[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-ash-mcp":3,"mdc--jd8idi-key":45,"related-repo-aws-labs-ash-mcp":818,"related-org-aws-labs-ash-mcp":829},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":40,"sourceUrl":43,"mdContent":44},"ash-mcp","run security scans with ASH","Run security scans with the ASH (Automated Security Helper) MCP server. Use this skill whenever the user asks to scan for vulnerabilities, run a security check, find CVEs, audit dependencies, check for secrets, run SAST or SCA, scan IaC (Terraform\u002FCloudFormation\u002FKubernetes), check for hardcoded credentials, or mentions ASH, Bandit, Semgrep, Checkov, Grype, Syft, or detect-secrets. Also trigger when the user wants to find security issues, harden a codebase, or asks \"is my code secure\". Do NOT trigger for code review without security context, performance audits, or test writing.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Vulnerability","vulnerability",{"name":24,"slug":25,"type":16},"MCP","mcp",{"name":27,"slug":28,"type":16},"Code Analysis","code-analysis",680,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fautomated-security-helper","2026-08-23T04:00:21.3187",null,88,[35,11,36,37,38,39,15],"aws","iac","sast","sca","scanner",{"repoUrl":30,"stars":29,"forks":33,"topics":41,"description":42},[35,11,36,37,38,39,15],"ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fautomated-security-helper\u002Ftree\u002FHEAD\u002Fash-agent-plugins\u002Fagentic-coding\u002Fplugins\u002Fgeneric-skill\u002Fskills\u002Fash-mcp","---\nname: ash-mcp\ndescription: Run security scans with the ASH (Automated Security Helper) MCP server. Use this skill whenever the user asks to scan for vulnerabilities, run a security check, find CVEs, audit dependencies, check for secrets, run SAST or SCA, scan IaC (Terraform\u002FCloudFormation\u002FKubernetes), check for hardcoded credentials, or mentions ASH, Bandit, Semgrep, Checkov, Grype, Syft, or detect-secrets. Also trigger when the user wants to find security issues, harden a codebase, or asks \"is my code secure\". Do NOT trigger for code review without security context, performance audits, or test writing.\nversion: 1.0.0\n---\n\n# ASH MCP — Security Scanning Workflow\n\nASH (Automated Security Helper) wraps nine security scanners behind a single MCP interface. The server exposes scans as async tools — start a scan, poll for progress, fetch filtered results.\n\nThis skill assumes the ASH MCP server is configured (the plugin\u002Fpower that ships this skill provides it).\n\n## The mandatory three-step workflow\n\nEvery scan follows this exact pattern. Skipping the poll step means stale progress visibility — the scan keeps running server-side, but you lose real-time updates.\n\n### Step 1 — Start the scan\n\nCall `run_ash_scan` with the absolute path to the project. The call returns immediately with a `scan_id`.\n\n```\nrun_ash_scan(\n    source_dir=\"\u002Fabsolute\u002Fpath\u002Fto\u002Fproject\",\n    severity_threshold=\"MEDIUM\",   # CRITICAL | HIGH | MEDIUM | LOW | INFO\n    config_path=None,              # Optional path to .ash.yaml\n    clean_output=True\n)\n```\n\nReturns a dict with `scan_id`, `status: \"running\"`, `directory_path` (the resolved absolute scan root), and an `important.next_steps` block. **Always store the `scan_id`** — every subsequent call needs it.\n\nFor the output directory, prefer reading `output_directory` from any subsequent `get_scan_progress` response (it pre-computes the path). If you need the output dir before the first poll, derive it from this response's `directory_path` as `\u003Cdirectory_path>\u002F.ash\u002Fash_output\u002F`.\n\nThe server's `important.next_steps` block recommends polling `progress['is_complete']`. Ignore that — `is_complete` stays `False` for cancelled scans. Always check `status` independently, as described in Step 2.\n\nThe MCP server always runs scans in local mode (Python-only, no Docker). For container or precommit modes, use the ASH CLI directly. Scanner selection lives in `.ash\u002F.ash.yaml`, not in tool parameters.\n\n### Step 2 — Poll progress every 5 seconds\n\nLoop on `get_scan_progress` until the scan is complete. The 5-second cadence is what the ASH MCP server's own docstring requests for reliable progress streaming over long scans.\n\n```\nget_scan_progress(scan_id=\"\u003Cuuid>\")\n```\n\nStop polling when `status` is one of `completed | failed | cancelled`. Do **not** rely on `is_complete` alone — it stays `False` for cancelled scans, so polling on `is_complete` will loop forever after a cancel. Typical scans take 30-120 seconds.\n\nFor progress display, use `completed_scanners \u002F total_scanners` — but check `total_scanners > 0` first (it's zero during pre-flight before any scanner registers; show \"initializing\" in that case). The response also includes `severity_counts` and per-scanner breakdown to surface in user-facing updates.\n\nThe scan itself runs server-side regardless of polling cadence — polling is for progress visibility, not for keeping the scan alive.\n\n### Step 3 — Fetch results with the right filter\n\nOnce the scan is complete, call `get_scan_results`. Match the filter to the user's intent.\n\n| User goal | Filter combination |\n|-----------|-------------------|\n| \"How bad is it?\" | `filter_level=\"summary\"` + `actionable_only=True` |\n| \"Show me the critical issues\" | `filter_level=\"full\"` + `severities=\"critical,high\"` |\n| \"Audit Bandit only\" | `scanners=\"bandit\"` + `filter_level=\"full\"` |\n| \"Generate exec summary\" | Use `get_scan_result_paths`, then read `ash.summary.md` |\n\n```\nget_scan_results(\n    output_dir=\"\u002Fabsolute\u002Fpath\u002Fto\u002Fproject\u002F.ash\u002Fash_output\",\n    filter_level=\"summary\",\n    severities=\"critical,high\",\n    actionable_only=True\n)\n```\n\nFor HTML\u002FSARIF\u002FCSV reports, prefer `get_scan_result_paths` and read the files directly with native file tools — it avoids piping large payloads through MCP.\n\n## Tool inventory\n\nFor full parameter details, see [tool-reference.md](references\u002Ftool-reference.md).\n\n- `run_ash_scan` — Start a scan asynchronously\n- `get_scan_progress` — Poll progress (call every 5s)\n- `get_scan_results` — Fetch filtered results\n- `get_scan_summary` — Counts only, no findings\n- `get_scan_result_paths` — File paths to all reports\n- `list_active_scans` — All current\u002Frecent scans\n- `cancel_scan` — Stop a running scan\n- `check_installation` — Verify ASH is installed\n\n## Choosing scanners\n\nASH runs all nine scanners by default. To run only a subset, edit `.ash\u002F.ash.yaml` at the project root before scanning — `run_ash_scan` does not accept a scanners argument. To filter results post-scan, use the `scanners` parameter on `get_scan_results`.\n\nFor result-time filtering by scanner:\n\n- **Python issues** → `scanners=\"bandit,semgrep\"`\n- **Secrets only** → `scanners=\"detect-secrets\"`\n- **IaC review** → `scanners=\"checkov,cfn_nag,cdk-nag\"`\n- **Dependencies** → `scanners=\"grype,npm-audit\"`\n- **SBOM generation** → `scanners=\"syft\"`\n\n## When something goes wrong\n\nSee [troubleshooting.md](references\u002Ftroubleshooting.md) for the common failures: connection timeouts, empty results, stuck scans, container\u002FDocker issues, suppression rules not applying.\n\nThe fast checks: scan never starts → run `check_installation` first. Scan returns no findings → drop `actionable_only` and widen `severities`. Stale progress visibility → you weren't polling every 5 seconds.