MCP Tool Reference - CodeAnt AI

Your agent chooses and calls these tools based on your requests. Use this page to write precise requests, set up auto-approval rules, or debug a tool call. It covers the CodeAnt AI MCP server as of CLI 0.5.10. Parameters marked required must be passed. Everything else is optional.

Conventions

Connection parameters

The Hotlist, anti-pattern, cloud, pentest, and API tools act on one authenticated organization and Git-provider connection. They accept these parameters:

Parameter	Type	Description
`org`	string	Organization name. Selected automatically when only one connection matches.
`service`	`github`, `gitlab`, `bitbucket`, `azuredevops`	Git provider of the connection.
`providerBaseUrl`	URL	Provider URL of a self-hosted connection.

Call codeant_scans_orgs to list the connections. If a tool reports multiple matching organizations, pass both org and service. They must match an authenticated connection. providerBaseUrl replaces the connection’s provider URL in the request. Your token is only ever sent to the configured CodeAnt API host.

Repository parameters

The pull request tools call your Git provider directly and accept:

Parameter	Type	Description
`name`	string	Repository in `owner/repo` form. Azure DevOps uses `project/repo`.
`remote`	`github`, `gitlab`, `bitbucket`, `azure`	Git provider.

When omitted, both are detected from the origin remote of the git repository in the server’s working directory. Detection works for github.com, gitlab.com, bitbucket.org, and self-hosted hosts whose name contains the provider name. On Azure DevOps, always pass name. Provider tokens are covered in Pull request tools.

The pull request tools spell Azure DevOps azure. The connection parameter service spells it azuredevops.

Responses and errors

Every tool returns one text content item that holds compact JSON. The exception is the write tool codeant_scans_start, which returns a plain-text message.
Failures set isError: true and return {"error": "<message>"}. codeant_review_local failures return the full review result, including its error. Some messages name the equivalent CLI flag, for example --tenant-id for tenantId or --max-wait for maxWaitSeconds.
Invalid arguments, such as a value outside an enum, are rejected by the MCP SDK with a plain-text Input validation error and isError: true. Unknown parameters are ignored.
A result over 80,000 characters is refused with {"error": "Result too large: …", "hint": "…"}. Narrow the request, or raise CODEANT_MCP_MAX_RESULT_CHARS. See Results and paging.
Responses from tools that take connection parameters include a tenant object that identifies the connection used.

Repositories and scans

codeant_scans_orgs

List the organization connections the current login can access. Takes no parameters. Returns connections (each with organizationName, baseUrl, and service) and the signed-in email. CLI equivalent: codeant scans orgs.

codeant_scans_repos

List repositories connected to CodeAnt in one organization, most recently pushed first.

Parameter	Type	Default	Description
`org`	string	Only connection	Organization name. Required when you have more than one organization.
`search`	string	—	Case-insensitive substring match on the repository name.
`limit`	integer, 1–1000	`100`	Repositories per page.
`offset`	integer	`0`	Pagination offset.
`full`	boolean	`false`	Return complete provider records instead of slim ones.

Returns org, total, offset, limit, next_offset (null on the last page), and repos. Each slim record has full_name, name, private, visibility, default_branch, language, description, archived, and pushed_at. Pass full_name as repo to the other scan tools. CLI equivalent: codeant scans repos (always returns full records).

codeant_scans_history

List recent scans of one repository.

Parameter	Type	Default	Description
`repo`	string	required	Repository in `owner/repo` form.
`branch`	string	—	Only scans of this branch.
`since`	string	—	ISO 8601 date. Only scans newer than this.
`limit`	integer, 1–100	`20`	Maximum scans returned.

CLI equivalent: codeant scans history.

codeant_scans_get

Get the summary of one scan: severity and category counts, without findings.

Parameter	Type	Default	Description
`repo`	string	required	Repository in `owner/repo` form.
`scan`	string	—	Commit SHA of the scan. Takes precedence over `branch`.
`branch`	string	—	Use the latest scan of this branch.
`types`	string	`all`	Comma-separated scan types, for example `sast,secrets`.

With neither scan nor branch, the tool uses the repository’s most recent scan on any branch. CLI equivalent: codeant scans get.

codeant_scans_results

Fetch findings from one scan of one repository. To cover several repositories, call it once per repository. Parallel calls are safe.

