> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Tool Reference

> Parameters, defaults, and key response fields for every tool in the CodeAnt AI MCP server

Your agent chooses and calls these tools based on your requests. Use this page to write precise requests, set up auto-approval rules, or debug a tool call. It covers the [CodeAnt AI MCP server](/cli/mcp-server) as of CLI 0.5.10. Parameters marked **required** must be passed. Everything else is optional.

## Conventions

### Connection parameters

The Hotlist, anti-pattern, cloud, pentest, and API tools act on one authenticated organization and Git-provider connection. They accept these parameters:

| Parameter | Type | Description |
| - | - | - |
| `org` | string | Organization name. Selected automatically when only one connection matches. |
| `service` | `github`, `gitlab`, `bitbucket`, `azuredevops` | Git provider of the connection. |
| `providerBaseUrl` | URL | Provider URL of a self-hosted connection. |

Call [`codeant_scans_orgs`](#codeant_scans_orgs) to list the connections. If a tool reports multiple matching organizations, pass both `org` and `service`. They must match an authenticated connection. `providerBaseUrl` replaces the connection's provider URL in the request. Your token is only ever sent to the configured CodeAnt API host.

### Repository parameters

The pull request tools call your Git provider directly and accept:

| Parameter | Type | Description |
| - | - | - |
| `name` | string | Repository in `owner/repo` form. Azure DevOps uses `project/repo`. |
| `remote` | `github`, `gitlab`, `bitbucket`, `azure` | Git provider. |

When omitted, both are detected from the `origin` remote of the git repository in the server's working directory. Detection works for github.com, gitlab.com, bitbucket.org, and self-hosted hosts whose name contains the provider name. On Azure DevOps, always pass `name`. Provider tokens are covered in [Pull request tools](/cli/mcp-server#pull-request-tools).

<Warning>
  The pull request tools spell Azure DevOps `azure`. The connection parameter `service` spells it `azuredevops`.
</Warning>

### Responses and errors

* Every tool returns one text content item that holds compact JSON. The exception is the write tool `codeant_scans_start`, which returns a plain-text message.
* Failures set `isError: true` and return `{"error": "<message>"}`. `codeant_review_local` failures return the full review result, including its `error`. Some messages name the equivalent CLI flag, for example `--tenant-id` for `tenantId` or `--max-wait` for `maxWaitSeconds`.
* Invalid arguments, such as a value outside an enum, are rejected by the MCP SDK with a plain-text `Input validation error` and `isError: true`. Unknown parameters are ignored.
* A result over 80,000 characters is refused with `{"error": "Result too large: …", "hint": "…"}`. Narrow the request, or raise `CODEANT_MCP_MAX_RESULT_CHARS`. See [Results and paging](/cli/mcp-server#results-and-paging).
* Responses from tools that take connection parameters include a `tenant` object that identifies the connection used.

## Repositories and scans

### codeant\_scans\_orgs

List the organization connections the current login can access. Takes no parameters.

Returns `connections` (each with `organizationName`, `baseUrl`, and `service`) and the signed-in `email`.

CLI equivalent: `codeant scans orgs`.

### codeant\_scans\_repos

List repositories connected to CodeAnt in one organization, most recently pushed first.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `org` | string | Only connection | Organization name. Required when you have more than one organization. |
| `search` | string | — | Case-insensitive substring match on the repository name. |
| `limit` | integer, 1–1000 | `100` | Repositories per page. |
| `offset` | integer | `0` | Pagination offset. |
| `full` | boolean | `false` | Return complete provider records instead of slim ones. |

Returns `org`, `total`, `offset`, `limit`, `next_offset` (`null` on the last page), and `repos`. Each slim record has `full_name`, `name`, `private`, `visibility`, `default_branch`, `language`, `description`, `archived`, and `pushed_at`. Pass `full_name` as `repo` to the other scan tools.

CLI equivalent: `codeant scans repos` (always returns full records).

### codeant\_scans\_history

List recent scans of one repository.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repo` | string | **required** | Repository in `owner/repo` form. |
| `branch` | string | — | Only scans of this branch. |
| `since` | string | — | ISO 8601 date. Only scans newer than this. |
| `limit` | integer, 1–100 | `20` | Maximum scans returned. |

CLI equivalent: `codeant scans history`.

