/scope

name: scope
description: "[stable] Prepare focused analysis scope for large codebases, list workspaces in monorepos"
argument-hint: "<path> [--list] [--include patterns] [--exclude patterns] [--compress] [--name scope-name] [--force]"
allowed-tools:
  - Bash
  - Glob
  - Grep
  - Read
  - Write
  - TodoWrite

Scope Command - Prepare Focused Analysis

Prepare a focused analysis scope for large codebases or monorepos using repomix. Creates a digestible snapshot of the target code for subsequent security analysis.

Saved scope files are context artifacts for Claude-side review and threat modeling. Static tool entrypoints like `scan_orchestrator.py` still run against the original source directory or workspace, not the generated markdown snapshot.

Flags

| Flag | Effect | |------|--------| | `--list` | List workspaces/packages in monorepo with size estimates | | `--compress` | Use language-aware compression (Go: 97%, TS/JS: 80%) | | `--include` | Glob patterns to include | | `--exclude` | Glob patterns to exclude | | `--name` | Output filename (default: derived from path) | | `--force` | Force scope even if >300k tokens | | `--language` | Force specific language strategy (go\|ts\|py\|java\|rust\|php\|cs\|ruby\|sol) |

List Workspaces (--list)

When `--list` is provided, detect and display monorepo structure:

/vuln-scout:scope --list

**Detects:**

• npm/yarn/pnpm workspaces (`package.json`, `pnpm-workspace.yaml`)
• Go modules (`go.work`, multiple `go.mod`)
• Maven/Gradle modules (`pom.xml`, `settings.gradle`)
• Rust workspaces (`Cargo.toml`)
• Python packages (`pyproject.toml`, `setup.py`)

**Output:**

## Detected Workspaces

| Name | Path | Language | Est. Tokens | Risk |
|------|------|----------|-------------|------|
| query-service | query-service/ | Go | 184k | HIGH |
| index-service | index-service/ | Go | 100k | HIGH |
| tahoma | tahoma/ | Go | 706k | MEDIUM |

### Recommendations
- query-service: `/scope query-service --name qs`
- tahoma is oversized: scope sub-directories individually

Polyglot Monorepo Detection (Automatic)

When `--list` is used, polyglot detection happens automatically. Mixed-language codebases are identified and services are mapped to their languages:

/vuln-scout:scope --list

Step 1: Detect All Languages

echo "=== Language Distribution ==="
go_count=$(find [path] -name '*.go' ! -path '*/vendor/*' ! -name '*_test.go' 2>/dev/null | wc -l)
py_count=$(find [path] -name '*.py' ! -path '*/.venv/*' ! -name 'test_*.py' 2>/dev/null | wc -l)
ts_count=$(find [path] \( -name '*.ts' -o -name '*.tsx' \) ! -path '*/node_modules/*' ! -name '*.test.*' 2>/dev/null | wc -l)
java_count=$(find [path] -name '*.java' ! -path '*/test/*' ! -name '*Test.java' 2>/dev/null | wc -l)
rs_count=$(find [path] -name '*.rs' ! -path '*/target/*' 2>/dev/null | wc -l)
php_count=$(find [path] -name '*.php' ! -path '*/vendor/*' 2>/dev/null | wc -l)
cs_count=$(find [path] -name '*.cs' ! -path '*/bin/*' ! -path '*/obj/*' 2>/dev/null | wc -l)
rb_count=$(find [path] -name '*.rb' ! -path '*/vendor/*' 2>/dev/null | wc -l)
sol_count=$(find [path] -name '*.sol' ! -path '*/node_modules/*' 2>/dev/null | wc -l)

**Polyglot Detection Threshold**: If 2+ languages have >50 files each, treat as polyglot.

Step 2: Map Services to Languages

Identify service boundaries by looking for entrypoints:

# Go services
find [path] -name 'main.go' 2>/dev/null | while read f; do dirname "$f"; done

# Python services
find [path] \( -name 'main.py' -o -name 'app.py' -o -name 'manage.py' \) 2>/dev/null | while read f; do dirname "$f"; done

# TypeScript/JavaScript services
find [path] -name 'package.json' ! -path '*/node_modules/*' -exec grep -l '"start"' {} \; 2>/dev/null | while read f; do dirname "$f"; done

# Java services
find [path] -name '*Application.java' 2>/dev/null | while read f; do dirname "$(dirname "$f")"; done

# Detect Dockerfiles for service boundaries
find [path] -name 'Dockerfile*' 2>/dev/null | while read f; do dirname "$f"; done

Step 3: Detect Inter-Service Communication

# Protocol definitions
proto_count=$(find [path] -name '*.proto' 2>/dev/null | wc -l)
openapi_count=$(find [path] \( -name 'openapi*.yaml' -o -name 'swagger*.yaml' \) 2>/dev/null | wc -l)
graphql_count=$(find [path] -name '*.graphql' 2>/dev/null | wc -l)

# Message queues
kafka_refs=$(grep -rniE "kafka|rabbitmq|amqp" --include="*.yaml" --include="*.json" [path] 2>/dev/null | wc -l)

Polyglot Output Format

## Polyglot Monorepo Analysis

### Language Distribution

| Language | Files | % of Codebase |
|----------|-------|---------------|
| Go | 450 | 35% |
| Python | 380 | 30% |
| TypeScript | 420 | 33% |
| Solidity | 25 | 2% |

### Service Map

| Service | Path | Language | Est. Tokens | Risk | Communication |
|---------|------|----------|-------------|------|---------------|
| api-gateway | services/gateway/ | Go | 85k | HIGH | gRPC, REST |
| auth-service | services/auth/ | Go | 45k | CRITICAL | gRPC |
| ml-pipeline | services/ml/ | Python | 120k | HIGH | REST, Kafka |
| web-frontend | apps/web/ | TypeScript | 200k | MEDIUM | REST client |
| contracts | blockchain/contracts/ | Solidity | 15k | CRITICAL | On-chain |

### Protocol Definitions

| Type | Count | Location |
|------|-------|----------|
| Protobuf | 15 | services/proto/ |
| OpenAPI | 2 | docs/api/ |
| GraphQL | 1 | apps/web/schema/ |

### Inter-Service Data Flows

```mermaid
graph LR
    A[web-frontend<br/>TypeScript] -->|REST| B[api-gateway<br/>Go]
    B -->|gRPC| C[auth-service<br/>Go]
    B -->|REST| D[ml-pipeline<br/>Python]
    D -->|Kafka| E[data-processor<br/>Java]

Recommended Audit Order

| Priority | Service | Reason | |----------|---------|--------| | 1 | auth-service | Handles authentication, CRITICAL risk | | 2 | api-gateway | External entry point, HIGH risk | | 3 | contracts | Financial operations, CRITICAL risk | | 4 | ml-pipeline | D