\n",{"data":46,"body":48},{"name":4,"description":6,"version":47},"1.0.0",{"type":49,"children":50},"root",[51,60,66,71,78,83,90,112,124,172,207,251,264,270,282,291,339,368,373,379,392,519,528,540,546,559,648,654,687,692,771,777,790],{"type":52,"tag":53,"props":54,"children":56},"element","h1",{"id":55},"ash-mcp-security-scanning-workflow",[57],{"type":58,"value":59},"text","ASH MCP — Security Scanning Workflow",{"type":52,"tag":61,"props":62,"children":63},"p",{},[64],{"type":58,"value":65},"ASH (Automated Security Helper) wraps nine security scanners behind a single MCP interface. The server exposes scans as async tools — start a scan, poll for progress, fetch filtered results.",{"type":52,"tag":61,"props":67,"children":68},{},[69],{"type":58,"value":70},"This skill assumes the ASH MCP server is configured (the plugin\u002Fpower that ships this skill provides it).",{"type":52,"tag":72,"props":73,"children":75},"h2",{"id":74},"the-mandatory-three-step-workflow",[76],{"type":58,"value":77},"The mandatory three-step workflow",{"type":52,"tag":61,"props":79,"children":80},{},[81],{"type":58,"value":82},"Every scan follows this exact pattern. Skipping the poll step means stale progress visibility — the scan keeps running server-side, but you lose real-time updates.",{"type":52,"tag":84,"props":85,"children":87},"h3",{"id":86},"step-1-start-the-scan",[88],{"type":58,"value":89},"Step 1 — Start the scan",{"type":52,"tag":61,"props":91,"children":92},{},[93,95,102,104,110],{"type":58,"value":94},"Call ",{"type":52,"tag":96,"props":97,"children":99},"code",{"className":98},[],[100],{"type":58,"value":101},"run_ash_scan",{"type":58,"value":103}," with the absolute path to the project. The call returns immediately with a ",{"type":52,"tag":96,"props":105,"children":107},{"className":106},[],[108],{"type":58,"value":109},"scan_id",{"type":58,"value":111},".",{"type":52,"tag":113,"props":114,"children":118},"pre",{"className":115,"code":117,"language":58},[116],"language-text","run_ash_scan(\n    source_dir=\"\u002Fabsolute\u002Fpath\u002Fto\u002Fproject\",\n    severity_threshold=\"MEDIUM\",   # CRITICAL | HIGH | MEDIUM | LOW | INFO\n    config_path=None,              # Optional path to .ash.yaml\n    clean_output=True\n)\n",[119],{"type":52,"tag":96,"props":120,"children":122},{"__ignoreMap":121},"",[123],{"type":58,"value":117},{"type":52,"tag":61,"props":125,"children":126},{},[127,129,134,136,142,143,149,151,157,159,170],{"type":58,"value":128},"Returns a dict with ",{"type":52,"tag":96,"props":130,"children":132},{"className":131},[],[133],{"type":58,"value":109},{"type":58,"value":135},", ",{"type":52,"tag":96,"props":137,"children":139},{"className":138},[],[140],{"type":58,"value":141},"status: \"running\"",{"type":58,"value":135},{"type":52,"tag":96,"props":144,"children":146},{"className":145},[],[147],{"type":58,"value":148},"directory_path",{"type":58,"value":150}," (the resolved absolute scan root), and an ",{"type":52,"tag":96,"props":152,"children":154},{"className":153},[],[155],{"type":58,"value":156},"important.next_steps",{"type":58,"value":158}," block. ",{"type":52,"tag":160,"props":161,"children":162},"strong",{},[163,165],{"type":58,"value":164},"Always store the ",{"type":52,"tag":96,"props":166,"children":168},{"className":167},[],[169],{"type":58,"value":109},{"type":58,"value":171}," — every subsequent call needs it.",{"type":52,"tag":61,"props":173,"children":174},{},[175,177,183,185,191,193,198,200,206],{"type":58,"value":176},"For the output directory, prefer reading ",{"type":52,"tag":96,"props":178,"children":180},{"className":179},[],[181],{"type":58,"value":182},"output_directory",{"type":58,"value":184}," from any subsequent ",{"type":52,"tag":96,"props":186,"children":188},{"className":187},[],[189],{"type":58,"value":190},"get_scan_progress",{"type":58,"value":192}," response (it pre-computes the path). If you need the output dir before the first poll, derive it from this response's ",{"type":52,"tag":96,"props":194,"children":196},{"className":195},[],[197],{"type":58,"value":148},{"type":58,"value":199}," as ",{"type":52,"tag":96,"props":201,"children":203},{"className":202},[],[204],{"type":58,"value":205},"\u003Cdirectory_path>\u002F.ash\u002Fash_output\u002F",{"type":58,"value":111},{"type":52,"tag":61,"props":208,"children":209},{},[210,212,217,219,225,227,233,235,241,243,249],{"type":58,"value":211},"The server's ",{"type":52,"tag":96,"props":213,"children":215},{"className":214},[],[216],{"type":58,"value":156},{"type":58,"value":218}," block recommends polling ",{"type":52,"tag":96,"props":220,"children":222},{"className":221},[],[223],{"type":58,"value":224},"progress['is_complete']",{"type":58,"value":226},". Ignore that — ",{"type":52,"tag":96,"props":228,"children":230},{"className":229},[],[231],{"type":58,"value":232},"is_complete",{"type":58,"value":234}," stays ",{"type":52,"tag":96,"props":236,"children":238},{"className":237},[],[239],{"type":58,"value":240},"False",{"type":58,"value":242}," for cancelled scans. Always check ",{"type":52,"tag":96,"props":244,"children":246},{"className":245},[],[247],{"type":58,"value":248},"status",{"type":58,"value":250}," independently, as described in Step 2.",{"type":52,"tag":61,"props":252,"children":253},{},[254,256,262],{"type":58,"value":255},"The MCP server always runs scans in local mode (Python-only, no Docker). For container or precommit modes, use the ASH CLI directly. Scanner selection lives in ",{"type":52,"tag":96,"props":257,"children":259},{"className":258},[],[260],{"type":58,"value":261},".ash\u002F.ash.yaml",{"type":58,"value":263},", not in tool parameters.",{"type":52,"tag":84,"props":265,"children":267},{"id":266},"step-2-poll-progress-every-5-seconds",[268],{"type":58,"value":269},"Step 2 — Poll progress every 5 seconds",{"type":52,"tag":61,"props":271,"children":272},{},[273,275,280],{"type":58,"value":274},"Loop on ",{"type":52,"tag":96,"props":276,"children":278},{"className":277},[],[279],{"type":58,"value":190},{"type":58,"value":281}," until the scan is complete. The 5-second cadence is what the ASH MCP server's own docstring requests for reliable progress streaming over long scans.",{"type":52,"tag":113,"props":283,"children":286},{"className":284,"code":285,"language":58},[116],"get_scan_progress(scan_id=\"\u003Cuuid>\")\n",[287],{"type":52,"tag":96,"props":288,"children":289},{"__ignoreMap":121},[290],{"type":58,"value":285},{"type":52,"tag":61,"props":292,"children":293},{},[294,296,301,303,309,311,316,318,323,325,330,332,337],{"type":58,"value":295},"Stop polling when ",{"type":52,"tag":96,"props":297,"children":299},{"className":298},[],[300],{"type":58,"value":248},{"type":58,"value":302}," is one of ",{"type":52,"tag":96,"props":304,"children":306},{"className":305},[],[307],{"type":58,"value":308},"completed | failed | cancelled",{"type":58,"value":310},". Do ",{"type":52,"tag":160,"props":312,"children":313},{},[314],{"type":58,"value":315},"not",{"type":58,"value":317}," rely on ",{"type":52,"tag":96,"props":319,"children":321},{"className":320},[],[322],{"type":58,"value":232},{"type":58,"value":324}," alone — it stays ",{"type":52,"tag":96,"props":326,"children":328},{"className":327},[],[329],{"type":58,"value":240},{"type":58,"value":331}," for cancelled scans, so polling on ",{"type":52,"tag":96,"props":333,"children":335},{"className":334},[],[336],{"type":58,"value":232},{"type":58,"value":338}," will loop forever after a cancel. Typical scans take 30-120 seconds.",{"type":52,"tag":61,"props":340,"children":341},{},[342,344,350,352,358,360,366],{"type":58,"value":343},"For progress display, use ",{"type":52,"tag":96,"props":345,"children":347},{"className":346},[],[348],{"type":58,"value":349},"completed_scanners \u002F total_scanners",{"type":58,"value":351}," — but check ",{"type":52,"tag":96,"props":353,"children":355},{"className":354},[],[356],{"type":58,"value":357},"total_scanners > 0",{"type":58,"value":359}," first (it's zero during pre-flight before any scanner registers; show \"initializing\" in