run-scan

Skill: Run Scan

Run an OpenTaint scan over the project model and collect its findings

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

• project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
• rule-ids (optional) — full rule IDs to restrict the scan to
• max-memory (optional) — a --max-memory value to run scan with. Default: unset (engine default 8G)

Workflow

1. Run the scan

Scan the pre-built model at .opentaint/project. Write the report to .opentaint/results/report.sarif and load both the built-in ruleset and the project's own rules under .opentaint/rules:

opentaint scan --project-model .opentaint/project \
  -o .opentaint/results/report.sarif \
  --ruleset builtin --ruleset .opentaint/rules \
  --track-external-methods

• --rule-id <full-id> — restrict to specific rules (repeatable, one per input rule ID); every unnamed rule is dropped, including library refs, so list every id the restricted rules depend on. Omit to run all loaded rules
• --passthrough-approximations .opentaint/pass-through — add when that directory exists: passThrough configs override built-ins at the rule level, a provided rule overriding a built-in only when it matches one
• --dataflow-approximations .opentaint/dataflow — add when that directory exists: code-based approximations (sources auto-compiled; pre-compiled .class dirs passed through as-is)

Both approximation-dir flags walk their trees recursively; pass each parent directory once, not every package or batch separately.

The scan is long — run it in the background and wait for it to finish. Leave --timeout at the engine default (900s); the CLI ends the analysis itself and writes whatever SARIF it has.

2. Retry once on out-of-memory