### codeant\_scans\_get

Get the summary of one scan: severity and category counts, without findings.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repo` | string | **required** | Repository in `owner/repo` form. |
| `scan` | string | — | Commit SHA of the scan. Takes precedence over `branch`. |
| `branch` | string | — | Use the latest scan of this branch. |
| `types` | string | `all` | Comma-separated scan types, for example `sast,secrets`. |

With neither `scan` nor `branch`, the tool uses the repository's most recent scan on any branch.

CLI equivalent: `codeant scans get`.

### codeant\_scans\_results

Fetch findings from one scan of one repository. To cover several repositories, call it once per repository. Parallel calls are safe.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repo` | string | **required** | Repository in `owner/repo` form. |
| `scan` | string | — | Commit SHA of the scan. Takes precedence over `branch`. |
| `branch` | string | — | Use the latest scan of this branch. |
| `types` | string | `all` | Comma-separated: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all`. |
| `severity` | string | — | Comma-separated severities, for example `critical,high`. |
| `path` | string | — | File path glob. A pattern without `/`, such as `*.py`, matches at any depth. |
| `check` | string | — | Case-insensitive regular expression matched against the check ID or name. |
| `filterDismissed` | boolean | `false` | Exclude dismissed findings. When `false`, dismissed findings are returned with `metadata.dismissed`. |
| `includeFalsePositives` | boolean | `true` | Include false positives, including ones users marked in the app. They carry `metadata.false_positive`. |
| `fields` | string | All fields | Comma-separated finding fields to return, for example `id,severity,file_path,line_number`. |
| `limit` | integer, 1–500 | `50` | Findings per page. |
| `offset` | integer | `0` | Pagination offset. |

With neither `scan` nor `branch`, the tool uses the repository's most recent scan on any branch.

Returns `repo`, `scan`, `categories`, `summary` (totals by severity and category, before paging), `pagination` (`limit`, `offset`, `returned`, `total`, `has_more`), `filters`, `errors` (one entry per scan type that failed), and `findings`. Each finding has `id`, `category`, `severity`, `file_path`, `line_number`, `line_range`, `check_id`, `check_name`, `message`, `rule_id`, `cwe`, `cve`, `package`, and `metadata`.

CLI equivalent: `codeant scans results` or `codeant findings repo`.

### codeant\_scans\_dismissed

List findings dismissed in the app for one repository. Use it during triage to avoid resurfacing handled findings.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repo` | string | **required** | Repository in `owner/repo` form. |
| `analysisType` | `security`, `sast`, `secrets`, `sca`, `iac`, `antipatterns`, `anti_patterns`, `docstring`, `complex_functions`, `dead_code`, `duplicate_code` | `security` | Analysis type. `sast` is an alias for `security`, and `anti_patterns` for `antipatterns`. |

CLI equivalent: `codeant scans dismissed`.

### codeant\_scans\_overrides

List per-finding overrides users set in the app. `codeant_scans_results` already applies them; use this tool to explain why a finding is hidden or re-rated.

| Override | Set in the app with | `analysisType` |
| - | - | - |
| False positive | **Mark/Unmark false positive** | `security`, `iac` |
| Confidence | Secrets confidence | `secrets` |
| Severity | **Change Severity** | `security`, `sca` |

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repo` | string | **required** | Repository in `owner/repo` form. |
| `analysisType` | `security`, `secrets`, `iac`, `sca` | `security` | Analysis type. |

CLI equivalent: `codeant scans overrides`.

## Organization Hotlist

### codeant\_hotlist\_list

Query the organization-wide Hotlist, with the same stable IDs, ranking, and filters as the CodeAnt app. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `search` | string | — | Search title, repository, path, package, CVE, or check ID. |
| `types` | string array | — | Finding types, case-sensitive: `SAST`, `SCA`, `DAST`, `Secrets`, `IaC`, `Infrastructure`, `AI Exploitation`. Other values return `Invalid filter value`. |
| `locations` | string array | — | Repositories or cloud accounts. |
| `severities` | array of `critical`, `high`, `medium`, `low`, `unknown` | — | Severities. |
| `ticketStatuses` | array of `created`, `not_created` | — | Ticket status. |
| `compliance` | string array | — | Compliance frameworks. Currently `soc2`. |
| `validation` | array of `exploit_confirmed` | — | Validation flags. |
| `limit` | integer, 1–100 | `10` | Findings per page. |
| `cursor` | string | — | `next_cursor` from the previous page. |
| `all` | boolean | `false` | Fetch every matching page. Large Hotlists can exceed the result size limit. |
| `maxWaitSeconds` | integer, 0–600 | `60` | How long to wait for the first Hotlist build. |

Returns `items`, `total_filtered`, `has_more`, `next_cursor`, `summary`, and `facets`. With `all`, it also returns `returned_count`. Pass an item's `id` to `codeant_hotlist_get`.

CLI equivalent: `codeant hotlist list` or `codeant findings list`.

### codeant\_hotlist\_get

Fetch one complete Hotlist finding. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `findingId` | string | **required** | 32-character stable ID shown in the app or returned by `codeant_hotlist_list`. |
| `maxWaitSeconds` | integer, 0–600 | `60` | How long to wait for the first Hotlist build. |

CLI equivalent: `codeant hotlist get` or `codeant findings get`.

## Anti-patterns

### codeant\_findings\_antipatterns

Fetch anti-pattern findings across selected repositories, or across every repository in the organization. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `repos` | string array | Every repository | Repositories in `owner/repo` form. |
| `limit` | `25`, `100`, `500` | `25` | Findings per page. |
| `offset` | integer | `0` | Start offset, a multiple of `limit`. |
| `all` | boolean | `false` | Fetch every page from `offset` on. |

Returns `antipatterns`, `total`, `limit`, and `offset`. Request the next page with `offset` + `limit` while it's below `total`.

CLI equivalent: `codeant findings antipatterns`.

## Cloud security

Cloud findings belong to an organization and cloud account, not to a repository.

### codeant\_cloud\_scan\_history

List AWS, Azure, or GCP scans. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `provider` | `aws`, `azure`, `gcp`, `all` | `all` | Cloud provider. |
| `kind` | `cspm`, `vm`, `container` | `cspm` | Scan kind. |
| `latest` | boolean | `false` | Return the latest scans instead of the full history. CSPM only. |
| `limit` | integer, 1–200 | `10` | Scans per provider, newest first. |
| `offset` | integer | `0` | Pagination offset within each provider. |
| `full` | boolean | `false` | Keep per-service, compliance, and region rollups on each scan. Use it to find the exact compliance keys for the `framework` filter. |

With `provider: "all"`, returns `providers` keyed by provider. Each entry has `scans`, `total`, `offset`, `limit`, `next_offset`, and an `error` if that provider was unavailable. With a single provider, those fields are returned directly. Pass a scan's `scan_id` (and `account_id`, `tenant_id`, or `project_id`) to `codeant_cloud_findings_list`.

CLI equivalent: `codeant findings cloud history`.

### codeant\_cloud\_findings\_list

List findings for one cloud scan. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `provider` | `aws`, `azure`, `gcp` | **required** | Cloud provider. |
| `scanId` | string | **required** | Scan ID from `codeant_cloud_scan_history`. |
| `kind` | `cspm`, `vm`, `container` | `cspm` | Scan kind. |
| `accountId` | string | — | CSPM: AWS account ID. |
| `tenantId` | string | — | CSPM: Azure tenant ID. Required for Azure. |
| `projectId` | string | — | CSPM: GCP project ID. Required for GCP. |
| `cloudService` | string | — | CSPM: cloud service, for example `ec2`. |
| `severity` | string | — | CSPM: severity, for example `critical` or `high`. |
| `status` | string | — | CSPM: check status. Pass `FAIL` to skip passing checks. |
| `framework` | string | — | CSPM: exact compliance key as it appears in the scan's `compliance_rollup`, for example `CIS-3.0`. |
| `subscriptionId` | string | — | CSPM: Azure subscription ID. |
| `exploitAttemptedOnly` | boolean | `false` | CSPM, AWS: only findings with exploit attempts. |
| `minDaysUnused` | integer | — | CSPM: minimum unused age in days. |
| `limit` | `25`, `100`, `500` | `25` | Findings per page. |
| `offset` | integer | `0` | Start offset, a multiple of `limit`. |
| `all` | boolean | `false` | Return every page from `offset` on. Large scans can exceed the result size limit. |
| `full` | boolean | `false` | Keep each finding's compliance mappings. |

VM and container scans accept only `scanId` and the paging parameters; the CSPM filters don't apply to them.

Returns `findings` and `total`. CSPM responses also include `offset`, `limit`, `next_offset`, `dismissed_findings`, and `dismissed_total`. `dismissed_findings` is returned in full on every page. Each CSPM finding includes `uid`, `check_id`, `check_title`, `service`, `severity`, `status`, `resource`, `region`, and dismissal fields.

CLI equivalent: `codeant findings cloud list` (returns every CSPM finding).

