cgis_audit_reachability
Find IDOR/authz gaps: list route handlers or functions that never reach a required ownership check, including via Depends(), then return uncovered gaps as JSON.
Instructions
Reachability/authorization audit — which sources never reach a checkpoint.
The headline use is **IDOR/authz coverage**: list every route handler that does
NOT transitively reach an ownership check. Reachability follows behavioral edges
(CALLS *and* FastAPI ``Depends()`` DEPENDS_ON), so a guard wired via DI counts.
Select sources with ``from_type`` (the ``ROUTE_HANDLER`` role — FastAPI handlers on
a router built in the same module — or a NodeType like ``FUNCTION``) and/or
``from_prefix`` (FQN prefix) — at least
one is required. Returns JSON ``{target, covered, gaps}`` where each gap carries
``fqn``/``file``/``line``. Generalizes to validators, event tracking, or
service-layer-boundary rules by pointing ``target`` at the required node.
A selection that matches no source returns a ❌ message, not an empty
``{covered: [], gaps: []}`` that would read as a passing audit (#467).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | Maximum reachability depth; a longer path is reported as a gap. | |
| target | Yes | FQN of the checkpoint every source must reach, e.g. an ownership check. A unique dot-boundary suffix also resolves. | |
| db_path | No | SQLite graph built by cgis_ingest. A relative path resolves against the MCP server's working directory, not the agent's — prefer an absolute path. | graph.db |
| from_type | No | NodeType or role of the sources to audit (any case): ROUTE_HANDLER selects FastAPI handlers on a router built in the same module; a structural type such as FUNCTION selects by type. Give this, from_prefix, or both. | |
| from_prefix | No | Only audit sources at or under this FQN prefix, matched on whole dot-segments. A selection matching no source is an error naming the whole-segment prefixes it may have meant. Combined with from_type when both are given. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |