Symfony Agent MCP

Statistics for Apache configuration: counts by type (rewrite/security-header/disclosure/directory/performance) and total issues

Statistics for API contract testing: counts by type, issue count

Statistics for API pagination: offset/cursor count, issue count

Statistics for GraphQL security: counts by type, issue count

Statistics for API HATEOAS: resource/collection count, issue count

Statistics for idempotency: key/storage/replay count, issue count

Statistics for JSON-LD: context/type/property/vocab count, issue count

Statistics for JSON:API format: counts by type, issue count

Statistics for API key rotation: hardcoded/rotation count, issue count

Show API Platform OpenAPI context statistics: class count, total properties, description coverage, deprecated count, example coverage, issues count

Statistics for OpenAPI security schemes: bearer/apiKey/oauth2/openIdConnect/basic count, issue count

Show API Platform operation statistics: resource count, total operations, write operation count, secured vs open write ops, normalization group coverage, issue count

Show API Platform pagination statistics: custom resource pagination count, disabled/cursor/client-control/max-set counts, custom paginator count, issue count

Custom normalizer statistics: normalizer/denormalizer/both counts, cacheable support coverage, issue count

API Platform DTO output statistics: resource count, explicit output class count, output:false count, transformer/processor coverage, issue count

Show API Platform error handling statistics: error format count, exception mapping count, 5xx mappings, custom normalizer presence, issues count

Show API Platform filter statistics: total declarations, entities with filters, custom filter count, issue count, filter type breakdown

API Platform IRI converter statistics: custom converter count, uriTemplate count, issue count

API Platform query extension statistics: collection/item/both counts, resourceClass check coverage, issue count

Show API Platform resource metadata statistics: resource count, shortName/description/types adoption, issue count

API Platform security expression statistics: resource count, expression count, security/securityPostDenormalize breakdown, issue count

Show API Platform security statistics: resource count, total/secured/unsecured operation counts, normalization context count, issue count

Show API Platform serialization context statistics: resource count, normalization/denormalization context coverage, issue count

Show API Platform state processor statistics: processor count, persist/remove/transaction counts, issue count

Show API Platform statistics: resource count, operation breakdown, filter count, and all serialization groups in use

API Platform subresource statistics: resource count, endpoint count, provider coverage, issue count

Show API Platform validation context statistics: resource count, operation count, with-groups count, issue count

Statistics for Problem Details: response/exception/listener count, issue count

Show API rate limit statistics: controller-level limits, nginx zone count, Caddy directive count, total mechanisms detected

Get full details for an API Platform resource: all operations with paths, per-operation serialization groups, filters, and pagination config

Statistics for response compression: counts by type, issue count

Show API state statistics: provider count, processor count, decorator count, deprecated AP v2 count, issue count

Show API versioning statistics: versions detected, versioned endpoint count, versioned serializer group count, FOSRest flag

Get application environment, debug mode, and version information

Show asset pipeline statistics: pipeline type, entry point count, package count, Stimulus controller breakdown

Show authentication statistics: JWT/OAuth2 presence, firewall count, stateless vs stateful, auth type breakdown, TTL warnings

Show authenticator statistics: total count by kind, CSRF/RememberMe badge coverage, firewall count, stateless count, login throttling coverage, security issue count

Statistics for AWS CloudFront configuration: env/PHP/config entry counts and issue breakdown.

Statistics for AWS Cognito integration: env/PHP/config entry counts and issue breakdown.

Statistics for AWS ECS task definitions: file/family/container counts, secret/health-check/privileged issues, and total issue count

Statistics for AWS Lambda / Bref: counts by type (runtime/cold-start/filesystem/timeout/messenger) and total issues

Statistics for AWS SSM Parameter Store: decryption/hardcoded/kms/naming/batch/credentials issue counts.

Statistics for AWS S3 integration: upload/download/presigned/acl pattern counts and total issues

Statistics for AWS Secrets Manager: rotation/version/cache/hardcoded/parse/credentials issue counts.

Statistics for AWS SES integration: counts by type (dsn/env/php/config) and total issue count

Statistics for Azure Blob Storage: package/sas/acl/connection-string/retry/content-type issue counts.

Statistics for Azure Pipelines configuration: file/stage/job counts, trigger/secret/timeout issues, and total issue count

Show Behat statistics: context count, step counts by type, feature file count, scenario count, issue count

Show Behat statistics: suite count, total feature files, total scenarios, context class count, step definition count

Get Behat step coverage statistics: feature file count, step count, defined vs undefined steps, unused definitions, coverage percentage

Get Behat tag statistics: feature file count, scenario count, unique tags, tag frequency table, browser driver status

Statistics for Bitbucket Pipelines configuration: step counts by type (build/test/deploy/security) and total issues

Show Blackfire statistics: SDK installed, ext-blackfire, Docker service, .bkf file count, PHP usage site count

Statistics for Braintree integration: pattern counts by type (gateway/transaction/subscription/webhook/vault), environment breakdown (sandbox/production/unknown), and total issues

Statistics for Bugsnag integration: php/js/config pattern counts and total issues

Show bundle statistics: total count by environment (prod/dev/test) and category breakdown

Read Symfony cache configuration from config/packages/cache.yaml — shows app/system adapters and configured pools

Show cache pool statistics: pool count, tag-aware count, pools without TTL, Redis/Memcached usage, prefix seed presence

Show cache warmer statistics: total count, required vs optional split, warmers with priority, warmers with heavy constructor deps

Statistics for Caddy server configuration: count of config files, directives analyzed, TLS/reverse_proxy/encode entries, and total issues

Statistics for CDN config: asset/CORS/CSP entry count, issue count

Show CI/CD statistics: pipeline count, GitHub/GitLab presence, tests-in-CI flag, static analysis flag, migration-in-CI flag, deploy pipeline count

Statistics for CircleCI configuration: job count, caching/parallelism/secret issues, and total issue count

Statistics for Cloudflare configuration: settings count, worker/pages entry counts, compatibility_date/secret/route issues, and total issues

Statistics for Cloudinary integration: counts by type (env/php/config) and total issue count

Statistics for CloudWatch integration: counts by type (handler/metric/alarm/retention/tracing) and total issues

Scan PHP classes for quality violations: long methods (>30 lines), high cyclomatic complexity, constructor bloat, oversized classes (>300 lines)

Show code quality statistics: average lines/methods/deps per class, violation count, long method total

Statistics for Codeception configuration

Get full details for a console command: description, class, arguments, options, and usage example

Show compiler pass statistics: total count, passes by phase, passes with explicit priority, bundle extensions registering passes

Get project information from composer.json: name, description, license, dependency counts, and scripts

Statistics for composer audit: dev-in-prod/abandoned/platform/script-risk count, total issue count

Console command option statistics: command count, total options/arguments, deprecated options, issue count

Statistics for Consul service discovery: health/acl/deregister/connect/port/tags issue counts.

Show service tag statistics: unique tag count, custom vs built-in, tagged service count, attribute vs YAML origin, orphan tag count

Get all action methods and routes for a specific controller class

Show controller security statistics: total actions, class-level vs method-level protection, open action count, attribute coverage percentage

Cookie security statistics: file count, HttpOnly/Secure/SameSite coverage, raw setcookie usage, session config issue count

Show CORS statistics: pattern count, wildcard origin count, credential paths, risk flag count

Show cron job statistics: total external cron entries, cron-named command count, sources detected

CSP statistics: files count, nonce/unsafe-inline/unsafe-eval/report-uri coverage, issue count

Custom exception statistics: class count, HTTP-status-coded count, interface count, issue count

Show statistics for Cypress E2E config issues grouped by type: baseurl/fixtures/specpattern/retries/security/tasks/video counts and total issues

Get database configuration including type, host, database name (password redacted)

Get database type, host, database name, and total table count from DATABASE_URL or doctrine.yaml

Statistics for Datadog custom metrics: call type breakdown (increment/gauge/histogram/timing/set/event/constructor) and issue count.

Statistics for Datadog: tracer/span/log/env count, issue count

DBAL connection factory statistics: custom factory count, wrapper_class presence, issue count

DBAL connection statistics: connection count, persistent count, timeout/pool_size coverage, issue count

DBAL middleware statistics: configured middleware count, SQLLogger usage, file count, issue count

Get statistics about DBAL prepared statement usage and parameter styles.