Parameter	Type	Default	Description
`repo`	string	required	Repository in `owner/repo` form.
`scan`	string	—	Commit SHA of the scan. Takes precedence over `branch`.
`branch`	string	—	Use the latest scan of this branch.
`types`	string	`all`	Comma-separated: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all`.
`severity`	string	—	Comma-separated severities, for example `critical,high`.
`path`	string	—	File path glob. A pattern without `/`, such as `*.py`, matches at any depth.
`check`	string	—	Case-insensitive regular expression matched against the check ID or name.
`filterDismissed`	boolean	`false`	Exclude dismissed findings. When `false`, dismissed findings are returned with `metadata.dismissed`.
`includeFalsePositives`	boolean	`true`	Include false positives, including ones users marked in the app. They carry `metadata.false_positive`.
`fields`	string	All fields	Comma-separated finding fields to return, for example `id,severity,file_path,line_number`.
`limit`	integer, 1–500	`50`	Findings per page.
`offset`	integer	`0`	Pagination offset.

With neither scan nor branch, the tool uses the repository’s most recent scan on any branch. Returns repo, scan, categories, summary (totals by severity and category, before paging), pagination (limit, offset, returned, total, has_more), filters, errors (one entry per scan type that failed), and findings. Each finding has id, category, severity, file_path, line_number, line_range, check_id, check_name, message, rule_id, cwe, cve, package, and metadata. CLI equivalent: codeant scans results or codeant findings repo.

codeant_scans_dismissed

List findings dismissed in the app for one repository. Use it during triage to avoid resurfacing handled findings.

Parameter	Type	Default	Description
`repo`	string	required	Repository in `owner/repo` form.
`analysisType`	`security`, `sast`, `secrets`, `sca`, `iac`, `antipatterns`, `anti_patterns`, `docstring`, `complex_functions`, `dead_code`, `duplicate_code`	`security`	Analysis type. `sast` is an alias for `security`, and `anti_patterns` for `antipatterns`.

CLI equivalent: codeant scans dismissed.

codeant_scans_overrides

List per-finding overrides users set in the app. codeant_scans_results already applies them; use this tool to explain why a finding is hidden or re-rated.

Override	Set in the app with	`analysisType`
False positive	Mark/Unmark false positive	`security`, `iac`
Confidence	Secrets confidence	`secrets`
Severity	Change Severity	`security`, `sca`

Parameter	Type	Default	Description
`repo`	string	required	Repository in `owner/repo` form.
`analysisType`	`security`, `secrets`, `iac`, `sca`	`security`	Analysis type.

CLI equivalent: codeant scans overrides.

Organization Hotlist

codeant_hotlist_list

Query the organization-wide Hotlist, with the same stable IDs, ranking, and filters as the CodeAnt app. Accepts the connection parameters.

Parameter	Type	Default	Description
`search`	string	—	Search title, repository, path, package, CVE, or check ID.
`types`	string array	—	Finding types, case-sensitive: `SAST`, `SCA`, `DAST`, `Secrets`, `IaC`, `Infrastructure`, `AI Exploitation`. Other values return `Invalid filter value`.
`locations`	string array	—	Repositories or cloud accounts.
`severities`	array of `critical`, `high`, `medium`, `low`, `unknown`	—	Severities.
`ticketStatuses`	array of `created`, `not_created`	—	Ticket status.
`compliance`	string array	—	Compliance frameworks. Currently `soc2`.
`validation`	array of `exploit_confirmed`	—	Validation flags.
`limit`	integer, 1–100	`10`	Findings per page.
`cursor`	string	—	`next_cursor` from the previous page.
`all`	boolean	`false`	Fetch every matching page. Large Hotlists can exceed the result size limit.
`maxWaitSeconds`	integer, 0–600	`60`	How long to wait for the first Hotlist build.

Returns items, total_filtered, has_more, next_cursor, summary, and facets. With all, it also returns returned_count. Pass an item’s id to codeant_hotlist_get. CLI equivalent: codeant hotlist list or codeant findings list.

codeant_hotlist_get

Fetch one complete Hotlist finding. Accepts the connection parameters.

Parameter	Type	Default	Description
`findingId`	string	required	32-character stable ID shown in the app or returned by `codeant_hotlist_list`.
`maxWaitSeconds`	integer, 0–600	`60`	How long to wait for the first Hotlist build.

CLI equivalent: codeant hotlist get or codeant findings get.

Anti-patterns

codeant_findings_antipatterns

Fetch anti-pattern findings across selected repositories, or across every repository in the organization. Accepts the connection parameters.