### codeant\_cloud\_finding\_get

Fetch complete detail for one cloud finding. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `provider` | `aws`, `azure`, `gcp` | **required** | Cloud provider. |
| `scanId` | string | **required** | Scan ID. |
| `uid` | string | **required** | Finding `uid` from `codeant_cloud_findings_list`. |
| `kind` | `cspm`, `vm`, `container` | `cspm` | Scan kind. |
| `accountId` | string | — | AWS account ID. |
| `tenantId` | string | — | Azure tenant ID. Required for Azure CSPM. |
| `projectId` | string | — | GCP project ID. Required for GCP CSPM. |
| `cloudService` | string | — | Cloud service of the finding. |

CLI equivalent: `codeant findings cloud get`.

## Pentesting

### codeant\_pentest\_history

List pentest engagements, newest first, with status and finding counts. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `limit` | integer, 1–500 | `25` | Engagements per page. |
| `offset` | integer | `0` | Pagination offset. |
| `full` | boolean | `false` | Keep credit and billing details on each engagement. |

Returns `total`, `offset`, `limit`, `next_offset`, and `history`. Each engagement has `id`, `requested_at`, `testing_type`, `domains`, `status`, `findings` (counts by severity), and `report_url`. Pass `id` as `reportId` to the issue and report tools.

CLI equivalent: `codeant findings pentest history`.

### codeant\_pentest\_issues

Fetch the issues for one engagement. The backend applies the same plan-based redaction as the app. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `reportId` | string | **required** | Engagement ID from `codeant_pentest_history`. |
| `variant` | `prod`, `test` | `prod` | Report variant. |

CLI equivalent: `codeant findings pentest issues`.

### codeant\_pentest\_report

Fetch the full customer report for one engagement. The backend applies the same plan-based redaction as the app. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `reportId` | string | **required** | Engagement ID from `codeant_pentest_history`. |
| `variant` | `prod`, `test` | `prod` | Report variant. |

CLI equivalent: `codeant findings pentest report`.

## API passthrough

### codeant\_api\_get

Call any authenticated GET endpoint on the configured CodeAnt API host, for read APIs that no dedicated tool covers. Accepts the [connection parameters](#connection-parameters).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `path` | string | **required** | Relative path starting with a single `/`. Absolute URLs and paths starting with `//` are rejected. |
| `query` | object | — | Query parameters. Values can be strings, numbers, booleans, or string arrays. |
| `headers` | string array | — | Extra `Name: value` headers. `Authorization`, `Cookie`, `Host`, `Content-Length`, and the `X-CodeAnt-CLI-*` headers can't be set. |

Returns `ok`, `status`, `tenant`, and `data`. A non-2xx response comes back as a normal result with `ok: false`, except 403, which fails with an `Access denied` error.

CLI equivalent: `codeant api request GET`.

## Pull requests and comments

These tools accept the [repository parameters](#repository-parameters) and need a token for your Git provider.

### codeant\_pr\_list

List pull requests or merge requests.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `sourceBranch` | string | — | Source branch. |
| `author` | string | — | Pull request author. |
| `state` | `open`, `closed` | `open` | Pull request state. |
| `limit` | integer, 1–100 | `20` | Pull requests per page. |
| `offset` | integer | `0` | Pagination offset. |

Filters and paging depend on the provider:

| Provider | `sourceBranch` | `author` | `offset` |
| - | - | - | - |
| GitHub | Exact | Substring of the login, within the fetched page | Rounded down to a multiple of `limit` |
| GitLab | Exact | Exact username | Rounded down to a multiple of `limit` |
| Bitbucket | Substring | Substring | Ignored |
| Azure DevOps | Exact | Azure DevOps identity ID | Ignored |

Returns an array of pull requests, without a total.

CLI equivalent: `codeant pr list`.

### codeant\_pr\_get

Fetch one pull request's provider metadata and reviewer approval states (`reviewSummary`).

| Parameter | Type | Default | Description |
| - | - | - | - |
| `prNumber` | integer | **required** | Pull request number. |

CLI equivalent: `codeant pr get`.

### codeant\_pr\_comments

List comments on one pull request.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `prNumber` | integer | **required** | Pull request number. |
| `codeantGenerated` | boolean | — | `true` returns only CodeAnt comments, `false` only other comments. A comment counts as CodeAnt's when the author name contains "codeant" or the body contains "Suggestion". |
| `createdAfter` | string | — | ISO 8601 date. |
| `createdBefore` | string | — | ISO 8601 date. |

On GitLab, Bitbucket, and Azure DevOps, each comment has a `resolved` field. GitHub comments don't report resolved state.