Show DBAL SchemaManager statistics: total usage count, breakdown by migration/test/production, transaction coverage, method usage counts, issue count

Show DBAL statistics: connection count, driver, read replica count, SSL, logging flags

Show DBAL transaction statistics: total files, wrapInTransaction count, manual beginTransaction count, rollBack coverage, try/catch coverage, nested transaction count, issue count

Show dependency graph statistics: total classes, average dependencies per class, circular count, layer breakdown

Show deployment statistics: platforms detected and their names, total issues

Statistics for Deptrac configuration

List only migrations containing DROP TABLE, DROP COLUMN, TRUNCATE, or DELETE FROM with their risk level and rollback availability

Show DI parameter statistics: total count, env references, sensitive values, boolean flags, breakdown by source file

Statistics for DigitalOcean App Platform: service counts by type (web/worker/job/static) and total issues

Statistics for Docker Compose health: service count, issue count

Statistics for Docker security configuration: counts by type (root-user/privileged/secret/mutable-tag/capability/readonly) and total issues

Show Docker statistics: Dockerfile found flag, PHP version, multi-stage flag, extension count, compose service count, healthcheck coverage, services with issues

Statistics for Docker Swarm config: service count, resource coverage, healthcheck coverage, replicated service count, issue count

Statistics for Doctrine association fetch strategies: total count, EAGER/LAZY/EXTRA_LAZY breakdown, issue count

Show Doctrine bulk operation statistics: total files, flush-in-loop count, batch pattern count, DQL update count, transaction coverage, clear-in-loop count, issue count

Show Doctrine cache statistics: SLC enabled flag, region count, configured driver count, cached entity count by usage mode

Show Doctrine cascade statistics: association counts by type, orphanRemoval count, issue count

Show Doctrine change tracking statistics: total entities, DEFERRED_IMPLICIT/EXPLICIT/NOTIFY counts, NotifyPropertyChanged count, scheduleForDirtyCheck count, large entity count, issue count

Get statistics about Doctrine column charset and collation usage.

Statistics for Doctrine column defaults: counts by type (missing-default/boolean/datetime/enum/nullable), issue count

Statistics for Doctrine composite PK entities: count, ManyToOne-as-Id, GeneratedValue issues, JOINED inheritance, find()/getReference() scalar calls

Statistics for connection retry: middleware/config/listener/ping count, issue count

Show Doctrine Criteria statistics: total files, collection-based vs repository-based usage, orderBy count, setMaxResults count, issue count

Show Doctrine custom platform statistics: platform class count, type class count, total method overrides, addType/overrideType call counts, most-overridden platform class

Statistics for DBAL bulk inserts: total count, insert-loop/execute-statement/query-builder breakdown, transaction coverage, prepared statement coverage, issue count

Statistics for Doctrine DBAL driverOptions: connection count, emulate-prepares enabled, stringify-fetches enabled, missing errmode, missing timeout

Statistics for DBAL event listeners: total count, schema listener count, postConnect count, event usage breakdown, issue count

Statistics for DBAL query profiling: explain/stack/slowlog/middleware count, issue count

Statistics for DBAL schema diffs: total files, schema diff API usage count, DROP TABLE count, RENAME COLUMN count, issue count

Show Doctrine discriminator statistics: hierarchy count by type, explicit map count, issue count

Statistics for Doctrine DQL walkers: total count, tree/output/sql breakdown, cache issue count, total issues

Statistics for Doctrine encryption: entity count by type (attribute/annotation/subscriber), issue count

Show entity factory statistics: foundry installed flag, total factories, getDefaults/states/initialize/faker coverage counts, issue count

Show Doctrine entity graph statistics: total entities, cycle count, deep depth count, fat entity count, self-referential count, total associations, issue count

Get statistics about Doctrine entity listener usage and registration.

Statistics for Doctrine entity locks: total files, lock type breakdown, @Version coverage, OptimisticLockException catch coverage, issue count

Statistics for EntityManager scope: static/closed/scope issues, total issue count

Statistics for Doctrine entity proxies: config presence, auto-generate setting, final entity count, private constructor count

Show Doctrine entity state statistics: total files, merge/detach/refresh/contains usage counts, issue count

Show Doctrine EventManager statistics: file count, addEventListener call count, issue count

Show Gedmo extension statistics: entity count by extension type, list of soft-deleteable entities

Show Doctrine filter statistics: registered count, enabled/disabled split, filter class count, activation call count

Statistics for Doctrine full-text search: counts by type, issue count

Statistics for Gedmo extensions: blameable/loggable/timestampable entity count, issue count

Statistics for Gedmo Sluggable: slug count, unique/non-unique split, updatable/non-updatable split, issue count

Statistics for Gedmo Translatable: entity count, locale field presence, issue count

Statistics for Gedmo Tree: count per strategy type (nested/closure/materializedPath), issue count

Statistics for hydration modes: object/array/scalar/single-scalar/custom count, issue count

Doctrine hydrator statistics: custom count, registered vs unregistered, config entries

Show Doctrine index statistics: entity count, total indexes, unique constraint count, composite index count, missing FK index count, issue count

Show Doctrine inheritance statistics: MappedSuperclass count, counts by inheritance type, issue count

Doctrine mapping format statistics: PHP/XML/YAML file counts, mixed-format sets, issue count

Show Doctrine migration statistics: total count, transactional/non-transactional, version gaps, dependency count

Get statistics about Doctrine migrations configuration.

Get statistics about Doctrine multi-connection configuration.

Statistics for MySQL features: FULLTEXT/JSON/spatial/virtual/charset count, issue count

Show Doctrine named query statistics: entity count, query count, result mapping count, issue count

Show Doctrine MongoDB ODM statistics: bundle presence, document/embedded/GridFS counts, ReferenceMany/ReferenceOne counts, indexed document count, ORM co-usage flag

Statistics for Doctrine ORM profiling: environments configured, profiling enabled count, backtrace collection count, custom logger count, issue count

Show Doctrine ORM statistics: EM count, mapping driver, filter count (enabled/disabled), custom DQL function count

Show orphanRemoval statistics: association count, cascade persist count, redundant cascade remove count, issue count

Show Doctrine Paginator statistics: file count, fetchJoin count, setMaxResults/setFirstResult adoption, issue count

Statistics for PostgreSQL features: JSON/array/fulltext/generated/sequence count, issue count

Show Doctrine query cache statistics: driver types for query/metadata/result cache, whether array cache is used, issue count

Statistics for raw SQL/DQL: query count by type, issue count

Statistics for read replica config: connection/usage count, issue count

Show Doctrine repository query statistics: repository count, by query type, setMaxResults adoption, issue count

Doctrine result cache statistics: file count, enableResultCache/setCacheMode count, lifetime coverage, issue count

Show Doctrine ResultSetMapping statistics: total files, RSM count, RSMBuilder count, native query count, user input concatenation count, issue count

Show Doctrine 2LC statistics: entity count by usage mode, named region count, issue count

Get statistics about Doctrine sequence generator configuration.

Statistics for Doctrine DBAL sharding: whether sharding is enabled, shard count, ShardChoser, issue count

Show Doctrine SLC statistics: entity count by cache usage mode (READ_ONLY/READ_WRITE/NONSTRICT), region count, query cache usage

Doctrine soft delete statistics: entity count, Gedmo vs custom, issue count

Show Doctrine event subscriber statistics: total count, attribute vs interface style, events per subscriber, issue count

Statistics for temporal tables: valid-time/transaction-time/bitemporal count, issue count

Show Doctrine custom type statistics: total registered, third-party vs own, entity usage count, categories

Get statistics about Doctrine UoW lifecycle listener patterns.

Statistics for upsert patterns: DBAL/ORM/native/fetch-persist count, issue count

Statistics for versioned entities: versioned/unversioned count, issue count

Show DQL function statistics: total count by category, missing class count

Statistics for Easy Coding Standard configuration

Show admin panel statistics: dashboard count, CRUD controller count, secured vs unsecured dashboards, Sonata admin count

Statistics for Elastic APM PHP agent: INI/env/PHP entry counts and issue breakdown.