Parameter	Type	Default	Description
`repos`	string array	Every repository	Repositories in `owner/repo` form.
`limit`	`25`, `100`, `500`	`25`	Findings per page.
`offset`	integer	`0`	Start offset, a multiple of `limit`.
`all`	boolean	`false`	Fetch every page from `offset` on.

Returns antipatterns, total, limit, and offset. Request the next page with offset + limit while it’s below total. CLI equivalent: codeant findings antipatterns.

Cloud security

Cloud findings belong to an organization and cloud account, not to a repository.

codeant_cloud_scan_history

List AWS, Azure, or GCP scans. Accepts the connection parameters.

Parameter	Type	Default	Description
`provider`	`aws`, `azure`, `gcp`, `all`	`all`	Cloud provider.
`kind`	`cspm`, `vm`, `container`	`cspm`	Scan kind.
`latest`	boolean	`false`	Return the latest scans instead of the full history. CSPM only.
`limit`	integer, 1–200	`10`	Scans per provider, newest first.
`offset`	integer	`0`	Pagination offset within each provider.
`full`	boolean	`false`	Keep per-service, compliance, and region rollups on each scan. Use it to find the exact compliance keys for the `framework` filter.

With provider: "all", returns providers keyed by provider. Each entry has scans, total, offset, limit, next_offset, and an error if that provider was unavailable. With a single provider, those fields are returned directly. Pass a scan’s scan_id (and account_id, tenant_id, or project_id) to codeant_cloud_findings_list. CLI equivalent: codeant findings cloud history.

codeant_cloud_findings_list

List findings for one cloud scan. Accepts the connection parameters.

Parameter	Type	Default	Description
`provider`	`aws`, `azure`, `gcp`	required	Cloud provider.
`scanId`	string	required	Scan ID from `codeant_cloud_scan_history`.
`kind`	`cspm`, `vm`, `container`	`cspm`	Scan kind.
`accountId`	string	—	CSPM: AWS account ID.
`tenantId`	string	—	CSPM: Azure tenant ID. Required for Azure.
`projectId`	string	—	CSPM: GCP project ID. Required for GCP.
`cloudService`	string	—	CSPM: cloud service, for example `ec2`.
`severity`	string	—	CSPM: severity, for example `critical` or `high`.
`status`	string	—	CSPM: check status. Pass `FAIL` to skip passing checks.
`framework`	string	—	CSPM: exact compliance key as it appears in the scan’s `compliance_rollup`, for example `CIS-3.0`.
`subscriptionId`	string	—	CSPM: Azure subscription ID.
`exploitAttemptedOnly`	boolean	`false`	CSPM, AWS: only findings with exploit attempts.
`minDaysUnused`	integer	—	CSPM: minimum unused age in days.
`limit`	`25`, `100`, `500`	`25`	Findings per page.
`offset`	integer	`0`	Start offset, a multiple of `limit`.
`all`	boolean	`false`	Return every page from `offset` on. Large scans can exceed the result size limit.
`full`	boolean	`false`	Keep each finding’s compliance mappings.

VM and container scans accept only scanId and the paging parameters; the CSPM filters don’t apply to them. Returns findings and total. CSPM responses also include offset, limit, next_offset, dismissed_findings, and dismissed_total. dismissed_findings is returned in full on every page. Each CSPM finding includes uid, check_id, check_title, service, severity, status, resource, region, and dismissal fields. CLI equivalent: codeant findings cloud list (returns every CSPM finding).

codeant_cloud_finding_get

Fetch complete detail for one cloud finding. Accepts the connection parameters.

Parameter	Type	Default	Description
`provider`	`aws`, `azure`, `gcp`	required	Cloud provider.
`scanId`	string	required	Scan ID.
`uid`	string	required	Finding `uid` from `codeant_cloud_findings_list`.
`kind`	`cspm`, `vm`, `container`	`cspm`	Scan kind.
`accountId`	string	—	AWS account ID.
`tenantId`	string	—	Azure tenant ID. Required for Azure CSPM.
`projectId`	string	—	GCP project ID. Required for GCP CSPM.
`cloudService`	string	—	Cloud service of the finding.

CLI equivalent: codeant findings cloud get.

Pentesting

codeant_pentest_history

List pentest engagements, newest first, with status and finding counts. Accepts the connection parameters.

Parameter	Type	Default	Description
`limit`	integer, 1–500	`25`	Engagements per page.
`offset`	integer	`0`	Pagination offset.
`full`	boolean	`false`	Keep credit and billing details on each engagement.

