Tools provided
Tools the agent exposes — your AI client calls them automatically when it needs them.
- scan_security — Review a parsed Terraform or Helm plan you supply for resources this change would expose to the public internet: security-group ingress open to 0.0.0.0/0 or ::/0, and S3 buckets made publicly readable.
- check_least_privilege — Review a parsed Terraform or Helm plan you supply for IAM policies that grant more than the workload needs, and how to scope each one down.
- review_dependency_audit — Read the security-audit report you supply and classify every vulnerable package: the semver jump, the advisory severity, and whether a usable fix exists at all.
- plan_upgrades — Turn the audit report you supply into one upgrade proposal per vulnerable package: the version bump, ordered migration steps, a PR title, and whether a human has to review it.
- score_upgrade_risk — Score how likely each upgrade in the audit report you supply is to break the build, and return the weight table used so every score can be recomputed by hand.
- run_full — Run every capability you supplied the input for, in registry order, and return one report. Capabilities whose input is missing are listed as skipped.
- list_capabilities — List what this agent can do: every tool it advertises, what each one is for, and the arguments each one reads.
- plan_inputs — Plan the inputs for a tool: returns the questions to ask, the JSON schema of the arguments, and a ready-to-edit example.
- discover_intent — Understand your goal and co-design the exact input through clarifying questions before anything runs.
- open_form — Opens an interactive form that collects the run arguments. The form is the entry point for running the agent.
- run_form — Internal: invoked by the open_form form when the user submits. Not for direct use.
