Connect a client

Maxwell tools

What your AI client can do once it is connected to Maxwell, and which role in your account may do it. A tool your role may not use is not offered to you.

Maxwell

maxwell_list_regulators Regulators: list

List the records of Regulators (shared by every company, read only), a page at a time: filter, sort, then pass next as after for the following page. The regulatory instruments Maxwell checks against (circulars, directions, rules, standards), each with its regulator, from Maxwell's registry at the pinned commit. Shared by every company, read only. Source: Maxwell (AGPL-3.0-only) at the pin. Fields: regulator (Regulator, enum), short_name (Short name, text), version (Version, text), status (Status, text), issued_on (Issued, date), effective_from (Effective from, date), repealed_on (Repealed, date), url (Official text, text), applicability (Applicability, json), hard_requirements (Hard requirements, json), structure (Numbering, text), supersedes (Supersedes, link), superseded_by (Superseded by, link), catalog_file (Control catalog, text).

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, regulator, short_name, version, status, issued_on, effective_from, repealed_on, url, applicability, hard_requirements, structure, supersedes, superseded_by, catalog_file",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "regulator",
        "-regulator",
        "short_name",
        "-short_name",
        "version",
        "-version",
        "status",
        "-status",
        "issued_on",
        "-issued_on",
        "effective_from",
        "-effective_from",
        "repealed_on",
        "-repealed_on",
        "url",
        "-url",
        "structure",
        "-structure",
        "catalog_file",
        "-catalog_file"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_regulators Regulators: get one

One record of Regulators (shared by every company, read only) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Regulators record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_controls Control library: list

List the records of Control library (shared by every company, read only), a page at a time: filter, sort, then pass next as after for the following page. Every control of Maxwell's regulator catalogs at the pinned commit, keyed instrument : control id . Shared by every company, read only. Source: Maxwell (AGPL-3.0-only) at the pin. Fields: instrument (Instrument, reference), regulator (Regulator, enum), control_id (Control id, text), category (Category, text), prose (Requirement, text), guidance (Guidance, text), mandatory (Mandatory, boolean), default_severity (Default severity, enum), cadence (Cadence, text), sla_days (SLA days, number), applicability (Applicability, json), params (Parameters, json), mappings (Mappings, json), evidence_expected (Evidence expected, json), probe_workflows (Probe workflows, json).

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, instrument, regulator, control_id, category, prose, guidance, mandatory, default_severity, cadence, sla_days, applicability, params, mappings, evidence_expected, probe_workflows",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "instrument",
        "-instrument",
        "regulator",
        "-regulator",
        "control_id",
        "-control_id",
        "category",
        "-category",
        "prose",
        "-prose",
        "guidance",
        "-guidance",
        "mandatory",
        "-mandatory",
        "default_severity",
        "-default_severity",
        "cadence",
        "-cadence",
        "sla_days",
        "-sla_days"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_controls Control library: get one

One record of Control library (shared by every company, read only) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Control library record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_control_status Controls: list

List this company's controls: how far each is implemented, how effective it is and when it is next due.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, control, company_specific, category, implementation_status, effectiveness, framework_refs, applicable_assets, last_assessed_at, next_due_at, recorded_at, workflow",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "company_specific",
        "-company_specific",
        "category",
        "-category",
        "implementation_status",
        "-implementation_status",
        "effectiveness",
        "-effectiveness",
        "last_assessed_at",
        "-last_assessed_at",
        "next_due_at",
        "-next_due_at",
        "recorded_at",
        "-recorded_at",
        "workflow",
        "-workflow"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_control_status Controls: get one

One record of Controls (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Controls record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_applications Applications: list

List the company's digital applications that Maxwell audits.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, readme, environments, repos",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "readme",
        "-readme"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_applications Applications: get one

One record of Applications (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Applications record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_findings Findings: list

List this company's findings (vulnerabilities and compliance gaps) from its control ledger, with severity, status, the application, control and regulator each traces to, and the SLA fix-by date. Filter by status (open, triaged, remediating, resolved, risk-accepted, false-positive, duplicate) or severity.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, severity, status, confidence, application, target_type, control, controls, company_specific, regulator, instrument, sla_due_at, first_seen_at, last_seen_at, resolved_at, rule_id, tool, workflow, location, fingerprint, description",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "severity",
        "-severity",
        "status",
        "-status",
        "confidence",
        "-confidence",
        "application",
        "-application",
        "target_type",
        "-target_type",
        "control",
        "-control",
        "company_specific",
        "-company_specific",
        "regulator",
        "-regulator",
        "instrument",
        "-instrument",
        "sla_due_at",
        "-sla_due_at",
        "first_seen_at",
        "-first_seen_at",
        "last_seen_at",
        "-last_seen_at",
        "resolved_at",
        "-resolved_at",
        "rule_id",
        "-rule_id",
        "tool",
        "-tool",
        "workflow",
        "-workflow",
        "location",
        "-location",
        "fingerprint",
        "-fingerprint",
        "description",
        "-description"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_findings Findings: get one