Statistics for Elasticsearch mapping: mapping/query/security count, issue count

Statistics for Elasticsearch usage: query/scroll/percolate/bulk/alias/config pattern counts and total issues

Show embeddable statistics: value object count, entities using embeddings, total usages, and unused embeddables

Get statistics about entities, properties, and relationships in the application

Get detailed information about a specific entity including properties and relationships

Show environment config diff statistics: override count per env, packages with dev-only overrides (potential prod gaps)

Show environment variable statistics: total keys, sensitive count, keys that differ across envs

Get log files for a specific environment (dev, prod, test)

Show error page statistics: custom template count, catch-all presence, missing critical codes, exception listener count

Get a summary of errors, warnings, and notices in a log file

Find all listeners registered for a specific event name (e.g. kernel.request, kernel.exception)

Event priority statistics: listeners with explicit priority, distinct event count

Show event system statistics: total subscribers, listeners, distinct events, and listener count per event

Statistics for Excel generation: library/security count, issue count

Exception subscriber statistics: subscriber count, HTTP/JSON response count, catch-all count, issue count

Show feature flag statistics: installed systems, flag count per source (YAML/env/parameter), classes checking flags, total check count

Show fetch mode statistics: entities with custom fetch, EXTRA_LAZY/EAGER/OrderBy counts, issue count

Statistics for file archive: operation count, issue count

Show file storage statistics: Vich mapping count, Flysystem storage count, local vs cloud adapter split, uploadable entity count, issue count

Statistics for Firebase integration: pattern counts by type (config/fcm/auth/realtime-db/firestore/storage) and total issues

Show fixture statistics: total count, group count, dependency count, reference count, circular dependency count

Show fixture statistics: class count, groups, dependency count, reference count, average size

Show Flex recipe statistics: total recipe count, official vs contrib breakdown, packages that added env vars

Statistics for fly.toml: settings analyzed, secret-like env vars found, health check issues, and total issue count

Get statistics about form types: total forms, total fields, most-used field types and constraints

Get detailed info for a form type: all fields with their types, options, constraints, and required status

Statistics for FOSRestBundle: config entry count, PHP usage count, issue count

Get Symfony framework configuration from config/packages/framework.yaml

Statistics for FrankenPHP configuration: counts by type (worker/tls/compression/http3/mercure/env) and total issues

Statistics for GDPR compliance: PII/consent/logging count, issue count

Statistics for GitHub Actions configuration: counts by type (permission/mutable-ref/secret/trigger/runner/cache) and total issues

Statistics for GitHub API integration: pattern counts by type (rest/graphql/webhook/oauth/app) and total issues

Statistics for GitHub Dependabot configuration: ecosystem/limit/assignee/schedule/groups issue counts.

Statistics for GitLab CI configuration: counts by type (variable/artifact/security-scan/environment/trigger/image) and total issues

List classes exceeding thresholds: >15 methods, >8 constructor dependencies, or >300 lines — potential "god class" anti-pattern

Statistics for Google Cloud Run configuration: entry counts, memory/secret/concurrency/timeout issue breakdown and total issues

Statistics for Google Cloud Storage: package/acl/signed-url/hmac/key-path/credentials issue counts.

Return summary statistics for Google OAuth integration: entry counts by type and total issues found.

Statistics for Grafana dashboard configuration: counts by type (dashboard/alert/datasource/secret/provisioning) and total issues

Show GraphQL statistics: total types, Query/Mutation/Object/Input/Enum counts, deprecated field count, resolver class count, API Platform GraphQL enabled flag

Statistics for gRPC integration: proto/service count, issue count

Statistics for GrumpPHP: config files, tasks configured, issue count

Show health check statistics: endpoint count, check implementations, liveness/readiness coverage, health bundle detection

Statistics for Helm chart configuration: chart count, settings analyzed, image tag/resource limit/probe issues, and total issue count

Statistics for Heroku configuration: counts of Procfile entries, app.json settings, buildpacks, and issues including missing worker/release phases

Statistics for HTMX integration: template/controller count, issue count

Show HTTP cache statistics: cached action count, public vs private split, ETag/Vary usage, proxy config, max-age range

Show HTTP client statistics: client count, service usage count, external base URIs, and SSL verification warnings

HTTP security header statistics: listener count, per-header coverage count, issue count

Statistics for HubSpot integration: counts by type (env/php/config) and total issue count

Statistics for image processing: upload handler count, issue count

Importmap statistics: total packages, pinned vs unpinned, polyfill count, local count, issue count

Statistics for Infection mutation testing: config presence, MSI threshold, mutator count, log file presence, and log summary (killed/escaped/MSI score) if log file exists

Show input DTO statistics: controller count, distinct DTO types, attribute usage breakdown, validation group usage

List installed Composer packages from composer.lock. Filter by type: symfony, dev, or a package type like "library"

Return aggregated counts of Intercom auth/identity/pii/ratelimit/config patterns and total issues found.

Statistics for Jenkins configuration: file count, declarative/scripted stage counts, credential/timeout/post-failure issues, and total issues

Show JWT authentication config (algorithm, token TTL, key paths masked), OAuth2 grant types/scopes, and firewall authenticator types

Statistics for Kafka integration: transport/producer count, issue count

Return summary statistics for Kafka Schema Registry configuration: entry counts by type and total issues found.

Show Kernel statistics: total bundles, bundles per environment, MicroKernelTrait, custom build(), risky dev bundles in prod

Statistics for Kubernetes manifests: count per kind (Deployment/Service/Ingress/ConfigMap/Secret/HPA/PDB), issue count

Statistics for League OAuth2 client: composer/env/PHP entry counts, provider breakdown, and issue count.

Find all entities that have a callback for a specific lifecycle event (e.g. PrePersist, PostLoad, PreUpdate)

Show lifecycle callback statistics: entity count, callbacks per event type, PostLoad warning (runs on every load)

Show Live Component statistics: component count, form trait count, total props/actions, writable prop count, issue count

Show lock statistics: store count, usage count, locks without TTL (deadlock risk), dynamic key usage, resource names

Return a summary count of Loki/Promtail configuration entries and issues found in the project.

Show Symfony Mailer configuration: MAILER_DSN transport type, host, global headers, and whether emails are actually sent

Mailer DKIM statistics: transport count, DKIM/Return-Path/signing-key coverage, issue count

Show mailer statistics: transport type, email class count, template count, HTML vs text templates

Statistics for Mailgun integration: pattern counts by type (config/transactional/batch/webhook/validation) and total issues

Statistics for Meilisearch integration

Statistics for Memcached integration: counts by type, issue count

Show Mercure push statistics: hub configured, resource push count, private/custom topic counts, direct publish count, try/catch count, issue count

Show Mercure statistics: hub count, hubs without JWT, public hubs, update call sites, distinct topic count

Show Messenger handler statistics: handler count, distinct message count, fan-out messages, buses, handlers with priority/transport assignment

Get Symfony Messenger overview: buses, transports, routing rules count, and message class summary

Show Messenger middleware statistics: bus count, total middleware entries, custom middleware and stamp class counts

Messenger serializer statistics: configured serializer type, custom serializer count, issue count

Return summary statistics for Microsoft Graph integration: entry counts by type (composer, env, php) and total issues found.

Show migration analysis statistics: total count, SQL statements, missing rollbacks, destructive operations by risk level

Show migration history statistics: file count, squash count, no-down-method count, all_or_nothing status, table name

List all Doctrine migration files found in migrations/ directory with versions and dates

Statistics for MongoDB integration: driver/query/security/config pattern counts and total issues

Monolog channel statistics: channel count, explicitly-routed count, excluded count, issue count

Show Monolog statistics: handler count by category (alert, file, fingers-crossed), custom channels, processors

Show multi-tenancy statistics: tenant entity count, Doctrine filter count, listener count, DBAL connection count, detected approach (DB-per-tenant vs row-level vs entity-based)

N+1 query statistics: suspected location count, affected file count

Statistics for NelmioSecurityBundle: entries per section, issue count

Show Nelmio statistics: installed, configured, area count, OA annotated file count, security scheme count

Statistics for netlify.toml analysis: total findings and issues, breakdown by TOML section

Statistics for New Relic integration: config/instrumentation count, issue count

Show New Relic PHP agent statistics: INI setting count, PHP API call counts, license key status, SQL recording mode, PII-risk custom parameter count, custom event and transaction naming usage

Statistics for nginx+fpm: nginx/security-headers/fpm directive count, issue count

Return summary statistics for NGINX Unit configuration: number of config files, entries, and issues.

Show notifier statistics: transport count by channel type, channel policies, notification class count

Notifier transport statistics: total count, by type, env var coverage, hardcoded credential count, issue count

Show OAuth/SSO statistics: client count per bundle, env-detected providers, authenticator class count, security issue count, provider list

Return summary statistics for OAuth2 server configuration: grant types found, issues count, and entry breakdown.

OPcache/APCu statistics: config files found, enabled status, preload configured, issue count

Statistics for OpenAI integration: completion/chat/embedding/image/moderation pattern counts and total issues

Show OpenAPI statistics: NelmioApiDocBundle detected, annotated endpoint count, response doc coverage, schema class count, OA property count, tags used

OpenTelemetry statistics: detected, exporter/processor/instrumentation counts, sampler configured, issue count

Statistics for OWASP dependency scanning: configured/missing status for each tool (dependency-check, retire-js, npm-audit, composer-audit) and total issues

Statistics for Panther testing

Show password hasher statistics: total hashers, critical/warning count, algorithms used, hashers with active migration

Return summary statistics for PayPal Checkout SDK v2 integration: entry counts by type and total issues found.

