Synthesize verified findings into multi-step, publication-grade exploit chains (e.g. Traversal + Write -> Persistent RCE; Header Injection -> Agent Escape).

Generate a contextual fix based on candidate line range, actual snippet, and verified finding.

Check if a fix has been applied at ALL vulnerable call sites in a file, cross-referenced with known candidates.

List all available per-CWE fix templates with their fix class and description.

Run the full resilient 0day audit pipeline: Scan → Verify → Chain → Report → Fix. Writes complete persistent artifacts into mcp2agy_workspace/runs// and returns a compact executive summary.

Detect the current host operating system (Windows, Linux, macOS), architecture, shell, homedir, path separators, permission commands, and OS-specific vulnerability nuances.