Run a bounded Sonar scan

Inspect before scanning

Follow Explore a target and resolve exactly one program UUID. If the program is absent or ambiguous, stop and request clarification. Never omit the program parameter to fall back to match-all work.

Select an approved workflow

list_workflows { category: "AI" }
get_workflow { id: "<candidate workflow version ID>" }

Confirm from the returned definition:

• category is exactly AI;
• the workflow declares the program parameter;
• its steps and output tables answer the missing-Inventory question; and
• the selected ID is the current workflow definition version, not a family ID.

Do not run a non-AI workflow through the public pentest policy.

Launch exactly once

create_scan {
  workflowDefinitionId: "<workflow version UUID>",
  parameters: {
    program: "<program UUID>"
  }
}

Do not add secrets, client-generated manifests, hashes, concurrency limits, routing tags, or result schema metadata. create_scan accepts only the documented strict arguments, and required step secrets come from Sonar's current global secret store at dispatch.

Monitor the confirmed scan

With the returned scan ID:

get_scan { id: "<scan UUID>" }
get_scan_tasks_statistics { id: "<scan UUID>" }

Poll at a reasonable interval until the scan is terminal. Keep task failures or missing worker capacity visible; CompletedWithErrors is not equivalent to complete coverage. A creation receipt, running status, task count, or terminal status is not a vulnerability conclusion.

Read the resulting Inventory

After completion, call get_target_overview again, then page the asset types written by the workflow. Attribute only observations actually returned from refreshed Inventory.