Returns total, offset, limit, next_offset, and history. Each engagement has id, requested_at, testing_type, domains, status, findings (counts by severity), and report_url. Pass id as reportId to the issue and report tools. CLI equivalent: codeant findings pentest history.

codeant_pentest_issues

Fetch the issues for one engagement. The backend applies the same plan-based redaction as the app. Accepts the connection parameters.

Parameter	Type	Default	Description
`reportId`	string	required	Engagement ID from `codeant_pentest_history`.
`variant`	`prod`, `test`	`prod`	Report variant.

CLI equivalent: codeant findings pentest issues.

codeant_pentest_report

Fetch the full customer report for one engagement. The backend applies the same plan-based redaction as the app. Accepts the connection parameters.

Parameter	Type	Default	Description
`reportId`	string	required	Engagement ID from `codeant_pentest_history`.
`variant`	`prod`, `test`	`prod`	Report variant.

CLI equivalent: codeant findings pentest report.

API passthrough

codeant_api_get

Call any authenticated GET endpoint on the configured CodeAnt API host, for read APIs that no dedicated tool covers. Accepts the connection parameters.

Parameter	Type	Default	Description
`path`	string	required	Relative path starting with a single `/`. Absolute URLs and paths starting with `//` are rejected.
`query`	object	—	Query parameters. Values can be strings, numbers, booleans, or string arrays.
`headers`	string array	—	Extra `Name: value` headers. `Authorization`, `Cookie`, `Host`, `Content-Length`, and the `X-CodeAnt-CLI-*` headers can’t be set.

Returns ok, status, tenant, and data. A non-2xx response comes back as a normal result with ok: false, except 403, which fails with an Access denied error. CLI equivalent: codeant api request GET.

Pull requests and comments

These tools accept the repository parameters and need a token for your Git provider.

codeant_pr_list

List pull requests or merge requests.

Parameter	Type	Default	Description
`sourceBranch`	string	—	Source branch.
`author`	string	—	Pull request author.
`state`	`open`, `closed`	`open`	Pull request state.
`limit`	integer, 1–100	`20`	Pull requests per page.
`offset`	integer	`0`	Pagination offset.

Filters and paging depend on the provider:

Provider	`sourceBranch`	`author`	`offset`
GitHub	Exact	Substring of the login, within the fetched page	Rounded down to a multiple of `limit`
GitLab	Exact	Exact username	Rounded down to a multiple of `limit`
Bitbucket	Substring	Substring	Ignored
Azure DevOps	Exact	Azure DevOps identity ID	Ignored

Returns an array of pull requests, without a total. CLI equivalent: codeant pr list.

codeant_pr_get

Fetch one pull request’s provider metadata and reviewer approval states (reviewSummary).

Parameter	Type	Default	Description
`prNumber`	integer	required	Pull request number.

CLI equivalent: codeant pr get.

codeant_pr_comments

List comments on one pull request.

Parameter	Type	Default	Description
`prNumber`	integer	required	Pull request number.
`codeantGenerated`	boolean	—	`true` returns only CodeAnt comments, `false` only other comments. A comment counts as CodeAnt’s when the author name contains “codeant” or the body contains “Suggestion”.
`createdAfter`	string	—	ISO 8601 date.
`createdBefore`	string	—	ISO 8601 date.

On GitLab, Bitbucket, and Azure DevOps, each comment has a resolved field. GitHub comments don’t report resolved state. CLI equivalent: codeant pr comments.

codeant_comments_search

Search review comments in one repository by text. The tool reads comments on the 10 most recently updated pull requests (open ones only on Bitbucket and Azure DevOps; inline review comments only on GitHub) and returns case-insensitive substring matches from every author.

Parameter	Type	Default	Description
`query`	string	required	Search text.
`limit`	integer, 1–50	`10`	Maximum matching comments returned.

Each result has prNumber, prTitle, id, author, body, path, line, createdAt, and isCodeantComment. Filter on isCodeantComment for CodeAnt’s comments. CLI equivalent: codeant comments search.

Local review

codeant_review_local

Run a CodeAnt AI review of local changes in the git repository in the server’s working directory. It needs a client that starts the server inside your project, such as Claude Code. It never modifies files.

Parameter	Type	Default	Description
`scope`	`all`, `uncommitted`, `staged-only`, `committed`, `last-commit`, `last-n-commits`, `base-branch`, `base-commit`	`uncommitted`	Which changes to review.
`lastNCommits`	integer, 1–5	`1`	Commit count for `last-n-commits`.
`baseBranch`	string	—	Branch to compare against for `base-branch`.
`baseCommit`	string	—	Commit to compare against for `base-commit`.
`include`	string array	—	File globs to include.
`exclude`	string array	—	File globs to exclude.