that case). The response also includes ",{"type":52,"tag":96,"props":361,"children":363},{"className":362},[],[364],{"type":58,"value":365},"severity_counts",{"type":58,"value":367}," and per-scanner breakdown to surface in user-facing updates.",{"type":52,"tag":61,"props":369,"children":370},{},[371],{"type":58,"value":372},"The scan itself runs server-side regardless of polling cadence — polling is for progress visibility, not for keeping the scan alive.",{"type":52,"tag":84,"props":374,"children":376},{"id":375},"step-3-fetch-results-with-the-right-filter",[377],{"type":58,"value":378},"Step 3 — Fetch results with the right filter",{"type":52,"tag":61,"props":380,"children":381},{},[382,384,390],{"type":58,"value":383},"Once the scan is complete, call ",{"type":52,"tag":96,"props":385,"children":387},{"className":386},[],[388],{"type":58,"value":389},"get_scan_results",{"type":58,"value":391},". Match the filter to the user's intent.",{"type":52,"tag":393,"props":394,"children":395},"table",{},[396,415],{"type":52,"tag":397,"props":398,"children":399},"thead",{},[400],{"type":52,"tag":401,"props":402,"children":403},"tr",{},[404,410],{"type":52,"tag":405,"props":406,"children":407},"th",{},[408],{"type":58,"value":409},"User goal",{"type":52,"tag":405,"props":411,"children":412},{},[413],{"type":58,"value":414},"Filter combination",{"type":52,"tag":416,"props":417,"children":418},"tbody",{},[419,445,469,492],{"type":52,"tag":401,"props":420,"children":421},{},[422,428],{"type":52,"tag":423,"props":424,"children":425},"td",{},[426],{"type":58,"value":427},"\"How bad is it?\"",{"type":52,"tag":423,"props":429,"children":430},{},[431,437,439],{"type":52,"tag":96,"props":432,"children":434},{"className":433},[],[435],{"type":58,"value":436},"filter_level=\"summary\"",{"type":58,"value":438}," + ",{"type":52,"tag":96,"props":440,"children":442},{"className":441},[],[443],{"type":58,"value":444},"actionable_only=True",{"type":52,"tag":401,"props":446,"children":447},{},[448,453],{"type":52,"tag":423,"props":449,"children":450},{},[451],{"type":58,"value":452},"\"Show me the critical issues\"",{"type":52,"tag":423,"props":454,"children":455},{},[456,462,463],{"type":52,"tag":96,"props":457,"children":459},{"className":458},[],[460],{"type":58,"value":461},"filter_level=\"full\"",{"type":58,"value":438},{"type":52,"tag":96,"props":464,"children":466},{"className":465},[],[467],{"type":58,"value":468},"severities=\"critical,high\"",{"type":52,"tag":401,"props":470,"children":471},{},[472,477],{"type":52,"tag":423,"props":473,"children":474},{},[475],{"type":58,"value":476},"\"Audit Bandit only\"",{"type":52,"tag":423,"props":478,"children":479},{},[480,486,487],{"type":52,"tag":96,"props":481,"children":483},{"className":482},[],[484],{"type":58,"value":485},"scanners=\"bandit\"",{"type":58,"value":438},{"type":52,"tag":96,"props":488,"children":490},{"className":489},[],[491],{"type":58,"value":461},{"type":52,"tag":401,"props":493,"children":494},{},[495,500],{"type":52,"tag":423,"props":496,"children":497},{},[498],{"type":58,"value":499},"\"Generate exec summary\"",{"type":52,"tag":423,"props":501,"children":502},{},[503,505,511,513],{"type":58,"value":504},"Use ",{"type":52,"tag":96,"props":506,"children":508},{"className":507},[],[509],{"type":58,"value":510},"get_scan_result_paths",{"type":58,"value":512},", then read ",{"type":52,"tag":96,"props":514,"children":516},{"className":515},[],[517],{"type":58,"value":518},"ash.summary.md",{"type":52,"tag":113,"props":520,"children":523},{"className":521,"code":522,"language":58},[116],"get_scan_results(\n    output_dir=\"\u002Fabsolute\u002Fpath\u002Fto\u002Fproject\u002F.ash\u002Fash_output\",\n    filter_level=\"summary\",\n    severities=\"critical,high\",\n    actionable_only=True\n)\n",[524],{"type":52,"tag":96,"props":525,"children":526},{"__ignoreMap":121},[527],{"type":58,"value":522},{"type":52,"tag":61,"props":529,"children":530},{},[531,533,538],{"type":58,"value":532},"For