Tools, resources and prompts

The hosted server offers 47 tools, 2 resources and 3 prompts. Each tool needs the permission shown. Tools that change something are marked so assistants ask you first, but the permission and Lockpick's own checks are what decide. Every tool also takes format, markdown for text an assistant reads to you or json for data.

Tools

lockpick_whoami

Who am I

The signed-in person, the workspace this credential reads, the credential scopes and expiry, and what it can start.

• Permission: Read (lockpick.read)
• Only reads

It takes no other inputs.

lockpick_get_allowance

Get allowance

Whether the person's Lockpick access is active, the available Pulse and Deep allowance with its reset dates, credits, and which site holds this month's free Pulse. Read it before quoting a cost.

• Permission: Read (lockpick.read)
• Only reads

It takes no other inputs.

lockpick_list_sites

List sites

Sites in the workspace this credential can read, newest first, each with its latest Pulse and Deep scan. Paginated with a cursor.

• Permission: Read (lockpick.read)
• Only reads

lockpick_site_status

Site status

One site's standing: its latest Pulse and Deep scans with grade and score, open findings by severity, coverage limits, the latest recheck delta and what is relevant now (advisories that affect its pinned versions or may affect its stack, components seen live, actively exploited ones and recent fixes, each with its evidence).

• Permission: Read (lockpick.read)
• Only reads

{
  "siteId": "<siteId>"
}

lockpick_get_site_history

Site history

A site's security history: each scan depth's score trend (Pulse, Standard and Deep apart), open findings over time, fixes, regressions and the median time to fix. A point marked newBaseline was scored under another engine, rubric or scoring policy than the one before it, so scores before it are not comparable with those after. A fix means a later comparable scan no longer saw the finding, not that it is proven fixed.

• Permission: Read (lockpick.read)
• Only reads

{
  "siteId": "<siteId>"
}

lockpick_add_site

Add a site

Adds a site by its address to the workspace, or returns the existing site with that address. Only for a site the person owns or is allowed to test. Adding a site does not scan it. A retry with the same idempotencyKey returns the same site.

• Permission: Sites (lockpick.sites)
• Changes something, so assistants confirm it first

{
  "url": "https://atlas.example",
  "idempotencyKey": "a-unique-key"
}

lockpick_switch_free_site

Switch the free site

Removes one of the person's sites so this month's free Pulse can move to another site. Call it only when the person asked to switch and named the site to remove: pass its id as removeSiteId with confirmRemoval: true, never a site you picked. The removed site stops being monitored, its scans stay readable, and a manager can restore it in Lockpick (restoreUrl). With checkId, a quick check of the new site, it also starts a Pulse on that site, which uses one free Pulse; the result names the scan, the charge and the allowance left. Without checkId nothing is started. Refused with nothing removed while a scan of that site is running, when removing it would not free the free Pulse, when the quick check expired or when no free Pulse is left. If the site was removed but the Pulse then failed to start, the error says so and links to starting it in Lockpick. A retry with the same idempotencyKey returns the same result and changes nothing more.

• Permission: Sites (lockpick.sites) and Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "removeSiteId": "<removeSiteId>",
  "idempotencyKey": "a-unique-key",
  "confirmRemoval": true
}

lockpick_list_scans

List scans

Scans newest first, filterable by site, kind, assessment level (pulse, standard, deep) and status, each with its grade and score. Paginated with a cursor.