CLI equivalent: `codeant pr comments`.

### codeant\_comments\_search

Search review comments in one repository by text. The tool reads comments on the 10 most recently updated pull requests (open ones only on Bitbucket and Azure DevOps; inline review comments only on GitHub) and returns case-insensitive substring matches from every author.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `query` | string | **required** | Search text. |
| `limit` | integer, 1–50 | `10` | Maximum matching comments returned. |

Each result has `prNumber`, `prTitle`, `id`, `author`, `body`, `path`, `line`, `createdAt`, and `isCodeantComment`. Filter on `isCodeantComment` for CodeAnt's comments.

CLI equivalent: `codeant comments search`.

## Local review

### codeant\_review\_local

Run a CodeAnt AI review of local changes in the git repository in the server's working directory. It needs a client that starts the server inside your project, such as Claude Code. It never modifies files.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `scope` | `all`, `uncommitted`, `staged-only`, `committed`, `last-commit`, `last-n-commits`, `base-branch`, `base-commit` | `uncommitted` | Which changes to review. |
| `lastNCommits` | integer, 1–5 | `1` | Commit count for `last-n-commits`. |
| `baseBranch` | string | — | Branch to compare against for `base-branch`. |
| `baseCommit` | string | — | Commit to compare against for `base-commit`. |
| `include` | string array | — | File globs to include. |
| `exclude` | string array | — | File globs to exclude. |

The review sends the diff and the full current contents of each changed file to CodeAnt, and the reviewer can read, list, and search other repository files for context.

Returns `issues`, `meta` (including the reviewed files), and `error`. When `error` is set, for example `Could not find a .git directory.`, the result has `isError: true`. `noFiles: true` means there were no changes in scope.

CLI equivalent: `codeant review --headless`. The CLI defaults to `--all`, while this tool defaults to `uncommitted`.

## Authentication

### codeant\_login

Start browser sign-in to CodeAnt AI.

| Parameter | Type | Default | Description |
| - | - | - | - |
| `force` | boolean | `false` | Sign in again even if a token is already configured. |

| Response | Meaning |
| - | - |
| `{"alreadyLoggedIn": true}` | A token is already configured. |
| `{"status": "pending", "loginUrl": "…", "browserOpened": true, "message": "…"}` | Sign-in started, or the user hasn't finished yet. Show `loginUrl` to the user, who must finish within 10 minutes, then call `codeant_login` again. The server checks about every 10 seconds. |
| `{"status": "success", "token": "cli___ab…"}` | Sign-in finished. The token is saved to `~/.codeant/config.json`. The response shows only its first 8 characters. |
| `isError` with `Could not determine the dashboard URL` | Self-hosted: set `CODEANT_DASHBOARD_URL` or run `codeant set-dashboard-url`. |
| `isError` with `Login timed out` or another message | Sign-in failed. The next call to `codeant_login` starts a new sign-in. |

Concurrent calls share one sign-in. The pending sign-in lives in the server process, so if the client restarts the server before the user finishes, call `codeant_login` again.

CLI equivalent: `codeant login`.

### codeant\_logout

Revoke the token on the server, remove it from `~/.codeant/config.json`, unset `CODEANT_API_TOKEN` in the server process, and cancel a pending sign-in. Takes no parameters. Because the CLI shares the config file, the CLI is signed out too.

Returns `wasLoggedIn`, `serverRevoked`, `status` (`logged_out` or `not_logged_in`), and a `warning` if server revocation couldn't be confirmed.

CLI equivalent: `codeant logout`.

## Write tools

Registered only when `CODEANT_READ_ONLY=0`. See [Enable write tools](/cli/mcp-server#enable-write-tools).

| Tool | Required parameters | Optional parameters |
| - | - | - |
| `codeant_scans_start` | — | `repo`, `branch`, and `commit` (auto-detected from the working directory's local Git context when omitted), `include`, `exclude` (globs, comma-separated) |
| `codeant_pr_resolve` | `prNumber` | `name`, `remote`, and one of `commentId` (GitHub, Bitbucket), `threadId` (GitHub, Azure DevOps), or `discussionId` (GitLab), taken from `codeant_pr_comments` |
| `codeant_api_request` | `method` (`POST`, `PUT`, `PATCH`, `DELETE`), `path` | [connection parameters](#connection-parameters), `query`, `body`, `headers` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.