Show projection statistics: SELECT NEW count, existing/missing DTO count, partial object load count, issue count

Show QueryBuilder statistics: repository count with QB, total QB usages, join count, native SQL count, issue count

Get all relationships defined on a specific entity

Show repository statistics: total count, ServiceEntityRepository vs EntityRepository split, interface adoption, direct getRepository() call count, issue count

Show response cache statistics: controller count, #[Cache] attribute count, public cache count, ETag/Last-Modified usage, issue count

Get security configuration including authentication and authorization setup

Get DI container services configuration from config/services.yaml

Statistics for asset SRI: external asset count, with/without SRI, issue count

Get the exact Symfony version installed (from composer.lock) with a list of all symfony/* components

Get detailed schema for a table: columns (with types/nullable), indexes, and foreign keys derived from Doctrine entity mapping

Show timestamp statistics: total count, manual/Gedmo/trait/none breakdown, issue count

Show MCP server internal cache statistics: hit rate, entries per namespace, TTL, and evictions

Inspect Symfony application cache pools in var/cache/ — lists pools with disk size, file count, and adapter type

Show abstract: true and parent: service definitions from services.yaml: child count per abstract, inherited calls/properties, unused abstract warning, missing parent warning

Static accessibility audit of Twig templates: missing img alt, button without accessible name, input without label, table without caption/scope, aria-hidden on focusable elements, skipped heading levels, multiple h1 — categorized by WCAG severity

Analyze Algolia integration: detect composer packages, env credentials (ALGOLIA_APP_ID/API_KEY/SEARCH_KEY), config/packages/algolia*.yaml, PHP SearchClient/search/saveObject/setSettings usage, flag admin key for search, no attributesForFaceting, hardcoded index names

Analyze Alpine.js integration in Symfony templates; warns on x-data with Twig expression (JS injection), x-html XSS risk, $eval with user data, fetch result to innerHTML, password in x-model, CSP with unsafe-eval

Scan *.yml/*.yaml, playbooks/, ansible/ for Ansible playbook security issues: shell/command tasks with hostvars/vars variables missing | quote filter (injection), become: true without become_user (defaults to root), plaintext secrets in vars: block (masked), missing no_log: true on credential tasks, gather_facts: true unnecessarily, ignore_errors: true on critical tasks.

Analyse Apache .htaccess and virtual-host config files for missing front-controller rewrite rules, missing security headers, server version disclosure, directory listing, and performance settings

Analyze API contract testing setup; warns on external API calls without Pact, no Pact broker verification in CI pipeline

Analyze API pagination implementation; warns on offset pagination with expensive COUNT, high OFFSET performance degradation, cursor without encoding, one-directional cursor, API Platform without max items per page, page-based instead of cursor for large collections

Analyze GraphQL security; warns on introspection enabled in prod, missing depth/complexity limits, N+1 resolver queries without DataLoader, mutations without security attributes

Analyze API HATEOAS hypermedia link implementation; warns on API controllers without _links, collection endpoints without pagination links, API Platform resources without self link in serialization groups

Detect API idempotency key patterns; warns on key read but not stored, storage without replay, no TTL, empty key not validated, key on GET requests

Detect JSON-LD @context patterns; warns on ApiResource without IRI types, HTTP schema.org IRIs (use HTTPS), missing @vocab, invalid .jsonld context files

Analyze JSON:API format compliance; warns on missing jsonapi format configuration, wrong content-type headers, error responses without JSON:API structure

Analyze API key rotation and lifecycle management; warns on hardcoded keys in committed .env, non-timing-safe comparison, no key versioning for rotation, API keys without expiry field

List API Platform OpenAPI context: #[ApiProperty] descriptions, examples, enums, deprecated properties, deprecationReason presence, type consistency checks, normalizationContext warnings

Analyze OpenAPI security scheme definitions; warns on ApiKey in query param, OAuth2 implicit flow (deprecated), missing bearerFormat, openIdConnect without discovery URL, schemes defined but not applied

Show API Platform per-resource operations: Get/GetCollection/Post/Put/Patch/Delete per class, security expression presence, normalizationContext groups, input/output DTO, uriTemplate, Post/Put/Patch/Delete without security warning

Show API Platform pagination config per resource: paginationEnabled, paginationItemsPerPage, paginationMaximumItemsPerPage, paginationClientEnabled, paginationClientItemsPerPage, paginationViaCursor, global api_platform.yaml defaults, unlimited-items warning when client control enabled without maximum

Detect custom NormalizerInterface/DenormalizerInterface: supportsNormalization/supportsDenormalization presence, getSupportedTypes cache method, API Platform context check

Detect API Platform output: DTO classes in #[ApiResource], OutputDataTransformerInterface implementations, output: false with normalization_context warning, missing transformer warning

Audit API Platform error handling: error_formats and exception_to_status from api_platform.yaml, custom exception normalizers, ProblemDetailsFactory, HTML format warning, 5xx mapping detection

Show API Platform filters: #[ApiFilter] declarations per entity (Search/Order/Date/Range/Boolean/Exists/Numeric), strategy, properties, custom AbstractFilter subclasses, SearchFilter without strategy warning, OrderFilter on text field warning

Detect API Platform IriConverterInterface implementations: getIriFromResource/getResourceFromIri presence, uriTemplate usage, missing method warning

Detect API Platform QueryCollectionExtensionInterface and QueryItemExtensionInterface: applyToCollection/applyToItem presence, resourceClass check, global extension warning

Show API Platform resource metadata: shortName, description, iri, JSON-LD types, uriTemplate, missing description warning, non-prefixed type IRI warning

Show API Platform security audit: operations without security/securityPostDenormalize, unsecured write operations (POST/PUT/PATCH/DELETE), public DELETE warning, missing normalizationContext (data leak risk), sensitive field name in normalization groups

Analyze per-operation security:/securityPostDenormalize: expressions in #[ApiResource]: is_granted/user/object/previous_object usage, PUBLIC_ACCESS warning, write-without-user-check warning

Show API Platform normalizationContext/denormalizationContext: serialization groups per operation, missing groups warning (all-properties serialized/writable)

Show API Platform StateProcessorInterface implementations: persist/flush/remove detection, transaction management, missing process() warning, persist without flush warning

Detect API Platform subresources via multi-variable uriTemplate patterns and deprecated @ApiSubresource, state provider coverage, legacy annotation migration warning

Show API Platform per-operation validationContext groups: Post/Put/Patch operations, validation group per operation, missing groups on write operations warning

Detect RFC 7807 Problem Details usage; warns on missing "type" field, wrong Content-Type, contradictory status codes, stack trace in response

Show API-layer rate limiting: nginx limit_req_zone/limit_req directives, Caddy rate_limit, controller-level RateLimiterFactory injection and rate-limit attributes, controllers without any limit coverage

List all API Platform resources (#[ApiResource]) with their operations, serialization groups, filters, and security rules

Analyze response compression configuration; warns on missing nginx gzip, gzip without gzip_min_length, gzip on binary images, missing Vary header

Show API Platform 3 state providers and processors: ProviderInterface/ProcessorInterface implementations, #[AsDecorator] detection, resource binding, pagination/flush/mailer flags, deprecated AP v2 DataProvider/DataPersister style detection

Show API versioning: URL-prefixed routes (/v1/, /v2/), versioned serializer groups (v1:read), FOSRestBundle versioning, gap analysis between versions

Show asset pipeline type (Asset Mapper or Webpack Encore), entry points, imported packages/importmap entries, and Stimulus controllers

Scan for AWS CloudFront distribution configuration: composer.json aws/aws-sdk-php, .env* CLOUDFRONT_DISTRIBUTION_ID/KEY_PAIR_ID/PRIVATE_KEY_PATH (masked), PHP CloudFrontClient/createInvalidation/getDistribution/sign/CloudFrontCookieSigner/CloudFrontUrlSigner usage, config/packages/ and config/aws/ YAML/JSON. Flags wildcard invalidation (/*), signed URL without expiry, hardcoded private key path.

Scan for AWS Cognito user pool integration: composer.json aws/aws-sdk-php, .env* Cognito vars (masked secrets), PHP CognitoIdentityProviderClient/initiateAuth/adminInitiateAuth/respondToAuthChallenge/signUp/adminGetUser, JWT signing key verification. Flags USER_PASSWORD_AUTH flow, missing JWT verification, hardcoded client secret, adminConfirmSignUp bypassing email verification, missing MFA handling.

Analyse ECS task definition JSON files (*task-definition*.json, ecs-task*.json, taskdef.json) for hardcoded secrets in environment[], missing healthCheck, privileged:true containers, and missing cpu/memory

Analyse AWS Lambda / Bref configuration: runtime layers, cold-start memory, filesystem write safety, timeout limits, missing APP_ENV=prod, and SQS Messenger transport

Scan src/**/*.php, config/**/*.yaml, .env* for AWS SSM Parameter Store patterns: GetParameter with WithDecryption: false on SecureString, hardcoded parameter name (not env var), missing custom KMS key alias (uses default aws/ssm), parameter path not following /app/env/param convention, multiple individual GetParameter calls instead of batch GetParameters, AWS credentials in source (masked).