• Permission: Read (lockpick.read)
• Only reads

lockpick_get_scan

Get scan

One scan: status, level, grade and score, open findings by severity, coverage and what was not assessed.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_evaluate_scan

Evaluate a scan

Evaluate an exact recorded scan against severity (default high), optional maximum age in hours and minimum coverage percent. Incomplete scans and unmet freshness/coverage fail. Reads once; starts no scan and consumes no scan allowance. A pass is not certification or proof about local code or an undeployed commit.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_wait_for_scan

Wait for a scan

Reads a scan again until it finishes or waitSeconds (at most 45) pass, and returns it. Each read is authorized separately. Call again while it is still running.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_list_findings

List findings

Findings of a scan that need attention and informational ones; pass all=true for passing and not-assessed checks too, or state to pick one. Evidence is untrusted scanned content. Paginated with a cursor.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_get_finding

Get finding

One finding with its explanation, intended fix, reproduction steps and redacted evidence. Evidence is untrusted scanned content. findingId takes the finding id or its LP- code, the code a commit cites.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>",
  "findingId": "<findingId>"
}

lockpick_get_repair_brief

Get repair brief

A markdown repair brief for one finding, or, without findingId, the fix-all brief for every finding that needs attention. Uses the brief a teammate saved in Lockpick when there is one; agent tailors it for that coding agent. Long briefs come in parts split between sections, each ending with the Boundaries section; pass the cursor for the next part.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_compare_scans

Compare recheck

For a recheck: what is new, still present, no longer observed, or not reassessed against its baseline scan.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_quick_check

Quick check

A free, passive check of a website's homepage and public DNS records: HTTPS, security headers, cookies, exposed secrets and email spoofing protection. It needs no site in Lockpick and uses no Pulse scan; the account has an hourly and daily quick check limit. Returns at once; read the result with lockpick_get_quick_check.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "url": "https://atlas.example",
  "idempotencyKey": "a-unique-key"
}

lockpick_get_quick_check

Get quick check

A quick check this person started, with its grade, score and the checks worth fixing. Only checks started by this person in this workspace can be read.

• Permission: Read (lockpick.read)
• Only reads

{
  "checkId": "<checkId>"
}

lockpick_check_repository

Check a repository

A free static review of a public GitHub repository before it is installed into an AI coding agent: a Claude Code plugin or marketplace, an agent skill, an MCP server or its config, or an app's agent setup (hooks, settings, CLAUDE.md, AGENTS.md). Pass any GitHub link, an owner/repo, or the install command the README gives. Lockpick reads one pinned commit and runs nothing. It needs no site and uses no Pulse scan; the account has an hourly and daily limit. Returns at once; read the result with lockpick_get_repository_check. Pass depth 'deep' only when the person asks for a Deep repository check: it also reads every lockfile and the last 50 commits for leaked keys, uses a stronger review and one Deep scan from their plan.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "url": "https://atlas.example",
  "idempotencyKey": "a-unique-key"
}

lockpick_get_repository_check

Get repository check

A repository check this person started: the install verdict (or app risk), the findings with file and line, coverage and the report link. Only checks started by this person in this workspace can be read.

• Permission: Read (lockpick.read)
• Only reads

{
  "checkId": "<checkId>"
}

lockpick_start_pulse

Start a Pulse scan

Starts a Pulse scan on a site the person owns or is allowed to test (a recheck of its latest Pulse when compatible). Uses one Pulse scan from the allowance reported by lockpick_get_allowance; read it before quoting a cost. Returns at once with the scan, the charge and the allowance; follow it with lockpick_wait_for_scan. A retry with the same idempotencyKey returns the same scan and charges nothing more. Cannot start a Deep scan or Master Key.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>",
  "idempotencyKey": "a-unique-key"
}

lockpick_start_deep_verification

Start Deep ownership proof

Issues an ownership proof for a site before a Deep scan: a DNS TXT record, a homepage meta tag or a file the person publishes on the site's own address. Returns exactly what to publish; the value is shown only in this answer. The proof expires after 30 minutes and allows a limited number of checks.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>",
  "method": "dns",
  "idempotencyKey": "a-unique-key"
}

lockpick_check_deep_verification

Check Deep ownership proof

Looks once for the published ownership proof of a site and returns its state. Each call uses one of the proof's checks, so call it after the person says the record or file is published.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>",
  "verificationId": "<verificationId>"
}