The review sends the diff and the full current contents of each changed file to CodeAnt, and the reviewer can read, list, and search other repository files for context. Returns issues, meta (including the reviewed files), and error. When error is set, for example Could not find a .git directory., the result has isError: true. noFiles: true means there were no changes in scope. CLI equivalent: codeant review --headless. The CLI defaults to --all, while this tool defaults to uncommitted.

Authentication

codeant_login

Start browser sign-in to CodeAnt AI.

Parameter	Type	Default	Description
`force`	boolean	`false`	Sign in again even if a token is already configured.

Response	Meaning
`{"alreadyLoggedIn": true}`	A token is already configured.
`{"status": "pending", "loginUrl": "…", "browserOpened": true, "message": "…"}`	Sign-in started, or the user hasn’t finished yet. Show `loginUrl` to the user, who must finish within 10 minutes, then call `codeant_login` again. The server checks about every 10 seconds.
`{"status": "success", "token": "cli___ab…"}`	Sign-in finished. The token is saved to `~/.codeant/config.json`. The response shows only its first 8 characters.
`isError` with `Could not determine the dashboard URL`	Self-hosted: set `CODEANT_DASHBOARD_URL` or run `codeant set-dashboard-url`.
`isError` with `Login timed out` or another message	Sign-in failed. The next call to `codeant_login` starts a new sign-in.

Concurrent calls share one sign-in. The pending sign-in lives in the server process, so if the client restarts the server before the user finishes, call codeant_login again. CLI equivalent: codeant login.

codeant_logout

Revoke the token on the server, remove it from ~/.codeant/config.json, unset CODEANT_API_TOKEN in the server process, and cancel a pending sign-in. Takes no parameters. Because the CLI shares the config file, the CLI is signed out too. Returns wasLoggedIn, serverRevoked, status (logged_out or not_logged_in), and a warning if server revocation couldn’t be confirmed. CLI equivalent: codeant logout.

Write tools

Registered only when CODEANT_READ_ONLY=0. See Enable write tools.

Tool	Required parameters	Optional parameters
`codeant_scans_start`	—	`repo`, `branch`, and `commit` (auto-detected from the working directory’s local Git context when omitted), `include`, `exclude` (globs, comma-separated)
`codeant_pr_resolve`	`prNumber`	`name`, `remote`, and one of `commentId` (GitHub, Bitbucket), `threadId` (GitHub, Azure DevOps), or `discussionId` (GitLab), taken from `codeant_pr_comments`
`codeant_api_request`	`method` (`POST`, `PUT`, `PATCH`, `DELETE`), `path`	connection parameters, `query`, `body`, `headers`

​Conventions

​Connection parameters

​Repository parameters

​Responses and errors

​Repositories and scans

​codeant_scans_orgs

​codeant_scans_repos

​codeant_scans_history

​codeant_scans_get

​codeant_scans_results

​codeant_scans_dismissed

​codeant_scans_overrides

​Organization Hotlist

​codeant_hotlist_list

​codeant_hotlist_get

​Anti-patterns

​codeant_findings_antipatterns

​Cloud security

​codeant_cloud_scan_history

​codeant_cloud_findings_list

​codeant_cloud_finding_get

​Pentesting

​codeant_pentest_history

​codeant_pentest_issues

​codeant_pentest_report

​API passthrough

​codeant_api_get

​Pull requests and comments

​codeant_pr_list

​codeant_pr_get

​codeant_pr_comments

​codeant_comments_search

​Local review

​codeant_review_local

​Authentication

​codeant_login

​codeant_logout

​Write tools

Conventions

Connection parameters

Repository parameters

Responses and errors

Repositories and scans

codeant_scans_orgs

codeant_scans_repos

codeant_scans_history

codeant_scans_get

codeant_scans_results

codeant_scans_dismissed

codeant_scans_overrides

Organization Hotlist

codeant_hotlist_list

codeant_hotlist_get

Anti-patterns

codeant_findings_antipatterns

Cloud security

codeant_cloud_scan_history

codeant_cloud_findings_list

codeant_cloud_finding_get

Pentesting

codeant_pentest_history

codeant_pentest_issues

codeant_pentest_report

API passthrough

codeant_api_get

Pull requests and comments

codeant_pr_list

codeant_pr_get

codeant_pr_comments

codeant_comments_search

Local review

codeant_review_local

Authentication

codeant_login

codeant_logout

Write tools