Analyze AWS S3 integration: detect composer SDK (aws-sdk-php, flysystem-aws-s3-v3), env credentials (AWS_ACCESS_KEY_ID/SECRET/S3_BUCKET/REGION), PHP S3Client/putObject/getObject/presigned usage, flag public-read ACL, hardcoded buckets, no server-side encryption, presigned URL without expiry

Scan src/**/*.php, config/**/*.yaml, .env* for AWS Secrets Manager patterns: RotationEnabled: false, GetSecretValue without VersionStage AWSCURRENT, missing SecretCache/SecretsManagerCache, hardcoded secret ARN or name, JSON parse without error handling, AWS credentials in source (masked).

Analyze AWS SES integration: scan .env/.env.local/.env.prod/mailer.yaml for MAILER_DSN with ses+smtp/api/https, AWS_SES_* env vars (masked), PHP SesClient/SesV2Client/SimpleEmailServiceV2Client usage, hardcoded AWS credentials in PHP. Flags: missing bounce/complaint handler, ses+smtp vs ses+api, APP_ENV=prod sandbox risk

Scan src/**/*.php, composer.json, config/**/*.yaml, .env* for Azure Blob Storage patterns: azure/storage-blob or microsoft/azure-storage-blob in composer.json, SAS token without expiry, container access set to container/blob (public), connection string with AccountKey (masked), missing retry policy (RetryMiddlewareFactory), blob upload without Content-Type header.

Analyse Azure Pipelines YAML (azure-pipelines.yml, azure-pipelines.yaml, .azure/pipelines.yml) for missing trigger branch filters, secrets in variables, no timeoutInMinutes, and job configuration

Show Behat configuration: suites, contexts, extensions (Mink/Panther), feature file count, scenario count per suite, WIP scenario warnings

Show Behat context step definitions: Given/When/Then counts, BeforeScenario/AfterScenario hooks, feature file count, scenario count, missing Context interface warning

Analyse Behat step coverage: match .feature file steps against PHP step definitions (@Given/@When/@Then / PHP 8 attributes); reports undefined steps (runtime errors), unused definitions (dead code), overly broad regex patterns, non-standard file locations

Analyse Behat scenario tags: @javascript without browser driver, @wip without TODO, @skip without reason, large @javascript percentage (slow suite), redundant feature+scenario tags, @slow without timeout config, custom tags not in any profile filter

Analyze bitbucket-pipelines.yml: parse default/branch/PR pipeline steps, image version, caches, services, deployment environments; flag no caches, plain-text secrets in scripts, privileged containers, missing test step

Show Blackfire profiler configuration: SDK/ext-blackfire in composer, Docker service detection, .bkf Player scenario files, PHP usage sites in src/, credentials in env files warning

Analyze Braintree integration: detect braintree/braintree_php in composer.json; scan .env* for BRAINTREE_MERCHANT_ID/PUBLIC_KEY/PRIVATE_KEY/ENVIRONMENT; scan src/**/*.php for Braintree\Gateway/transaction()->sale/subscription()->create/webHookNotification()->parse; flag production env with sandbox credentials, missing webhook signature verification, no 3D Secure enforcement, hardcoded credentials; masks BRAINTREE_PRIVATE_KEY values

Analyze Bugsnag integration: detect composer packages (bugsnag/bugsnag-symfony, bugsnag/bugsnag), env BUGSNAG_API_KEY, config/packages/bugsnag.yaml (api_key/notify_release_stages/app_version/app_type), PHP notifyException/notifyError usage, flag missing release stage filter, no app_version, hardcoded API key

List all Symfony bundles from config/bundles.php grouped by category, showing active environments (all/dev/test)

List cache pools: adapter per pool (Redis/APCu/Filesystem), TTL, tag-aware flag, DSN masked, warns on pools without TTL

List custom cache warmers (CacheWarmerInterface/WarmableInterface): required vs optional, priority, heavy constructor dependencies warning

Analyse Caddy server configuration files (Caddyfile, caddy.json, docker/Caddyfile) for missing TLS, missing gzip/zstd encoding, reverse_proxy without health checks, and root directive settings

Analyze CDN configuration in Symfony; warns on HTTP CDN base_url, missing SRI integrity attributes, CDN domains not in CSP, CORS wildcard origin, AssetMapper server not configured for CDN delivery

Show CI/CD configuration: GitHub Actions workflows and GitLab CI stages with PHP versions, Composer, PHPUnit/Behat, PHPStan, migrations, cache warmup, deployment gating checks; Makefile Symfony targets

Analyse .circleci/config.yml for PHP version pinning, composer --no-dev in prod, vendor/ caching, test parallelism, and secrets in plain text commands

Analyse Cloudflare wrangler.toml, wrangler.json, and .dev.vars for outdated compatibility_date, secrets in [vars] instead of wrangler secrets, missing routes, and KV namespace bindings

Analyze Cloudinary media management integration: detect composer.json cloudinary/cloudinary_php, scan .env* for CLOUDINARY_URL/CLOUD_NAME/API_KEY/API_SECRET (masked), cloudinary.yaml, PHP new Cloudinary/config/upload/uploadLarge/adminApi/uploadApi usage. Flags: exposed api_secret, unsigned upload preset, missing transformation restrictions, adminApi in web code, missing notification_url

Analyse AWS CloudWatch integration: Monolog handlers, static AWS credentials in .env, CloudWatch alarms in Terraform/CloudFormation, log retention settings, and X-Ray tracing configuration

Analyze Codeception testing framework configuration and detect issues

List all Symfony console commands from src/Command/ grouped by namespace prefix, with name and description

List custom DI Compiler Passes (CompilerPassInterface) grouped by phase (BEFORE_OPTIMIZATION/REMOVING/etc.), with priority and registration class

Audit composer.json for security risks: dev packages in require, known abandoned packages, unbound PHP version constraint, PHP 7 EOL, minimum-stability dev/alpha, post-install network calls

List all available configuration packages in config/packages directory

Analyze console command addOption()/addArgument() definitions: name, shortcut, VALUE_REQUIRED/OPTIONAL mode, default values, missing descriptions, required-after-optional argument error

Scan consul.json, consul.hcl, docker-compose.yml, config/**/*.yaml for Consul service discovery issues: service registration without health check, missing deregister_critical_service_after, no ACL token for service registration, connect native_integration without sidecar proxy, port hardcoded to 0, missing environment tags.

List service tags: custom vs built-in tags, services per tag, tagged_iterator/locator consumers, orphan tags with no consumer

List all controller classes in src/Controller/ with their action count and parent class

Audit cookie security flags: Symfony Cookie class HttpOnly/Secure/SameSite, setcookie() raw usage, session cookie config (cookie_secure/cookie_httponly/cookie_samesite) in framework.yaml

Show NelmioCorsBundle CORS configuration: allow_origin/methods/headers per path pattern, credentials, max_age, and dangerous config combinations

Show external cron jobs (outside SchedulerBundle): Dockerfile crontab, docker-compose cron service, supervisord programs, Kubernetes CronJob manifests, Platform.sh crons, console commands named like cron targets

Detect Content Security Policy implementation: nonce usage, 'unsafe-inline'/'unsafe-eval' risks, strict-dynamic, report-uri/report-to directive, Report-Only mode

Show custom authenticators: AbstractAuthenticator/AbstractLoginFormAuthenticator subclasses with Passport badge analysis (CSRF/RememberMe/PasswordCredentials), firewall deep config (stateless, login_throttling, remember_me security), security issue detection

Map custom Exception/Error class hierarchy: parent classes, children, HTTP status codes, naming convention check, invalid HTTP code warning

Scan cypress.config.js/ts, cypress.json and cypress/ directory for Cypress config issues: missing baseUrl, no fixtures, broad specPattern, missing retries, chromeWebSecurity:false, no setupNodeEvents, video not disabled for CI

Scan for DogStatsD / Datadog custom metrics in PHP: composer.json datadog/php-datadogstatsd, PHP Datadogstatsd::increment/gauge/histogram/timing/set/event, new DogStatsd/Datadogstatsd. Validates metric name characters ([a-zA-Z0-9._-] only), detects PII in tags (user_id/email/ip), flags missing sampling_rate parameter and constructor without host/port.

Detect Datadog APM ddtrace usage; warns on missing DD_SERVICE/DD_ENV/DD_VERSION, API key in .env, spans not finished, PII in span tags

Show Doctrine DBAL connection config: driver, host, charset, server_version, read replicas, SSL, logging, persistent connections

Detect custom Doctrine DBAL ConnectionFactory classes and wrapper_class config: createConnection() override, wrapper_class inheritance check

Analyze DBAL connection options: PDO::ATTR_PERSISTENT (PHP-FPM leak risk), connect_timeout, pool_size, driver options from doctrine.yaml

Show DBAL middleware stack from doctrine.yaml, deprecated SQLLogger usage (DBAL 3+), missing middleware warning, files using setSQLLogger

Analyze DBAL prepared statements for SQL injection risks (string concatenation), mixed param styles, and missing array binding types for IN clauses.