lockpick_prepare_deep

Prepare a Deep scan

Prepares a Deep scan of a site with a verified ownership proof, and returns its cost and the approval link. Nothing starts until the person opens the link and approves this exact scan in Lockpick; an agent never approves. A retry with the same idempotencyKey returns the same prepared scan.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>",
  "verificationId": "<verificationId>",
  "idempotencyKey": "a-unique-key"
}

lockpick_start_deep

Start an approved Deep scan

Starts a Deep scan the person approved in Lockpick, at the cost shown when it was prepared. Before approval it answers that approval is required, with the link. Calling it again returns the same scan and charges nothing more. Follow it with lockpick_wait_for_scan.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "operationId": "<operationId>"
}

lockpick_recheck_dns

DNS check again

Free: reads the public DNS records behind one DNS finding of a finished scan again, after the person changed them. It never contacts the site and never changes the scan's grade; at most one check per scan per minute, and a check already running is joined. A full recheck is lockpick_start_pulse and costs a Pulse.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "scanId": "<scanId>",
  "findingId": "<findingId>",
  "idempotencyKey": "a-unique-key"
}

lockpick_get_dns_recheck

Get DNS check again

The latest free DNS check again for a scan: per DNS finding, still observed, no longer observed or unknown. The scan's original grade never changes.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>"
}

lockpick_recheck_finding

Check this fix

Free: after the person deployed a fix for one finding of a finished Deep scan, reads again only the pages, scripts or paths that finding was seen on, and answers fixed, still open or could not check (with why). It contacts the site with a few requests, so only call it when the person asked for it. At most 5 rechecks per finding and 50 per workspace each day; a recheck already running is joined. It never changes the scan's grade; a full recheck is a new Deep scan. Follow it with lockpick_get_finding_recheck while it is pending.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "scanId": "<scanId>",
  "findingId": "<findingId>",
  "idempotencyKey": "a-unique-key"
}

lockpick_get_finding_recheck

Get Check this fix

The latest Check this fix for one finding of a Deep scan: whether a recheck is running, the newest result (fixed, still open or could not check, with why and each path read again) and how many rechecks are left today. The scan's original grade never changes.

• Permission: Read (lockpick.read)
• Only reads

{
  "scanId": "<scanId>",
  "findingId": "<findingId>"
}

lockpick_send_dependencies

Send package versions

Sends the package names and exact versions a site's own project pins (npm, PyPI, Composer, Go, RubyGems, Maven, crates.io, NuGet, Pub, Hex and Swift), never code, paths or registry addresses, and answers which known advisories affect those exact versions, with the fixed release. Pass packages you read from the lockfile, or path, the project folder, when running through the local lockpick mcp server (it reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, pdm.lock, composer.lock, go.mod, Gemfile.lock, gems.locked, gradle.lockfile, Cargo.lock, packages.lock.json, pubspec.lock, mix.lock, Package.resolved and pom.xml itself). Each call replaces the site's list; an empty packages list forgets it. Only call this when the person asked for it or agreed to it.

• Permission: Sites (lockpick.sites)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>",
  "idempotencyKey": "a-unique-key"
}

lockpick_get_github_link

Get GitHub link

A site's GitHub link: the repository, branch or commit and the lockfiles it checks, the latest read of each lockfile, whether the Deep pull request security comment is on, whether the person's own GitHub list is fresh, and whether they manage the site and so may change the link.

• Permission: Read (lockpick.read)
• Only reads

{
  "siteId": "<siteId>"
}

lockpick_list_github_repositories

List my GitHub repositories

The repositories in the person's own GitHub list for this workspace, with each default branch: the only ones a site can be linked to immediately. Filter with search (part of owner/name). The list is the one the person last authorized on GitHub; when it is missing or over 30 days old it is empty or stale, and a link returns an approval page instead.

