export-sarif

name	export-sarif
user-invocable	false
description	Export .kuzushi/findings.json as a SARIF 2.1.0 file (.kuzushi/findings.sarif) so findings are consumable by CI code-scanning, dashboards, and IDEs. Deterministic transform — no analysis. Pass "all" to include reviewed/noise findings too.
argument-hint	[all]
allowed-tools	Bash

Export findings as SARIF

Convert the shared findings index into SARIF 2.1.0 for interop with CI / IDE tooling.

Run, using the project working directory as <cwd> (add --all only if $ARGUMENTS is all):

node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/export-sarif.mjs" --target "<cwd>"

It writes .kuzushi/findings.sarif and prints { sarifPath, resultCount, ruleCount }. By default only actionable findings are exported (status open/confirmed/proven, or verdict exploitable/finding); pass all to include reviewed/noise too. Relay the result and the path. Severity maps to SARIF level (critical/high → error, medium → warning, else → note); each distinct CWE becomes a SARIF rule; the kuzushi fingerprint is carried as a partial fingerprint.

When NOT to use

• Before any findings exist — run a producer (/threat-hunt, /taint-analysis, /systems-hunt) first.
• To analyze or triage — this only reformats existing findings; it makes no security decisions.