One record of Findings (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Findings record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_company_regulators Company regulators: list

List the records of Company regulators (this company's own), a page at a time: filter, sort, then pass next as after for the following page. The company's OWN regulators and sources (its board, a customer whose contract sets controls, a sector body the shared list lacks), beside the shared Regulators: company-profile/ company /regulators.json in its workspace (Maxwell's v1/company/regulators.schema.json). Company-specific: only this com… Fields: source_type (Kind, enum), url (Web page, text), notes (Notes, text), source_file (Company file, text).

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, source_type, url, notes, source_file",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "source_type",
        "-source_type",
        "url",
        "-url",
        "notes",
        "-notes",
        "source_file",
        "-source_file"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_company_regulators Company regulators: get one

One record of Company regulators (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Company regulators record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_company_controls Company controls: list

List the company's own controls (from its own catalogs: internal policies, customer security schedules), beside the shared control library. Company-specific: no other company sees them.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, instrument, catalog_title, source_type, regulator, version, control_id, category, prose, guidance, mandatory, default_severity, cadence, sla_days, mappings, evidence_expected, probe_workflows, source_file",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "instrument",
        "-instrument",
        "catalog_title",
        "-catalog_title",
        "source_type",
        "-source_type",
        "version",
        "-version",
        "control_id",
        "-control_id",
        "category",
        "-category",
        "prose",
        "-prose",
        "guidance",
        "-guidance",
        "mandatory",
        "-mandatory",
        "default_severity",
        "-default_severity",
        "cadence",
        "-cadence",
        "sla_days",
        "-sla_days",
        "source_file",
        "-source_file"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_company_controls Company controls: get one

One record of Company controls (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Company controls record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_list_coverage Control coverage: list

The company's control coverage at its last measurement: the share of applicable controls observed in the last 30 days, over every control (raw) and over its own controls only (company-specific-controls).

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "filter": {
      "description": "{field: value} or {field: {op: value}}, every condition ANDed; op is eq, ne, in, lt, lte, gt, gte, contains, prefix or exists; field is one of key, title, updated_at, series, value, numerator, denominator, period_start, period_end, computed_at, notes",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "sort": {
      "description": "The order: a field, key, title or updated_at; - first for descending (default key)",
      "type": "string",
      "enum": [
        "key",
        "-key",
        "title",
        "-title",
        "updated_at",
        "-updated_at",
        "series",
        "-series",
        "value",
        "-value",
        "numerator",
        "-numerator",
        "denominator",
        "-denominator",
        "period_start",
        "-period_start",
        "period_end",
        "-period_end",
        "computed_at",
        "-computed_at",
        "notes",
        "-notes"
      ]
    },
    "limit": {
      "description": "Records per page (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    },
    "after": {
      "description": "The next value of the previous page",
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "additionalProperties": false
}

maxwell_get_coverage Control coverage: get one

One record of Control coverage (this company's own) by its key, with every field and the records its links name.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
      "description": "The Control coverage record's key"
    }
  },
  "required": [
    "key"
  ],
  "additionalProperties": false
}

maxwell_get_metrics Maxwell metrics

This company's audit dashboard numbers: open findings by severity, found vs fixed per week, by application, regulator and control, overdue against SLA, time to fix, and the cost of audits.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "names": {
      "description": "Only these metrics (default every one)",
      "minItems": 1,
      "maxItems": 30,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "open_findings",
          "overdue_findings",
          "open_by_severity",
          "found_per_week",
          "fixed_per_week",
          "found_weekly_by_severity",
          "open_by_application",
          "open_by_regulator",
          "open_by_instrument",
          "open_by_control",
          "open_due_status",
          "time_to_fix",
          "median_fix_by_severity",
          "fix_rate",
          "controls_by_implementation",
          "coverage_all",
          "coverage_company_specific",
          "open_company_specific",
          "controls_due",
          "audits_per_week",
          "audit_cost",
          "audit_spend"
        ]
      }
    }
  },
  "additionalProperties": false
}

maxwell_start_refresh_soc Start Refresh the control ledger

Rebuild the company's control ledger from the shared catalogs that apply to it and its own catalogs (run it after adding the company's own controls); follow it with maxwell_audit_status.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_seed_company Start Set up the company profile