Show DBAL SchemaManager usage: createSchemaManager/createTable/dropTable/introspectTable/listTableNames/tablesExist/getDatabasePlatform calls; classifies into migration/test/production code; warns on schema modifications in production, createTable/dropTable outside migrations, missing transaction, introspectTable in hot paths

Show DBAL transaction patterns: beginTransaction/commit/rollBack/wrapInTransaction usage; detects nested transactions, missing rollBack in catch, exception swallowing; warns on manual transaction patterns (prefer wrapInTransaction), SERIALIZABLE isolation in high-concurrency code

Show deployment configuration: Kubernetes Deployments/HPA/Ingress (replicas, resource limits, probes), Helm values, Fly.io (vm size, min/max machines), Heroku Procfile, Render.com, Google Cloud App Engine — with availability and configuration issue detection

Analyze Deptrac architecture layer configuration and detect issues

List all Symfony DI %parameters% from services.yaml and config packages, grouped by source file (sensitive values masked)

Analyze DigitalOcean App Platform config (.do/app.yaml, app.yaml, .do/deploy.template.yaml): parse services/workers/jobs/databases, flag hardcoded secrets in envs, missing health_check, basic-xxs instance for prod, missing alert_policies; masks secret values

Analyze Docker Compose service health configuration; warns on db/cache services without healthcheck, no restart policy, depends_on without condition: service_healthy, missing resource limits on web/app containers

Show Docker configuration: Dockerfile base image, PHP version, extensions, multi-stage build, root-user warning; docker-compose services by role (PHP/DB/cache/broker), ports, healthcheck presence, volume issues

Analyse Docker security: Dockerfile root-user, ENV secrets, :latest tags, privileged containers, sensitive host mounts, missing security_opt/cap_drop, and read_only settings

Scan docker-compose.yml/prod/swarm files for Swarm deploy sections; detects missing resource limits (OOM kill risk), missing healthcheck with multiple replicas, missing update_config.failure_action: rollback, stop-first update order (downtime), missing restart_policy, rollback_config without parallelism

Detect per-association fetch strategy (LAZY/EAGER/EXTRA_LAZY) in PHP entity attributes/annotations and XML/YAML mappings: #[OneToMany(fetch:)], #[ManyToMany(fetch:)], #[OneToOne(fetch:)], #[ManyToOne(fetch:)]; warns on EAGER on large collections, EXTRA_LAZY on XToOne, EAGER on ManyToMany (Cartesian product)

Show Doctrine bulk operation patterns: flush-in-loop, batch flush (% BATCH_SIZE), DQL UPDATE/DELETE, DBAL bulk INSERT; warns on flush in loop (use batching), DQL UPDATE/DELETE without WHERE (mass update risk), DQL bypasses lifecycle events, DBAL INSERT without transaction, batch without clear() (memory leak), batch without transaction (partial failure risk)

Show Doctrine cache configuration: second_level_cache (enabled, driver, regions), query/result/metadata cache drivers, entities with #[Cache] (region, usage mode), orphan region detection, READ_WRITE concurrency warnings

Show Doctrine cascade configuration: cascade=ALL/PERSIST/REMOVE per association, orphanRemoval, cascade=ALL with REMOVE warning, REMOVE without orphanRemoval warning, redundant types warning

Show Doctrine change tracking policies: DEFERRED_IMPLICIT/DEFERRED_EXPLICIT/NOTIFY per entity; warns on DEFERRED_IMPLICIT with >20 fields (slow flush), NOTIFY without NotifyPropertyChanged interface, DEFERRED_EXPLICIT without scheduleForDirtyCheck(), mixed policies in related entities

List Doctrine entity columns with explicit charset/collation options and warn about utf8 truncation risk, latin1, and mixed charsets in the same entity.

Analyze Doctrine entity columns for missing defaults; warns on boolean/datetime/string NOT NULL columns without defaults, enum columns without defaults

Audit Doctrine composite primary key entities: GeneratedValue strategy must be NONE, ManyToOne as Id without JoinColumn, JOINED inheritance incompatibility, EntityManager::find() and getReference() called with scalar instead of array for composite PK

Detect DB connection retry/reconnect patterns; warns on persistent connections in FPM, no EM reset in worker, reconnect middleware catching too few exceptions, ping outside exception handler

Show Doctrine Criteria API usage: Criteria::create/where/orderBy, ArrayCollection::matching vs Repository::matching; warns on in-memory filtering of large collections, setMaxResults on ArrayCollection, Expr::in() with large arrays, LIKE on non-indexed fields

Detect AbstractHydrator subclasses: hydrateAll/hydrateRow presence, registration in doctrine.yaml orm.hydrators, unregistered hydrator warning

Detect custom Doctrine DBAL platform classes (AbstractPlatform subclasses), overridden methods (getColumnDeclarationSQL, getDateTimeFormatString, getName, initializeDoctrineTypeMappings, etc.), custom Type classes, Type::addType() and Type::overrideType() calls with risk warnings

Detect DBAL-level bulk insert patterns: $connection->executeStatement() in loops, $connection->insert() in loops, QueryBuilder INSERT, beginTransaction/commit wrapping inserts; warns on insert loop without transaction (auto-commit overhead), executeStatement without parameterization (injection risk), missing batch size limit, QueryBuilder string concatenation

Audit Doctrine DBAL driverOptions: ATTR_EMULATE_PREPARES=true (SQL injection risk), ATTR_STRINGIFY_FETCHES=true (type loss), charset: utf8 vs utf8mb4, missing ERRMODE_EXCEPTION, missing connectTimeout

Detect DBAL-level event listeners (distinct from ORM entity subscribers): implements EventSubscriber (DBAL), PostConnectEventArgs, SchemaColumnDefinitionEventArgs, onSchemaCreateTable/DropTable/AlterTable, addEventSubscriber; warns on postConnect schema changes, onSchemaCreateTable connection modifications, wrong method names, listener on wrong EventManager

Detect DBAL query profiling patterns; warns on EXPLAIN in production, DebugStack outside tests, setSQLLogger deprecated in DBAL 3.x, profiling middleware without sampling

Detect DBAL schema comparison patterns and migration diff analysis: SchemaDiff, SchemaComparator::compareSchemas(), Comparator::compareSchemas(), introspectSchema(), SchemaManager::createComparator(); scans migration files for DROP TABLE, RENAME COLUMN, CHANGE (destructive changes); warns on missing down(), DROP TABLE without backup, RENAME via drop+add, schema comparison in production, index-affected column changes

Show Doctrine inheritance hierarchies: InheritanceType (STI/CTI/TPC), DiscriminatorColumn, DiscriminatorMap entries, missing map warning, TABLE_PER_CLASS performance warning

Detect custom Doctrine DQL SQL walkers (TreeWalker, OutputWalker, SqlWalker): implements TreeWalkerInterface, extends SqlWalker/OutputWalker, addCustomTreeWalker(), HINT_CUSTOM_TREE_WALKERS/HINT_CUSTOM_OUTPUT_WALKER; warns on missing walkSelectStatement, unbounded accumulation, both walker hints set, AST mutation without cloning

Detect Doctrine encrypted column patterns; warns on encryption key in .env, encrypted column with index (useless), no encryption bundle found

Show zenstruck/foundry entity factory analysis: ModelFactory/ObjectFactory/PersistentProxyObjectFactory subclasses with getDefaults/states/initialize/faker detection; warns on missing getDefaults, all-null defaults, seeded Faker (parallel test race), large createMany() counts

Show Doctrine entity relationship graph: ORM associations (OneToMany/ManyToOne/ManyToMany/OneToOne), detects cycles, deep chains (depth > 5), fat entities (>10 associations), self-referential entities without depth limit; warns on circular references (serialization risk), deep inheritance chains

List Doctrine entity listeners, their lifecycle methods, registration status, and issues like unregistered listeners or missing lifecycle methods.