HTML\u002FSARIF\u002FCSV reports, prefer ",{"type":52,"tag":96,"props":534,"children":536},{"className":535},[],[537],{"type":58,"value":510},{"type":58,"value":539}," and read the files directly with native file tools — it avoids piping large payloads through MCP.",{"type":52,"tag":72,"props":541,"children":543},{"id":542},"tool-inventory",[544],{"type":58,"value":545},"Tool inventory",{"type":52,"tag":61,"props":547,"children":548},{},[549,551,558],{"type":58,"value":550},"For full parameter details, see ",{"type":52,"tag":552,"props":553,"children":555},"a",{"href":554},"references\u002Ftool-reference.md",[556],{"type":58,"value":557},"tool-reference.md",{"type":58,"value":111},{"type":52,"tag":560,"props":561,"children":562},"ul",{},[563,574,584,594,605,615,626,637],{"type":52,"tag":564,"props":565,"children":566},"li",{},[567,572],{"type":52,"tag":96,"props":568,"children":570},{"className":569},[],[571],{"type":58,"value":101},{"type":58,"value":573}," — Start a scan asynchronously",{"type":52,"tag":564,"props":575,"children":576},{},[577,582],{"type":52,"tag":96,"props":578,"children":580},{"className":579},[],[581],{"type":58,"value":190},{"type":58,"value":583}," — Poll progress (call every 5s)",{"type":52,"tag":564,"props":585,"children":586},{},[587,592],{"type":52,"tag":96,"props":588,"children":590},{"className":589},[],[591],{"type":58,"value":389},{"type":58,"value":593}," — Fetch filtered results",{"type":52,"tag":564,"props":595,"children":596},{},[597,603],{"type":52,"tag":96,"props":598,"children":600},{"className":599},[],[601],{"type":58,"value":602},"get_scan_summary",{"type":58,"value":604}," — Counts only, no findings",{"type":52,"tag":564,"props":606,"children":607},{},[608,613],{"type":52,"tag":96,"props":609,"children":611},{"className":610},[],[612],{"type":58,"value":510},{"type":58,"value":614}," — File paths to all reports",{"type":52,"tag":564,"props":616,"children":617},{},[618,624],{"type":52,"tag":96,"props":619,"children":621},{"className":620},[],[622],{"type":58,"value":623},"list_active_scans",{"type":58,"value":625}," — All current\u002Frecent scans",{"type":52,"tag":564,"props":627,"children":628},{},[629,635],{"type":52,"tag":96,"props":630,"children":632},{"className":631},[],[633],{"type":58,"value":634},"cancel_scan",{"type":58,"value":636}," — Stop a running scan",{"type":52,"tag":564,"props":638,"children":639},{},[640,646],{"type":52,"tag":96,"props":641,"children":643},{"className":642},[],[644],{"type":58,"value":645},"check_installation",{"type":58,"value":647}," — Verify ASH is installed",{"type":52,"tag":72,"props":649,"children":651},{"id":650},"choosing-scanners",[652],{"type":58,"value":653},"Choosing scanners",{"type":52,"tag":61,"props":655,"children":656},{},[657,659,664,666,671,673,679,681,686],{"type":58,"value":658},"ASH runs all nine scanners by default. To run only a subset, edit ",{"type":52,"tag":96,"props":660,"children":662},{"className":661},[],[663],{"type":58,"value":261},{"type":58,"value":665}," at the project root before scanning — ",{"type":52,"tag":96,"props":667,"children":669},{"className":668},[],[670],{"type":58,"value":101},{"type":58,"value":672}," does not accept a scanners argument. To filter results post-scan, use the ",{"type":52,"tag":96,"props":674,"children":676},{"className":675},[],[677],{"type":58,"value":678},"scanners",{"type":58,"value":680}," parameter on ",{"type":52,"tag":96,"props":682,"children":684},{"className":683},[],[685],{"type":58,"value":389},{"type":58,"value":111},{"type":52,"tag":61,"props":688,"children":689},{},[690],{"type":58,"value":691},"For result-time filtering by scanner:",{"type":52,"tag":560,"props":693,"children":694},{},[695,711,726,741,756],{"type":52,"tag":564,"props":696,"children":697},{},[698,703,705],{"type":52,"tag":160,"props":699,"children":700},{},[701],{"type":58,"value":702},"Python