COD-1178: expose all CodeAnt findings through CLI and MCP

[Sagar-CodeAnt]

Summary

• expose the authenticated application API surface through codeant api request <method> <path> while preserving the app's authorization path
• add first-class codeant findings commands for repository discovery and repo-level SAST, SCA, IaC, Secrets, SBOM, anti-pattern, dead-code, docstring, and complex-function findings
• expose organization Hotlist list/get and all-repository anti-pattern findings
• expose AWS, Azure, and GCP CSPM, VM, and container scan history, findings/results, and full finding detail
• expose pentest history, all available issues, and complete prod/test reports with the same backend entitlement redaction as the UI
• add seven read-only MCP tools for anti-pattern, cloud-security, and pentest access; existing scan and Hotlist tools remain compatible
• revoke the server key on CLI/MCP logout before clearing local authentication
• ship findings.md and the existing CLI/MCP manuals in the npm package

Command flow

codeant login
codeant scans orgs

codeant findings repos --org CodeAnt-AI
codeant findings repo --repo CodeAnt-AI/example --types sast,sca,iac,anti_patterns
codeant findings list --severity critical,high

codeant findings cloud history --provider all --kind cspm
codeant findings cloud list --provider aws --kind vm --scan-id <scan-id>
codeant findings cloud get --provider gcp --kind container --scan-id <scan-id> --uid <uid>

codeant findings pentest history
codeant findings pentest issues --report-id <report-id>
codeant findings pentest report --report-id <report-id> --variant test

The existing codeant scans repos/results and codeant hotlist list/get interfaces remain supported. The new namespace delegates to those proven flows where possible and calls the same authenticated UI endpoints for CSPM, VM, container, organization anti-pattern, and pentest data. No additional backend adapter was needed for this expanded findings layer.

Security contract

• absolute and protocol-relative API URLs are rejected
• Authorization, Cookie, Host, Content-Length, and all X-CodeAnt-CLI-* headers cannot be overridden
• organization, service, and provider base URL must exactly match one saved authenticated connection
• backend organization membership, RBAC, repository access, audit attribution, cloud scope, and pentest entitlement checks remain authoritative
• cloud findings remain organization/account scoped rather than being falsely attached to repositories
• older keys must run codeant logout then codeant login once to gain verified app-API identity metadata

Agent access

The default read-only MCP server now exposes 23 tools (26 when write mode is explicitly enabled). New tools:

• codeant_findings_antipatterns
• codeant_cloud_scan_history
• codeant_cloud_findings_list
• codeant_cloud_finding_get
• codeant_pentest_history
• codeant_pentest_issues
• codeant_pentest_report

Manual

See findings.md for the complete command matrix, provider-specific scope fields, examples, agent workflow, and troubleshooting. cli-api.md documents the authenticated generic API escape hatch.

Validation

• 20 focused tests passed: new cloud/pentest/organization anti-pattern clients plus Hotlist and authenticated API regression coverage
• CLI help smoke-tested for the root findings tree, repo findings, cloud list, and pentest issues
• live MCP initialize + tools/list handshake confirmed all 23 default read-only tools
• MCP manifest contains 26 total static tools and valid JSON
• npm package dry run confirmed findings.md, cli-api.md, scans.md, and mcp.md are included
• JavaScript syntax checks and git diff --check passed

The repository-wide scan test suite also reaches configured online CodeAnt endpoints; those pre-existing cases fail in this environment with ENOTFOUND. The existing --include-dismissed test mismatch is also unrelated. COD-1178 focused tests pass.

Dependencies and tracking

• Backend auth bridge and Hotlist API: https://github.com/CodeAnt-AI/codeant-ci-backend-2/pull/3233
• Frontend Hotlist CLI guidance: https://github.com/CodeAnt-AI/codeant-ci-app-2/pull/1461
• COD-1178
• Addresses Anthropic MCP Directory Review — CodeAnt AI #25

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	4ba71c1	Aug 27, 2026 · 06:59	07:00
✅ Incremental review completed	b437ce7	Aug 26, 2026 · 13:54	13:55
✅ Reviewed your PR	6af8c0e	Aug 26, 2026 · 06:14	06:17

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. Polling can exceed the configured maximum wait by an entire retry interval.

Logic error · src/hotlist/client.js:79-83

[codeant-ai]

CodeAnt Confidence score 4/5

• The PR appears safe to merge; no confirmed high-impact regression remains.
• Hotlist commands can exceed the configured maximum wait by a full retry interval when the server requests a long delay.
• The current API command confines endpoints to relative paths, preventing bearer tokens from reaching arbitrary hosts through the reachable path.
• No inline suggestions were posted because the confirmed polling issue was assessed as low impact.