Tools provided
Tools the agent exposes — your AI client calls them automatically when it needs them.
- run_full — Orchestrated path: CVSS-classify a provided scanner batch against OWASP, CWE and your company Custom Instructions, triage false positives, and return the full security report with findings, a proposed patch PR that is never auto-merged, and regression tests.
- analyze — Run pure deterministic CVSS analysis over provided scanner hits with no model call, excluding triaged false positives, and return scored findings worst first.
- triage_false_positives — Triage the provided hits: return how many were marked SAST or SCA false positives and exactly which ones were excluded from the actionable list.
- count_custom_instruction_hits — Count and list the actionable hits that came from a company Custom Instruction rule rather than a generic OWASP or CWE rule.
- compute_max_cvss — Return the highest CVSS v3.1 base score among the actionable, non-false-positive hits, with its severity band.
- list_capabilities — List the agent's static capabilities: the available tools and a short description of the security pipeline. Useful for discovery.
- plan_inputs — Plan the inputs for a tool: returns the clarifying questions, the JSON schema and a ready-to-edit example.
- discover_intent — Understand your goal and co-design the exact input through clarifying questions before running.
- open_form — Opens the guided form to collect the project, repo and scan batch. The entry point for running the agent on your own data.
- run_form — Internal: invoked by the guided form when the user submits. Not for direct use.