issues",{"type":58,"value":704}," → ",{"type":52,"tag":96,"props":706,"children":708},{"className":707},[],[709],{"type":58,"value":710},"scanners=\"bandit,semgrep\"",{"type":52,"tag":564,"props":712,"children":713},{},[714,719,720],{"type":52,"tag":160,"props":715,"children":716},{},[717],{"type":58,"value":718},"Secrets only",{"type":58,"value":704},{"type":52,"tag":96,"props":721,"children":723},{"className":722},[],[724],{"type":58,"value":725},"scanners=\"detect-secrets\"",{"type":52,"tag":564,"props":727,"children":728},{},[729,734,735],{"type":52,"tag":160,"props":730,"children":731},{},[732],{"type":58,"value":733},"IaC review",{"type":58,"value":704},{"type":52,"tag":96,"props":736,"children":738},{"className":737},[],[739],{"type":58,"value":740},"scanners=\"checkov,cfn_nag,cdk-nag\"",{"type":52,"tag":564,"props":742,"children":743},{},[744,749,750],{"type":52,"tag":160,"props":745,"children":746},{},[747],{"type":58,"value":748},"Dependencies",{"type":58,"value":704},{"type":52,"tag":96,"props":751,"children":753},{"className":752},[],[754],{"type":58,"value":755},"scanners=\"grype,npm-audit\"",{"type":52,"tag":564,"props":757,"children":758},{},[759,764,765],{"type":52,"tag":160,"props":760,"children":761},{},[762],{"type":58,"value":763},"SBOM generation",{"type":58,"value":704},{"type":52,"tag":96,"props":766,"children":768},{"className":767},[],[769],{"type":58,"value":770},"scanners=\"syft\"",{"type":52,"tag":72,"props":772,"children":774},{"id":773},"when-something-goes-wrong",[775],{"type":58,"value":776},"When something goes wrong",{"type":52,"tag":61,"props":778,"children":779},{},[780,782,788],{"type":58,"value":781},"See ",{"type":52,"tag":552,"props":783,"children":785},{"href":784},"references\u002Ftroubleshooting.md",[786],{"type":58,"value":787},"troubleshooting.md",{"type":58,"value":789}," for the common failures: connection timeouts, empty results, stuck scans, container\u002FDocker issues, suppression rules not applying.",{"type":52,"tag":61,"props":791,"children":792},{},[793,795,800,802,808,810,816],{"type":58,"value":794},"The fast checks: scan never starts → run ",{"type":52,"tag":96,"props":796,"children":798},{"className":797},[],[799],{"type":58,"value":645},{"type":58,"value":801}," first. Scan returns no findings → drop ",{"type":52,"tag":96,"props":803,"children":805},{"className":804},[],[806],{"type":58,"value":807},"actionable_only",{"type":58,"value":809}," and widen ",{"type":52,"tag":96,"props":811,"children":813},{"className":812},[],[814],{"type":58,"value":815},"severities",{"type":58,"value":817},". Stale progress visibility → you weren't polling every 5 seconds.",{"items":819,"total":828},[820],{"slug":4,"name":4,"fn":5,"description":6,"org":821,"tags":822,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[823,824,825,826,827],{"name":18,"slug":19,"type":16},{"name":27,"slug":28,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},1,{"items":830,"total":1009},[831,851,872,882,895,908,918,928,949,964,979,994],{"slug":832,"name":832,"fn":833,"description":834,"org":835,"tags":836,"stars":848,"repoUrl":849,"updatedAt":850},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[837,839,842,845],{"name":838,"slug":35,"type":16},"AWS",{"name":840,"slug":841,"type":16},"Debugging","debugging",{"name":843,"slug":844,"type":16},"Logs","logs",{"name":846,"slug":847,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":852,"name":853,"fn":854,"description":855,"org":856,"tags":857,"stars":848,"repoUrl":849,"updatedAt":871},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[858,861,862,865,868],{"name":859,"slug":860,"type":16},"Aurora","aurora",{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},"Database","database",{"name":866,"slug":867,"type":16},"Serverless","serverless",{"name":869,"slug":870,