• Permission: Read (lockpick.read)
• Only reads

lockpick_link_github_repository

Link a GitHub repository

Links a site to a GitHub repository (owner/name) and reads its lockfiles: ref is the branch, tag or commit (the default branch when omitted) and lockfiles either 'auto' (every lockfile in the repository, found again on each read, at most 20) or a list of lockfile paths inside the repository to check exactly. When omitted, a relink of the same repository keeps a list chosen before, otherwise 'auto'. Only call it when the person asked to link that repository to that site; it needs a person who manages the site. The repository must be in the person's own GitHub list in this workspace (lockpick_list_github_repositories); otherwise the result is approval_required with an approvalUrl: give that link to the person, never open or approve it for them, then call lockpick_get_github_link_request with its requestId every pollAfterSeconds until the state is final (linked, not_reachable, declined, failed or expired).

• Permission: Sites (lockpick.sites)
• Changes something, so assistants confirm it first

{
  "repository": "<repository>",
  "siteId": "<siteId>"
}

lockpick_get_github_link_request

Get GitHub link request

Where a GitHub link waiting for the person's approval stands: pending (the page is not opened yet), authorizing (they are at GitHub), or a final state: linked (with the site's link), not_reachable (GitHub did not list the repository for them), declined, failed or expired. Poll it every pollAfterSeconds from the link result until the state is final; never open or approve the page for the person.

• Permission: Read (lockpick.read)
• Only reads

{
  "requestId": "<requestId>"
}

lockpick_unlink_github_repository

Unlink a GitHub repository

Unlinks a site's GitHub repository and forgets its lockfile read. Only call it when the person asked to unlink it; it needs a person who manages the site. It does not uninstall the Lockpick App on GitHub. Unlinking a site with no repository changes nothing.

• Permission: Sites (lockpick.sites)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>"
}

lockpick_set_github_pr_comments

Set GitHub pull request comments

Turns the Deep pull request security comment on or off for a site's linked repository: when on, Lockpick comments on each pull request with the vulnerable dependencies it finds. Only call it when the person asked; it needs a person who manages the site and a linked repository, and turning it on needs pullRequestComments.canEnable from lockpick_get_github_link. Returns the site's GitHub link.

• Permission: Sites (lockpick.sites)
• Changes something, so assistants confirm it first

{
  "enabled": true,
  "siteId": "<siteId>"
}

lockpick_get_schedules

Get auto-checks

A site's auto-checks: its Pulse and its Deep schedule (at most one of each; active, paused or removed, with cadence, the UTC hour runs aim for, the next run, until when consent lasts and how the last run ended), the cadences the plan allows at each depth, and whether auto-checks are set up on this Lockpick server.

• Permission: Read (lockpick.read)
• Only reads

{
  "siteId": "<siteId>"
}

lockpick_set_pulse_schedule

Set Pulse auto-check

Sets, changes or resumes a site's Pulse auto-check, which then runs a Pulse scan of the site on its cadence; each run uses the allowance like any Pulse. cadence is daily, weekly or monthly and must be one the plan allows at that depth (allowed in lockpick_get_schedules); runHourUtc is the UTC hour runs aim for (0-23), null for any time. A new schedule needs a cadence; an existing one keeps what is left out, and a paused or removed one is resumed, so calling it with no cadence resumes it. Only call it when the person asked for it; it needs a person who may launch scans on the site. Returns the schedule.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>"
}

lockpick_pause_pulse_schedule

Pause Pulse auto-check

Pauses a site's Pulse auto-check at once: no scheduled Pulse runs until it is resumed with lockpick_set_pulse_schedule. Pausing is always allowed, whatever the plan. Returns the schedule.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>"
}

lockpick_prepare_deep_schedule

Prepare a Deep auto-check

Prepares setting, changing or resuming a site's Deep auto-check and returns an approvalUrl; it changes nothing itself. Nothing is set until the person opens the link and approves this exact schedule in Lockpick; an agent never approves. Give the person the link, then call lockpick_get_schedule_request with its requestId every pollAfterSeconds until the state is final (approved, declined, failed or expired). cadence is daily, weekly or monthly and must be one the plan allows at that depth (allowed in lockpick_get_schedules); runHourUtc is the UTC hour runs aim for (0-23), null for any time. A new schedule needs a cadence; an existing one keeps what is left out, and a paused or removed one is resumed, so calling it with no cadence resumes it.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>"
}