Inspect Doctrine entity locking: LockMode::PESSIMISTIC_WRITE/READ/OPTIMISTIC, $em->lock(), #[Version]/@Version; warns on pessimistic locks in HTTP handlers, OPTIMISTIC without version field, missing OptimisticLockException catch, multi-entity deadlock risk, wrong @Version type

Analyze Doctrine EntityManager lifecycle issues; warns on closed EM in long-running processes without resetManager, static EM references, flush() in loop, large result iteration without clear()/detach()

Detect Doctrine proxy class configuration and issues: reads doctrine.yaml for proxy_dir/proxy_namespace/auto_generate_proxy_classes, scans var/cache for existing proxies, scans src/ for final entities and private constructors; warns on auto_generate in production, proxy_dir outside var/, namespace collision, final classes, private constructors

Show Doctrine entity state management: detach/merge/refresh/contains/UnitOfWork usage; warns on merge() removed in Doctrine ORM 3, detach without re-attach (lost changes), refresh on new entity (exception), getEntityState without contains(), UnitOfWork internals in business code, merge in event listener (recursive flush risk)

Show old-style Doctrine EventManager::addEventListener() usage: call count, migration to #[AsDoctrineListener] recommended

Show Doctrine-native event subscribers (EventSubscriber interface and #[AsDoctrineListener]): subscribed events, flush-in-onFlush infinite loop warning, empty getSubscribedEvents() warning, UnitOfWork access, loadClassMetadata platform check

List Gedmo Doctrine Extensions used in entities: Timestampable, Sluggable, SoftDeleteable, Blameable, Tree, Sortable, Translatable, Loggable, IpTraceable

Show Doctrine SQL filters: registered filters from doctrine.yaml (enabled flag, parameters), SQLFilter subclasses (target entities, parameters read), enable()/disable() call sites, orphan filter detection, always-active filter warning

Analyze Doctrine full-text search usage; warns on LIKE queries that should use FULLTEXT indexes, detects MATCH AGAINST patterns, GIN/GiST indexes, and Doctrine extension packages

Scan PHP entities for Gedmo Blameable (on: change missing field, non-string field type), Loggable (too many Versioned fields, missing custom log entry class), and Timestampable (on: change missing field) extensions

Scan PHP entities for Gedmo Sluggable extension; detects #[Gedmo\Slug] fields with source fields, unique/updatable flags; warns on unique: false (duplicate slugs), updatable: true (URL breakage), missing database index, SlugHandler usage

Scan PHP entities for Gedmo Translatable extension; detects #[Gedmo\Translatable] fields, missing #[Gedmo\Locale] property, missing TranslatableListener config, setTranslatableLocale without fallback locale, missing custom translation entity

Scan PHP entities for Gedmo Tree extension (nested set, closure table, materializedPath); detects #[Gedmo\Tree] type, required fields for each strategy, missing closure entity mapping, non-nullable root field, missing materializedPath fields

Analyze Doctrine hydration mode choices; warns on HYDRATE_OBJECT in read-only contexts, getResult() without LIMIT, custom hydrator without hydrateResultSet, HINT_FORCE_PARTIAL_LOAD with associations

Show Doctrine entity index analysis: #[ORM\Index]/#[ORM\UniqueConstraint] definitions, composite indexes, ManyToOne FK column index coverage, redundant single-column index detection, index name > 64 chars warning

Show Doctrine inheritance: #[InheritanceType] (SINGLE_TABLE/JOINED/TABLE_PER_CLASS), #[DiscriminatorColumn], #[DiscriminatorMap], MappedSuperclass classes, nullable column count per SINGLE_TABLE, deep hierarchy detection (JOINED > 3 levels), incomplete discriminator map warning

Check Doctrine entity mapping format consistency: XML vs PHP attributes vs YAML, mixed-format warning per mapping set, deprecated annotation type warning

Show Doctrine migration ordering: version sequence, large time gaps (>1 year), non-transactional migrations, explicit DependencyVersion declarations

Inspect doctrine_migrations.yaml configuration and warn about transactional:false, missing schema_filter, organize_migrations gotchas, and table_name collisions.

List all Doctrine DBAL connections and ORM entity managers, their bindings, and configuration issues like missing charset or unbound entity managers.

Detect MySQL/MariaDB-specific Doctrine features; warns on FULLTEXT with MyISAM, JSON as VARCHAR, utf8 charset (use utf8mb4 for emoji)

Show Doctrine #[ORM\NamedNativeQuery] and #[ORM\SqlResultSetMapping]: query names, SELECT * warning, missing SqlResultSetMapping warning

Show Doctrine MongoDB ODM configuration: composer.json bundle check, doctrine_mongodb.yaml connections/document_managers, Document/EmbeddedDocument/GridFS classes, ReferenceMany/ReferenceOne usage; warns on credentials in connection string, eager ReferenceMany, missing indexes on embedded fields, mixed ORM+ODM usage

Show Doctrine ORM configuration: mapping driver, entity managers, naming strategy, Doctrine Filters (SQL-level), custom DQL functions, proxy generation

Inspect Doctrine ORM profiling configuration across environments; warns on profiling_collect_backtrace in non-dev, SQLLogger in production, DebugStack memory leak, profiling overhead without Symfony profiler

Show Doctrine orphanRemoval associations: OneToMany/OneToOne with orphanRemoval:true, cascade persist/remove presence, missing cascade persist warning, redundant cascade remove warning

Show Doctrine Paginator usage: fetchJoinCollection flag, setMaxResults/setFirstResult presence, unbounded query warning, missing offset warning

Detect PostgreSQL-specific Doctrine features; warns on JSON vs JSONB for filtering, SimpleArrayType with commas, LIKE on tsvector, allocationSize=1 in sequences

Show Doctrine ORM cache driver configuration from doctrine.yaml: query_cache_driver, metadata_cache_driver, result_cache_driver types (array/apcu/redis/pool); warns on array drivers (per-request only), inconsistent drivers, missing result cache, same Redis DSN without key prefix

Analyze raw SQL and DQL queries for injection risks; warns on SQL/DQL string concatenation with variables, LIKE with concatenation, user-controlled ORDER BY without allowlist validation

Analyze Doctrine DBAL read replica configuration; warns on empty replica config, missing keep_slave/keep_replica, single connection without replicas for high-read workloads, forced master connections for reads

Show Doctrine repository DQL/SQL/QueryBuilder queries: setMaxResults/setFirstResult presence, native SQL string concatenation (SQL injection risk), unbounded query warning

Detect query-level result caching: enableResultCache(), setCacheMode(), setResultCacheId(), missing lifetime warning, missing cache invalidation warning

Show Doctrine ResultSetMapping and native query usage: RSM/RSMBuilder/createNativeQuery patterns; warns on native queries without RSM (raw array, no type safety), addJoinedEntityResult without discriminator, generateSelectClause with excluded columns, SQL injection via user input concatenation

Show Doctrine Second Level Cache (#[ORM\Cache]): usage mode (READ_WRITE/NONSTRICT_READ_WRITE), cache region, association cache, 2LC enabled check, missing region warning

List all Doctrine SequenceGenerator usages and warn about small allocationSize, wrong platform (MySQL/SQLite), or missing initialValue.

Detect Doctrine DBAL sharding: reads doctrine.yaml for shards/shard_choser/PoolingShardConnectionWrapper, scans src/ for ShardManager/getActiveShards()/selectShard(); warns on missing ShardChoser, selectShard() without beginTransaction, overlapping shard ranges, ShardManager used with ORM EntityManager

Show Doctrine Second Level Cache config: enabled status, cache regions, entities with #[ORM\Cache], query-level result caching

Detect soft-delete patterns: Gedmo\SoftDeleteable annotation, deletedAt field, custom soft-delete filters, missing filter enablement warning

Detect temporal/bitemporal table patterns; warns on valid_from/valid_to without CHECK constraint or index, missing transaction_time in bitemporal, @Loggable without @Versioned fields

List custom Doctrine DBAL types registered in doctrine.yaml with their class, category, and which entity columns use them

Detect dangerous Doctrine UoW flush patterns: flush() inside postFlush (infinite loop), persist() inside onClear, preUpdate side effects.

Detect DBAL/ORM/native upsert patterns; warns on ON DUPLICATE KEY without column list, REPLACE INTO (delete+insert), upsert without transaction, fetch-persist loop (N+1 + race condition)

Analyze Doctrine entity versioning; warns on @ORM\Version without optimistic locking, mutable entities without audit trail, SoftDeleteable without deletedAt field, missing Gedmo Loggable config

Show custom Doctrine DQL functions from doctrine.yaml: string/numeric/datetime categories, class resolution check, DQL usage scan in repositories, duplicate name detection

Show Doctrine DQL projection analysis: SELECT NEW DTO patterns, DTO class existence check, constructor argument count, partial object loading, missing DTO class warning, wide projection warning

Analyze Easy Coding Standard (ECS) configuration and detect issues

List EasyAdmin/SonataAdmin configuration: dashboard controllers, CRUD controllers per entity, custom fields/actions/filters, security (#[IsGranted]) audit

Scan for Elastic APM PHP agent configuration: php.ini/conf.d/*.ini/docker/php/*.ini elastic_apm.* settings, .env* ELASTIC_APM_* vars (masked secret_token/api_key), PHP ElasticApm::getCurrentTransaction/beginCurrentSpan/createSpan. Flags both secret_token+api_key set, HTTP server_url, transaction_sample_rate=1 in production, log_level=debug, service_name with spaces.