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":873,"name":874,"fn":854,"description":855,"org":875,"tags":876,"stars":848,"repoUrl":849,"updatedAt":881},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[877,878,879,880],{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},{"name":866,"slug":867,"type":16},{"name":869,"slug":870,"type":16},"2026-08-04T05:35:05.694395",{"slug":883,"name":884,"fn":854,"description":855,"org":885,"tags":886,"stars":848,"repoUrl":849,"updatedAt":894},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[887,888,889,892,893],{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},{"name":890,"slug":891,"type":16},"Migration","migration",{"name":866,"slug":867,"type":16},{"name":869,"slug":870,"type":16},"2026-08-04T05:35:08.749669",{"slug":896,"name":897,"fn":854,"description":855,"org":898,"tags":899,"stars":848,"repoUrl":849,"updatedAt":907},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[900,901,902,905,906],{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},{"name":903,"slug":904,"type":16},"PostgreSQL","postgresql",{"name":866,"slug":867,"type":16},{"name":869,"slug":870,"type":16},"2026-08-04T05:35:06.713102",{"slug":909,"name":910,"fn":854,"description":855,"org":911,"tags":912,"stars":848,"repoUrl":849,"updatedAt":917},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[913,914,915,916],{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},{"name":866,"slug":867,"type":16},{"name":869,"slug":870,"type":16},"2026-08-04T05:35:10.086942",{"slug":919,"name":919,"fn":854,"description":855,"org":920,"tags":921,"stars":848,"repoUrl":849,"updatedAt":927},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[922,923,924,925,926],{"name":838,"slug":35,"type":16},{"name":863,"slug":864,"type":16},{"name":890,"slug":891,"type":16},{"name":866,"slug":867,"type":16},{"name":869,"slug":870,"type":16},"2026-08-04T05:35:07.751779",{"slug":929,"name":929,"fn":930,"description":931,"org":932,"tags":933,"stars":946,"repoUrl":947,"updatedAt":948},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[934,937,940,943],{"name":935,"slug":936,"type":16},"Accounting","accounting",{"name":938,"slug":939,"type":16},"Analytics","analytics",{"name":941,"slug":942,"type":16},"Cost Optimization","cost-optimization",{"name":944,"slug":945,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":950,"name":950,"fn":951,"description":952,"org":953,"tags":954,"stars":946,"repoUrl":947,"updatedAt":963},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[955,956,957,960],{"name":838,"slug":35,"type":16},{"name":944,"slug":945,"type":16},{"name":958,"slug":959,"type":16},"Management","management",{"name":961,"slug":962,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":965,"name":965,"fn":966,"description":967,"org":968,"tags":969,"stars":946,"repoUrl":947,"updatedAt":978},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[970,971,972,975],{"name":938,"slug":939,"type":16},{"name":944,"slug":945,"type":16},{"name":973,"slug":974,"type":16},"Financial Statements","financial-statements",{"name":976,"slug":977,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":980,"name":980,"fn":981,"description":982,"org":983,"tags":984,"stars":946,"repoUrl":947,"updatedAt":993},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[985,988,991],{"name":986,"slug":987,"type":16},"Automation","automation",{"name":989,"slug":990,"type":16},"Documents","documents",{"name":992,"slug":980,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":995,"name":995,"fn":996,"description":997,"org":998,"tags":999,"stars":946,"repoUrl":947,"updatedAt":1008},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1000,1001,1004,1005],{"name":935,"slug":936,"type":16},{"name":1002,"slug":1003,"type":16},"Data Analysis","data-analysis",{"name":944,"slug":945,"type":16},{"name":1006,"slug":1007,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",128]