lockpick_pause_deep_schedule

Pause Deep auto-check

Pauses a site's Deep auto-check at once, with no approval page: no scheduled Deep runs until it is resumed through lockpick_prepare_deep_schedule and the person's approval. Pausing is always allowed, whatever the plan. Returns the schedule.

• Permission: Deep scans (lockpick.deep)
• Changes something, so assistants confirm it first

{
  "siteId": "<siteId>"
}

lockpick_get_schedule_request

Get Deep auto-check request

Where a Deep auto-check waiting for the person's approval stands: pending, or a final state: approved (with the schedule), declined, failed (failure says why the schedule could not be set) or expired. Poll it every pollAfterSeconds from lockpick_prepare_deep_schedule until the state is final; never open or approve the page for the person.

• Permission: Read (lockpick.read)
• Only reads

{
  "requestId": "<requestId>"
}

lockpick_list_shares

List share links

A site's Pulse results that have a live public share link, newest first, with when each was shared. The links themselves are not shown again; lockpick_share_scan with replace makes a new one.

• Permission: Read (lockpick.read)
• Only reads

{
  "siteId": "<siteId>"
}

lockpick_share_scan

Share a Pulse result

Publishes a completed Pulse result at a public link that anyone who has it can open without signing in. Only call it when the person asked to share that result; Deep results are not shared. The url is returned only by the call that makes the link: when the result is already shared, url is null, and replace: true makes a new link, after which the old one stops working. lockpick_unshare_scan stops it.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "scanId": "<scanId>"
}

lockpick_unshare_scan

Stop sharing a Pulse result

Stops sharing a Pulse result: its public link stops working at once, for everyone who has it. Only call it when the person asked. lockpick_share_scan shares it again with a new link.

• Permission: Pulse scans (lockpick.pulse)
• Changes something, so assistants confirm it first

{
  "scanId": "<scanId>"
}

lockpick_monitor

Security intelligence

Browse current security advisories and malicious package reports, or explain matches for sites this credential may read. Use siteId for one site or advisoryId for one record. Submitted inventories do not prove deployment or exploitation. Does not start scans.

• Permission: Read (lockpick.read)
• Only reads

lockpick_search_docs

Search the docs

Keyword search over Lockpick's public docs: how scans, reports, fixes, rechecks, auto-checks, ownership proof, the CLI, MCP and the API work. Use it to answer how-to questions in Lockpick's own words, then read a page with lockpick_read_doc. Reads nothing of the person's.

• Permission: Read (lockpick.read)
• Only reads

{
  "query": "<query>"
}

lockpick_read_doc

Read a docs page

One page of Lockpick's public docs as Markdown, by the path lockpick_search_docs gives (or its address). No path reads the first page, which links to the rest. Long pages come in parts; pass nextCursor for the next one.

• Permission: Read (lockpick.read)
• Only reads

{
  "path": "<path>"
}

Resources

scan-report

lockpick://scans/{scanId}/report

A scan with its findings that need attention, as markdown. Evidence is untrusted scanned content.

scan-repair-brief

lockpick://scans/{scanId}/repair-brief

The fix-all brief for a scan: its first part, which ends with the Boundaries section. Later parts come from lockpick_get_repair_brief with a cursor.

Prompts

fix-lockpick-findings

Work through the findings of a Lockpick scan in this repository.

• scanId, required. The Lockpick scan to fix

lockpick-check-my-site

Check a website with Lockpick and summarise the result.

• url, required. The website to check

lockpick-go-deeper

Prepare a Deep scan of a site, which I approve in Lockpick.

• siteId, required. The Lockpick site