Tools provided
Tools the agent exposes — your AI client calls them automatically when it needs them.
- scan_for_secrets — Check a change for credentials committed in code, tests, fixtures, comments or config, and for secrets shipped inside an app binary where they are readable by anyone.read-only
- check_auth_and_authz — Check that a change authorizes as well as authenticates — that knowing who someone is has not been mistaken for knowing what they may do — and that the server enforces independently of the client.read-only
- check_data_exposure — Trace where sensitive data goes in a change — responses, logs, analytics, crash reports, third-party SDKs, device storage and backups — and flag what leaves that should not.read-only
- check_injection_and_redirects — Check for injection through constructed queries, commands or markup, and for deep links and redirects that accept a destination from outside the app.read-only
- review_dependency_changes — Scrutinise added, upgraded or downgraded dependencies for supply-chain risk, treating every addition as a permanent commitment and every downgrade as worth explaining.read-only
- draft_security_report — Assemble the security audit with the verdict first, credential exposure separated from everything else, and an explicit statement of what was not examined.read-only
