Scan the project folder on this computer (or one folder inside it) for leaked API keys and for made-up, brand-new, lookalike or vulnerable packages. Use it for a full pass, for example before you say the work is done; after small edits use yof_check_diff, which reads only the changed lines. Files are read locally and never uploaded; only package names and versions go to npm, PyPI and OSV, unless offline is true. It follows .yof.yml and .gitignore, reads at most 20,000 files (stopped_early says so), looks up at most 500 dependencies and gives up after 90 seconds. Returns counts, must_fix_before_done and up to 100 findings with secrets redacted; an empty list means nothing was found within those limits.

Scan only the lines that changed: a unified diff you pass in, or, with no diff, the working tree against the last commit plus new untracked files (needs git). Use it after each edit and before you say the work is done; use yof_check for a full pass that also covers unchanged files. Only added lines are checked for keys, and only dependencies added to a changed manifest are looked up on npm, PyPI and OSV; code never leaves this computer. Limits: 1 MB of diff, 300 files and 90 seconds. Returns counts, must_fix_before_done and up to 100 findings with secrets redacted; an empty list means nothing was found in the changed lines.

Explain one yof rule in plain words: what it means, why it matters, how urgent it is and the safe fix. Use it to understand a finding from yof_check, yof_check_diff or yof_findings; use yof_fix_prompt instead for step-by-step instructions for one specific finding. Key rules (secret.) and package rules (package.) are answered on this computer without reading project files; any other rule id is asked of yof.io only when YOF_API_KEY is set, and is an error otherwise. Returns rule, name (or title from yof.io), severity, why and safe_fix.

Write step-by-step instructions to fix one finding, with any secret shown only as a short prefix plus REDACTED. Use it after yof_check, yof_check_diff or yof_findings reports a finding; use yof_explain for background on a rule, and yof_verify once the fix is made. For a key rule pass file (and line), which yof reads locally to find the value; for a package rule pass package. A finding_id, or a rule this computer does not know, is sent to yof.io and needs YOF_API_KEY. Returns rule and instructions, plus file, line and still_in_file for a key finding.

Re-scan one file on this computer and report whether a finding is gone. Use it right after fixing something yof_check, yof_check_diff or yof_fix_prompt pointed to; it reads only that file, so run yof_check_diff afterwards to cover the rest of the change. With no rule_id it looks for every key rule (secret.*); a package rule needs package and asks npm, PyPI and OSV unless offline is true. A missing file, or one over 1 MB, counts as fixed. Returns file, rule, fixed (true, false, or null when a registry did not answer), why, and for key rules the matches still there, redacted.

List open findings stored in your yof.io account: problems yof found on your proven apps' live sites and connected GitHub repositories. Use it to see what yof.io already knows; it does not scan this computer (use yof_check or yof_check_diff for that), and yof_fix_prompt takes a finding id from here. Needs YOF_API_KEY; sends only these arguments to yof.io and returns results from yof's latest checks, most recently seen first. Returns findings (id, app, rule, title, severity, where, redacted value, first and last seen) and next; an empty list means no open findings, and apps not proven yours are left out.

List Patch's open fix pull requests from your yof.io account, with the state of each one's CI checks. Use it to see whether a fix Patch proposed is waiting, passing or failing; use yof_lessons for fixes already merged, and yof_findings for problems with no pull request yet. Needs YOF_API_KEY; sends only app_id to yof.io, which answers from what it last stored (up to 50, newest first) without asking GitHub again. Returns open (repository, number, url, draft, rule, title, checks, failed_checks, opened) and a note; an empty list means Patch has no open pull request.

List short lessons from Patch fixes merged in your projects: what was fixed, in which pull request, whether yof's next check confirmed it, and how to avoid it next time. Use it before writing similar code so the same problem does not come back; use yof_patch_status for pull requests still open. Needs YOF_API_KEY; sends only app_id to yof.io, which answers from stored data (up to 50 merged pull requests, most recently opened first). Returns lessons (repository, pull_request, merged, rule, note, avoid_next_time); an empty list means no Patch fix has been merged yet.