FlawPilot

Queue a scan of a connected git repository's SOURCE CODE across one or more dimensions (SAST, SCA, SECRETS, CODE_QUALITY). Use when the user asks to "scan my repo for vulnerabilities", "check my code for security issues", or "run a dependency/secrets scan on my repository". NOT for a live website (use trigger_scan for a quick check or trigger_site_health for a full crawl). integrationRepoId, dimensions, and email are all required - if any are missing, this tool returns guidance on what to ask the user instead of scanning.

trigger_code_scan

(Code scan findings.) List findings (severity, file/line, rule, description) for a completed code scan job. Empty results mean either the job isn't COMPLETED yet (check get_code_scan_status first) or it completed clean.

get_code_scan_findings

(Code scan, not quick scan or site health.) Get the current status, and (per completed dimension) score and findings count, for a code scan run by scanRunId - a top-line summary, not per-finding detail. Use get_code_scan_findings for the findings themselves.

get_code_scan_status

Queue a full, multi-page crawl of an entire website (Lighthouse-style), scoring performance/accessibility/best-practices/SEO separately for every page discovered. Slower than trigger_scan (can take minutes) - use for a comprehensive site audit, not a quick check. Use when the user asks to "audit my whole website", "run a full site health check", or "do a Lighthouse-style audit of every page". NOT for a fast single-URL security check (use trigger_scan) and NOT for scanning source code (use trigger_code_scan). projectId, url, mode, and email are all required - if any are missing, this tool returns guidance on what to ask the user instead of scanning.

trigger_site_health

List the tenant's connected git repos (integrationRepoId, name, fullName, projectId, enabled, branches, connectionStatus). Use this to discover an integrationRepoId before calling trigger_code_scan.

list_integration_repos

List the tenant's projects (projectId, name, status). Use this to discover a projectId before calling trigger_scan, trigger_code_scan, or trigger_site_health. Which to use: a quick single-page security/performance/SEO check → trigger_scan. A full multi-page crawl of the whole site → trigger_site_health. Scanning a connected git repo's source code → trigger_code_scan.

list_projects

(Site health, not quick scan or code scan.) List a project's site health checks (id, status, url, mode, scores, timestamps). Use this to find a siteHealthId before calling get_site_health_status, or to browse history.

list_site_health_checks

(Quick scan, not code scan or site health.) Get the current status, progress, and (if complete) per-pillar scores for a scan by ID - a top-line summary, not per-finding detail. Once status reaches a terminal state, the response also includes a reportLink to the full report page.

get_scan_status

Queue a fast, single-page security/performance/infrastructure/SEO check for one URL (a "quick scan"). Use when the user asks to "scan my site for security issues", "check if my website is secure", or "run a security/performance check on this URL". NOT for crawling every page of a site (use trigger_site_health) and NOT for scanning source code in a git repo (use trigger_code_scan). projectId, pillars, and email are all required - if any are missing, this tool returns guidance on what to ask the user instead of scanning, rather than silently defaulting.

trigger_scan

(Site health, not quick scan or code scan.) Get the current status and (if complete) top-line scores for a site health check by ID - a summary, not per-page or per-finding detail.

get_site_health_status