codesecurity / code scanning alerts

Code Scanning Alerts

code_scanning_alerts

Retrieves GitHub code scanning alerts (SARIF findings) for a repository — results from tools like CodeQL, Semgrep, or other SAST tools integrated via GitHub Actions. Requires GitHub connector token with 'security_events' or 'repo' scope. Use when: user asks about code scanning results, CodeQL findings, SARIF alerts, or GitHub Actions security scan results on a remote repo. Scope: remote GitHub API only — requires GITHUB_TOKEN. Not for: local secret scanning (use repo_scanner), Dependabot package vulnerabilities (use dependabot_alerts), or local dependency auditing (use dependency_audit).

How to use code_scanning_alerts

Provide only the required inputs below. Start with the smallest scope that answers the task, then review the risk properties before an agent executes the call.

Risk and execution properties

Read only: yes

Destructive: no

Idempotent: yes

Open world: yes — can reach external systems

Inputs

repostringrequired

GitHub repo in 'owner/repo' format. Example: 'myorg/myrepo'

statestring

Filter by alert state. Default: 'open'.

Allowed: "open""dismissed""fixed"

Default: "open"

tool_namestring

Filter by scanning tool name. Example: 'CodeQL', 'Semgrep'. Optional — omit to return alerts from all tools.

severitystring

Filter by severity/precision. Optional.

Allowed: "critical""high""medium""low""warning""note""error"

Example input

{
  "repo": "<string>",
  "state": "open",
  "tool_name": "<string>",
  "severity": "critical"
}

Browse or search the full 74-tool reference to choose the smallest suitable capability.

Browse all tools →