Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Produces deterministic findings with explicit coverage, Security Concern Families, Scan Receipts, and Evidence Envelopes.

USE when a developer asks to:

• "check this for security issues"

• "audit this task before I push"

• "review this change for security problems"

• "scan this AI agent" or "scan this AI app"

• "check my LLM application"

• "security review this PR"

• "is this safe to merge"

• "check this before deployment"

• "audit this code for vulnerabilities"

• "run a security scan"

• "check for security risks before commit"

• "review this implementation before pushing"

Also use for:

• reviewing AI/LLM/agent source code for security

• validating AI code before merge

• checking an agent before deployment

• reviewing RAG or model integration security

• looking for unsafe AI source-code patterns

• checking AI-output-to-dangerous-action flows

• checking AI source-code secrets/security controls

DO NOT use for:

• actual LLM response/content verification (use verify_llm_content)

• tenant/RLS/cross-customer isolation (use scan_tenant_isolation)

• generic compliance questionnaires or compliance certification

• generic non-AI source scanning where no AI check applies

This tool performs static analysis only. It does NOT execute target code, make network requests, or emit telemetry. BLOCK findings are advisory — deployment enforcement is handled by check_deploy_security (not yet implemented).