Code Audit

Comment commands

Inth reads commands in pull request comments. The comment must start with @inth-agent on its first line. Inth ignores a mention in the middle of a sentence, in a quote, or in a code block.

Commands work only on a repository with pull request scans turned on.

Only people with write, maintain, or admin access to the repository can use commands. Inth ignores comments from other people and from bots. If a command is not correct, Inth replies with the correct format.

Scan the latest commit

@inth-agent review

@inth-agent review scans the latest commit. It works in the pull request conversation and in a review thread. Inth replies with the commit that it scans. If Inth does not start a scan, the reply gives the reason. For example, Inth already scans that commit, or the balance has too few Credits.

Dismiss a finding

Dismiss a finding when it is wrong or when your team accepts the risk. Inth then leaves it out of later pull requests in the same repository. You do not see the same finding again on each pull request.

To dismiss a finding, reply in its thread:

@inth-agent dismiss <reason> [note]

Use 1 of these reasons:

  • false-positive: the finding is wrong.
  • accepted-risk: the finding is correct and your team accepts the risk.
  • wont-fix: your team will not change this code.

The note is optional. Inth keeps it with the dismissal.

Some findings have no thread of their own, such as the ones under Outside this diff. Other threads hold more than 1 finding. These findings show a 6-character handle. Put the handle before the reason. You can use a command with a handle in any comment on the pull request:

@inth-agent dismiss a1b2c3 false-positive

Inth replies to confirm the dismissal. The review changes at the next scan. From then on, the summary, the counts, and the check run leave out the finding. The summary lists it under N dismissed, with its reason, the person who dismissed it, and its handle. Inth does not post new inline comments for it. Inline threads from before stay.

A dismissal lasts until the code of the finding changes. Then Inth reviews the finding again. If it shows, the review says that someone dismissed it before.

The Dashboard report and Inth MCP still list dismissed findings. They do not show the dismissal.

Bring a finding back

To bring a finding back, comment the command below. If the thread holds only 1 finding, you can leave out the handle. The finding shows again from the next scan.

@inth-agent undismiss [handle]

Resolve a thread

If you resolve the thread of an Inth comment, Inth hides its findings on that pull request only. The review changes at the next scan. Use this when you fixed the code. Unresolve the thread to show the findings again from the next scan.