Full-Surface Analysis Report

調べた内容を出典つきで1枚にまとめた報告（調査1件）

コードの問題点と修正案（根拠つき・検証済み）

Returns a one-page research brief with cited source URLs, key findings and open gaps for a question. Call it when an agent needs a sourced answer instead of an unsourced guess. Input: {"question": "..."} (5-400 chars, any language).

Reviews source code and returns line-numbered findings with severity and a concrete fix, combining deterministic static rules (eval, SQL concat, secrets, shell injection) with an AI review. Call it before merging or running untrusted code. Input: {"code": "...", "language": "javascript"}.

Convert tabular data between CSV/TSV and a JSON array of objects, in either direction, with detected delimiter and typed columns. Use it when a tool returns CSV but your pipeline needs JSON (or the reverse) and you do not want to run a parser yourself.

Cleans a CSV/TSV/JSON table: removes duplicate and empty rows, trims whitespace, and returns the cleaned CSV with before/after quality checks and per-column stats. Call it before analysing or importing messy tabular data. Input: {"data": "<csv text>"}.

Return the line-level diff between two texts as added/removed/unified hunks with counts. Use it to review a patch, compare two API responses, or decide whether two documents actually differ before spending tokens on them.

Full-surface analysis of a target: a website, an API, a shipped JS bundle, or (as a prepared runbook) a local artifact such as an ELF/PE/.NET/Mach-O binary, an Electron app.asar, an APK or a jar. Returns a capability map where every claim carries its evidence, the entry points found, feature flags and client-side secret shapes (shapes only, never values), and an explicit list of what could not be determined. Read-only: the target is never executed, a 401/403 is recorded as auth_required and never bypassed, and the response is never resold. Use it to plan an integration, document an undocumented API, or triage a vendor before you build on it.

Apply one regular expression to a text blob on the server and return every match with its index and capture groups. Deterministic, so the same input always returns the same answer. Useful for log triage, field extraction and validation at scale.

Inspect one publicly reachable website or API and return a machine-readable capability report: the entry points it exposes (endpoints, forms, feeds, MCP tools), the evidence behind every finding, and an explicit list of what could not be determined. Only public responses are read; a 401/403 is recorded as auth_required and never bypassed. Use it to plan an integration, document an undocumented API, or triage a vendor before you build on it.

Fetch one public URL and return machine-readable page metadata: HTTP status, title, meta/og description, canonical URL, language, link count and a short text sample. Honest 4xx/5xx statuses are returned as data, not as errors. Use it for link previews, source triage and citation checks.