add-compliance-test-evidence
ChatGPTAdd evidence to a compliance test. Evidence can be either a link (URL) or a previously uploaded document (use upload-compliance-document first to get a document ID). Provide exactly one of 'link' or 'evidenceDocumentId', not both.
exclude-compliance-test
ChatGPTExclude an entire compliance test from the compliance assessment. Use this when a test is not applicable to the customer's environment. Always ask for a justification comment before excluding.
get-code-security-issue-by-id
ChatGPTFetch the full details of a single open SAST (static application security testing) finding by its Bastion issue ID, including the rule, severity, file path, line range, and affected repository. Use this after list-code-security-issues to drill into one specific finding when the user wants the details of a particular item — not to list or browse issues.
get-compliance-failing-summary
ChatGPTGet a summary of failing compliance tests grouped by integration and test type (manual/automatic) for a given framework. Use this after get-frameworks-stats to understand where failures are concentrated.
get-compliance-test-detail
ChatGPTGet detailed information about a specific compliance test including its failing assets and evidence summary. Use this after list-failing-compliance-tests to understand what is failing and what actions can be taken.
get-customer
ChatGPTFetch the authenticated customer's Bastion profile: company name, website, and basic account metadata. Use this when the user asks about their own company record in Bastion, or when another tool needs the customer's website or company name as input.
get-customer-policy-by-id
ChatGPTFetch the full content of a single customer policy by policyId. Returns the latest version with lexical content converted to plain text and parameters substituted. Use list-customer-policies first to discover available policyIds, then call this tool for the one you need. Fetching policies one at a time keeps responses within model context limits.
get-frameworks-stats
ChatGPTGet the aggregate compliance posture for every framework the customer is tracking (e.g. SOC 2, ISO 27001, HIPAA): total tests, pass/fail counts, and overall percentage per framework. Use this as the entry point when the user asks about overall compliance status, a single framework's completion, or which framework needs the most attention.
get-github-dependabot-resolution
ChatGPTRead Bastion's cached Dependabot compliance status across the customer's connected GitHub repositories. Returns 'pass' if all Dependabot tests pass, 'no_test' if none are configured, or 'fail' with the failing repositories and their test/asset IDs. Use this when the user asks whether Dependabot is properly enabled for their repositories or wants a one-shot view of Dependabot compliance.
get-knowledge-base-status
ChatGPTCheck the status of the customer's compliance knowledge base. Returns status (not_created, refreshing, ready), last refresh timestamp, and whether it's stale (>7 days old). Always call this before asking questions to ensure the knowledge base is ready.
get-trust-center-config
ChatGPTRead the customer's Trust Center configuration: whether it is published, the FAQ entries, background color, SEO head attributes (title, description, keywords), and related customization fields. Use this when the user asks what their Trust Center looks like today, or before calling put-trust-center so the edit preserves fields the user did not mention.
list-code-security-issues
ChatGPTGet open code security issues (SAST findings) from Bastion, filtered by criticality. Returns only key fields: id and the repoName of each evidence. Results are paginated (default 25 per page, max 100). Compare totalCount against the returned items and call again with a higher page to fetch more.
list-customer-policies
ChatGPTList the latest version of every customer policy (metadata only — no body content). Returns key fields per policy: policyId, version, category, type, status, filename. Use get-customer-policy-by-id to fetch the full text of a specific policy by policyId. Bodies are intentionally omitted here to keep the response within model context limits.
list-failing-compliance-tests
ChatGPTGet the list of failing compliance tests for a given framework, optionally filtered by test type (manual/automatic) and integration. Use this after get-compliance-failing-summary to drill into a specific integration/type combination. Returns only key fields: id, testId, name, testResultStatus, type, category. Results are paginated (default 25 per page, max 100). Compare totalCount against the returned items and call again with a higher page to fetch more.
mark-compliance-test-ready-for-review
ChatGPTSubmit a compliance test for Bastion admin review. Use this after adding evidence to a manual test to move it from 'fail' to 'ready_for_bastion_review' status. Once reviewed and approved by a Bastion admin, the test will count as passing.
post-customer-issues-remediation
ChatGPTRecord how a Bastion security issue is being handled by assigning it a remediation state (for example: accepted risk, false positive, or resolved) together with a required justification comment. Use this when the user has reviewed a specific code security issue and wants to change its remediation status. The remediation is reversible — it can be updated to a different state later.
post-knowledge-base-ask
ChatGPTAsk security and compliance questions using the customer's knowledge base. The knowledge base contains customer policies, controls, questionnaires, company information, and compliance documents. Returns AI-generated answers based on the customer's specific documentation. Requires knowledge base status to be 'ready'. Use get-knowledge-base-status first to verify.
post-knowledge-base-refresh
ChatGPTTrigger a refresh of the customer's compliance knowledge base. This is an asynchronous operation that takes approximately 10 minutes to complete. The knowledge base indexes all customer policies, controls, questionnaires, company information, and compliance documents. Use get-knowledge-base-status to check when refresh is complete.
put-compliance-test-exclude-asset
ChatGPTExclude multiple assets from multiple compliance tests. Each asset will be excluded indefinitely with a comment explaining why.
put-trust-center
ChatGPTUpdate the customer's Trust Center configuration: publish/unpublish the page, edit FAQ entries, change the background color, or update SEO head attributes (title, description, keywords). Use this when the user asks to change, publish, or customize their Trust Center page. Call get-trust-center-config first to see the current state so unspecified fields are preserved. Any change made here is visible on the customer's public Trust Center URL.
refresh-compliance-test
ChatGPTTrigger a refresh of automatic compliance tests for a given integration. Use this after the user has fixed an issue in an external system (e.g. enabled branch protection on GitHub) to re-check the test status. Returns immediately — the refresh runs asynchronously.
upload-compliance-document
ChatGPTUpload a document (screenshot, PDF, image) to the compliance system. Returns a document ID that can be used with add-compliance-test-evidence to attach it as evidence to a test. The document must be a base64-encoded string with MIME type prefix (e.g. 'data:image/png;base64,...'). Supported formats: PDF, PNG, JPG, XLSX, DOCX, CSV. Max size: 25 MB.
