Security Assurance Tools

security:assess accepts supplied evidence and returns an assessment report. See the pack guide for the strict normalized/SARIF input subset, policy settings, errors and provenance. Every reported finding remains UNVALIDATED.

Tool Summary

Tool	Permission	Required approvals	Required scopes
security:assess	read	None	network off

Tool Details

security:assess

• Permission: read
• Required approvals: None
• Required scopes: network off

Input schema

{
  "type": "object",
  "properties": {
    "sources": {
      "type": "array",
      "items": {}
    }
  },
  "required": ["sources"],
  "additionalProperties": false
}

Output schema

Not declared in the pack manifest.

The manifest rejects invalid outer envelopes and unknown root fields before dispatch with INVALID_INPUT. Its unprojected array items preserve raw source snapshots and key order for digesting. The handler validates the documented strict input subset and rejects malformed snapshot content with SECURITY_INPUT_INVALID. Canonical policy comes from trusted host context; caller input and selector metadata cannot replace it.

Success returns success: true with data: status, policy decision, raw occurrence_count, deduplicated finding_count, input_bytes, source IDs/formats/digests, effective_policy, configuration_digest, findings with origins/dispositions/recommendations, and a summary. Failure returns success: false with an error code and actionable message. No scanner, remote retrieval, provider write or certification is performed. Future billing remains unvalidated.