Start a audit (Set up the company profile) for this company. Creates the company's profile skeleton (details, summary, SDLC policy, an empty control ledger) that every audit reads. It is queued and runs in a sandbox, spending at most $3 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_refresh_apps Start Refresh an application

Start a audit (Refresh an application) for this company. Syncs the application's repositories (read only) and re-derives what they contain, so probes know their targets. It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_iac Start Audit infrastructure code

Start an audit of one application's infrastructure code (Terraform, CloudFormation, Pulumi, Ansible, CDK). Name the application in target_asset. Its findings land in the company's ledger; follow it with maxwell_audit_status.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_app_chart Start Audit Helm charts

Start a audit (Audit Helm charts) for this company. Static audit of the application's Helm charts and Kubernetes manifests. It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_schemas Start Audit data schemas

Start a audit (Audit data schemas) for this company. Static audit of the application's database schemas and data models for personal and financial data handling. It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_cicd_env Start Audit CI/CD pipelines

Start a audit (Audit CI/CD pipelines) for this company. Static audit of the application's build and release pipelines and their supply chain. It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_agent_graph Start Audit agent code

Start a audit (Audit agent code) for this company. Static audit of the application's AI agent code (tools, prompts, permissions) against the agentic and LLM top-10s. It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_probe_sdlc Start Audit the SDLC

Start a audit (Audit the SDLC) for this company. Static audit of the application's secure development practices (reviews, branch protection, CODEOWNERS). It is queued and runs in a sandbox, spending at most $40 of model use; it answers with the audit's id at once. Follow it with maxwell_audit_status and read its results with maxwell_get_audit_results.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_report_audit_findings Start Write the audit report

Start writing the company's audit report from its ledger; read it with maxwell_get_report_audit_findings_report once the audit has succeeded.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_start_measure_coverage Start Measure control coverage

Measure the company's control coverage now (Maxwell's cm_coverage KPI, no model call); read it with maxwell_list_coverage once it has succeeded.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "target_asset": {
      "description": "The company's record the audit is for (its credentials bound to that record reach the audit)",
      "type": "object",
      "properties": {
        "area": {
          "type": "string",
          "enum": [
            "applications"
          ]
        },
        "key": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:()-]{0,199}$",
          "description": "The record's key"
        }
      },
      "required": [
        "area",
        "key"
      ],
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

maxwell_audit_status Audit status

One audit of Maxwell by its id: its kind, status (queued, running, succeeded, failed, cancelled), attempts, cost and error.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "pattern": "^run_[A-Za-z0-9_-]{1,64}$",
      "description": "The audit's id (run_…)"
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false
}

maxwell_list_audits List audits

This company's audits of Maxwell, newest first.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "kind": {
      "description": "Only this kind",
      "type": "string",
      "enum": [
        "refresh_soc",
        "seed_company",
        "refresh_apps",
        "probe_iac",
        "probe_app_chart",
        "probe_schemas",
        "probe_cicd_env",
        "probe_agent_graph",
        "probe_sdlc",
        "runtime_probe_appcontainers",
        "runtime_probe_identity_access",
        "runtime_probe_network_perimeter",
        "runtime_probe_datapipeline",
        "runtime_probe_sandboxes",
        "runtime_probe_harnesses",
        "report_audit_findings",
        "measure_coverage",
        "add_company_catalog_preview",
        "add_company_catalog"
      ]
    },
    "limit": {
      "description": "At most this many (default 50)",
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    }
  },
  "additionalProperties": false
}

maxwell_get_audit_results Audit results

The results of one audit: each finding's check, asset and source records, its status (pass, fail, error, not_applicable, unknown), fingerprint and evidence.

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "pattern": "^run_[A-Za-z0-9_-]{1,64}$",
      "description": "The audit's id (run_…)"
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false
}

maxwell_cancel_audit Cancel a audit

Cancel a queued or running audit of Maxwell: a queued one ends now; a running one stops spending at once and ends at its next heartbeat.

Changes something. Who may call it: Member, Billing manager, Owner.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "pattern": "^run_[A-Za-z0-9_-]{1,64}$",
      "description": "The audit's id (run_…)"
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false
}

maxwell_get_report_audit_findings_report Write the audit report: Audit report

The Audit report a succeeded audit of Write the audit report wrote (markdown, from the company's files as that audit left them).

Reads only. Who may call it: Every role.

Input
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "pattern": "^run_[A-Za-z0-9_-]{1,64}$",
      "description": "The audit's id (run_…)"
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false
}