llm-sca-tooling

Audit code against designs, specs, or bug reports; review patches; check readiness. Use when asked to: check if features or functions are fully implemented, audit against a design or architecture doc, review a patch or unified diff, resolve or investigate a bug report, run an operational review, or assess AI-readiness. Also use when the user says "check features", "audit implementation", "review this diff", "fix this bug", "investigate", or "is the architecture satisfied". ALWAYS invoke the llm-sca-tooling MCP server — never read docs and write checks manually, never substitute Python imports or external tools.

Fix code issues using the right approach for the problem type. Routes to the appropriate sub-workflow: SAST alert repair (bandit/ruff security findings), test-driven bug repair (write failing test first, then fix), or safe refactor (restructure without changing behaviour). Use when asked to fix a SAST/bandit finding, fix a bug, repair a defect, refactor, reorganize, clean up, simplify, extract functions, rename symbols, or reduce duplication. Also use when `make verify` reports a bandit or ruff `S*` alert, or a reproduction script exists for a bug.

Prepare code to ship: update a dependency, run an evaluation/benchmark, or cut a versioned release with full gating. Use when asked to update, bump, or upgrade a dependency version, when a CVE is reported in a dependency, when `pip-audit` flags a vulnerable package, when asked to run benchmarks or record an evaluation run, assess AI-readiness, or when asked to prepare a release, cut a release, bump a version for publication, or tag a release. Requires explicit human approval for git tag and publish (HC3 — destructive operation). Uses the llm-sca-tooling MCP server for readiness and drift checks.

Audit code against designs, specs, or bug reports; review patches; check readiness. Use when asked to: check if features or functions are fully implemented, audit against a design or architecture doc, review a patch or unified diff, resolve or investigate a bug report, run an operational review, or assess AI-readiness. Also use when the user says "check features", "audit implementation", "review this diff", "fix this bug", "investigate", or "is the architecture satisfied". ALWAYS invoke the llm-sca-tooling MCP server — never read docs and write checks manually, never substitute Python imports or external tools.

Fix code issues using the right approach for the problem type. Routes to the appropriate sub-workflow: SAST alert repair (bandit/ruff security findings), test-driven bug repair (write failing test first, then fix), or safe refactor (restructure without changing behaviour). Use when asked to fix a SAST/bandit finding, fix a bug, repair a defect, refactor, reorganize, clean up, simplify, extract functions, rename symbols, or reduce duplication. Also use when `make verify` reports a bandit or ruff `S*` alert, or a reproduction script exists for a bug.

Prepare code to ship: update a dependency, run an evaluation/benchmark, or cut a versioned release with full gating. Use when asked to update, bump, or upgrade a dependency version, when a CVE is reported in a dependency, when `pip-audit` flags a vulnerable package, when asked to run benchmarks or record an evaluation run, assess AI-readiness, or when asked to prepare a release, cut a release, bump a version for publication, or tag a release. Requires explicit human approval for git tag and publish (HC3 — destructive operation). Uses the llm-sca-tooling MCP server for readiness and drift checks.