Analyze Elasticsearch index mapping configuration; warns on dynamic: true mapping explosion, text without keyword sub-field, _source disabled, HTTP for remote cluster, no auth credentials, query_string with user input injection risk, size > 10000

Analyze Elasticsearch advanced usage: _update_by_query/_delete_by_query without conflicts:proceed, unbounded scroll without size limit, percolate queries with unvalidated user input, match_all without size limit, bulk() in tests without refresh:true, direct environment-prefixed index names instead of aliases

List custom Email/TemplatedEmail subclasses in src/ with their template paths and parent class

List Twig email templates in templates/emails/ and templates/mail/, showing HTML vs text variants and which Email class uses each

List Doctrine #[Embeddable] value objects and which entities embed them via #[Embedded], showing properties and column prefixes

List all Doctrine entities in the application with property and relationship counts

List all Doctrine entities with lifecycle callbacks (#[PrePersist], #[PostLoad], etc.) and entity listeners, with event timing descriptions

Show which config packages have dev/prod/test overrides, what top-level keys differ, and which bundles are env-restricted

List all .env* files (.env, .env.local, .env.test, .env.prod, etc.) with key counts and warn about .env.local.php optimizer

List all environment variables from .env and .env.local files (sensitive values redacted)

List custom Twig error templates (error404.html.twig etc.), missing critical codes, kernel.exception listeners, error_controller override

List all Symfony event listeners and subscribers from src/EventListener/, src/EventSubscriber/, and services.yaml tags

Detect event listeners with same event and same priority: non-deterministic execution order warning, getSubscribedEvents() priority analysis, #[AsEventListener] priority

Analyze Excel/CSV generation (phpspreadsheet/phpexcel/fast-excel); warns on deprecated phpexcel, CSV injection via formula prefix, loading all rows into memory, user-controlled filename in headers, large synchronous export blocking requests

Detect KernelEvents::EXCEPTION subscribers: HTTP status setting, JSON response, specific exception type mapping, catch-all Throwable warning, missing response warning

List feature flags: Flagception YAML flags, FEATURE_*/ENABLE_* env vars, parameter-based flags, Unleash/OpenFeature detection, flag check sites in source code

Show Doctrine association non-default fetch modes: EXTRA_LAZY/EAGER on OneToMany/ManyToMany/ManyToOne/OneToOne, #[OrderBy] on collections, EAGER-on-collection performance warning, EXTRA_LAZY-on-to-one no-benefit warning, ManyToMany EAGER cartesian product warning

Analyze file archive operations (ZipArchive/PharData) for security issues; warns on Zip Slip path traversal in extractTo(), ZIP entry names without sanitization, extracted content without MIME check, Phar deserialization via phar://, synchronous extraction in controllers

Show file storage configuration: VichUploaderBundle mappings (URI prefix, destination, delete flags), Flysystem storages (local/S3/GCS/Azure adapter), uploadable entities with #[Vich\UploadableField], orphan mapping detection

Analyze Firebase integration: detect kreait/firebase-bundle, kreait/laravel-firebase, google/apiclient in composer.json; scan .env* for FIREBASE_PROJECT_ID/CREDENTIALS/GOOGLE_APPLICATION_CREDENTIALS; scan src/**/*.php for FirebaseFactory/getMessaging/getAuth/getDatabase; check kreait_firebase.yaml; flag credential path in .env, inline service account JSON, FCM without TTL, missing credential file; masks credential values

Show DataFixtures groups and dependencies: getGroups() declarations, getDependencies() chains, dependency tree, circular dependency detection, addReference/getReference cross-check (missing reference warning), orphan fixture detection

List Doctrine fixture classes with their groups, load order (dependency-sorted), and reference keys shared between fixtures

List Symfony Flex recipes from symfony.lock: official vs contrib vs custom origin, recipe versions, packages that injected env vars (12-factor audit)

Analyse fly.toml for app name, primary_region, build, http_service/services health checks, hardcoded secrets in [env] (values masked), and [[vm]] configuration

List all Symfony Form types in src/Form/ with their data class, field count, and file location

Scan FOSRestBundle config (view.formats, body_listener, param_fetcher_listener, exception, include_format) and PHP usage (#[Rest\Get/Post/View/RequestParam/QueryParam] attributes, View::create); warns on missing json format, body_listener disabled, deprecated include_format, ReDoS in QueryParam requirements

Analyse FrankenPHP Caddyfile, docker-compose, and Dockerfile for worker mode, TLS, compression, HTTP/3, Mercure, and environment configuration issues

Analyze GDPR compliance patterns; warns on PII entities without encryption/anonymization/retention, right-to-erasure not implemented, consent without timestamp (Art. 7), log files without PII scrubbing or rotation

Analyse GitHub Actions workflows for mutable action refs, broad write permissions, pull_request_target risks, self-hosted runner isolation, cache secrets, and hardcoded env values

Analyze GitHub API integration: detect knplabs/github-api, github/github-api, symfony/github-bundle, lcobusc/github in composer.json; scan .env* for GITHUB_TOKEN/APP_ID/APP_PRIVATE_KEY/WEBHOOK_SECRET; scan src/**/*.php for GithubClient/api(repos)/graphql()->execute/WebhookEvent; flag hardcoded GITHUB_TOKEN, missing X-Hub-Signature-256 webhook validation, PAT vs GitHub App, no rate limit handling; masks token/key values

Scan .github/dependabot.yml for Dependabot configuration issues: missing composer/npm/docker/github-actions ecosystem entries, no open-pull-requests-limit, missing reviewers/assignees, schedule interval: daily for all ecosystems (suggest weekly), missing groups: for bundling minor/patch updates.

Analyse .gitlab-ci.yml for hardcoded secrets in variables, sensitive artifact paths, missing security scanning, :latest image tags, unprotected deploy environments, and trigger configuration

Analyze Google Cloud Run config (service.yaml, cloudrun.yaml, .cloudbuild/, deploy/cloudrun/): parse Knative service spec, env vars, resource limits, containerConcurrency; flag plain-text secrets (vs secretKeyRef), memory <512Mi, containerConcurrency:1, missing timeoutSeconds

Scan src/**/*.php, composer.json, config/**/*.yaml for Google Cloud Storage patterns: google/cloud-storage in composer.json, bucket allUsers/allAuthenticatedUsers ACL (public access), signed URL TTL > 7 days (GCS v4 max), HMAC key without rotation policy, StorageClient with hardcoded keyFilePath instead of env var, credentials JSON path (masked).

Scan for Google OAuth2 / Google APIs Client Library: composer packages (google/apiclient, league/oauth2-google), env vars (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI), PHP usage (new Google\Client, setClientSecret, setAccessType, createAuthUrl, fetchAccessTokenWithAuthCode). Flags hardcoded secrets, broad OAuth scopes (drive, gmail, cloud-platform), offline access without refresh token handling, and service account JSON key files in the project tree.

Analyse Grafana provisioning: dashboard JSON files, datasource secrets, hardcoded admin passwords, missing Prometheus datasources, and alert rule configuration

Show GraphQL configuration: OverblogGraphQLBundle type definitions (Query/Mutation/Object/Input/Enum) with field counts and deprecated fields, API Platform GraphQL flag, resolver classes by kind

Analyze gRPC integration in Symfony; warns on proto2 syntax, deprecated fields not reserved, camelCase field names, insecure gRPC channel, missing call deadline, no authentication metadata

Analyze GrumpPHP pre-commit hook configuration; warns on missing phpstan/phpunit tasks, no commit message validation, no pre-push hook

List health check and readiness probe endpoints (/health, /readyz, /livez), check implementations, health bundles, Kubernetes probe coverage

Analyse Helm Chart.yaml and values.yaml under helm/, charts/, k8s/ for image.tag:latest, missing resource limits, missing liveness/readiness probes, replicaCount, and chart dependencies

Analyse Heroku Procfile and app.json for web/worker/release dyno types, buildpacks, required env vars without values, formation, and addons without plan

Analyze HTMX integration in Symfony templates; warns on hx-post/put/delete without CSRF token, sensitive data in hx-get URL, innerHTML swap with raw filter (XSS risk), full-page response instead of fragment, hx-boost without URL strategy

Show HTTP caching: #[Cache] attributes on controllers (maxAge, sharedMaxAge, public, Vary), Symfony HTTP Cache proxy config, trusted proxies

Find services that inject HttpClientInterface or named scoped clients, and which ones make HTTP requests

List configured Symfony HTTP clients: default options and all scoped clients with base URIs, headers, auth, and timeout (credentials masked)

Detect app-level HTTP security headers set via KernelEvents::RESPONSE subscribers: X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, COOP, CORP — distinct from webserver-level headers

Analyze HubSpot CRM integration: detect composer.json hubspot/hubspot-php, scan .env* for HUBSPOT_API_KEY/ACCESS_TOKEN/CLIENT_SECRET (masked), PHP Factory::createWithApiKey/createWithAccessToken/contacts/deals/forms usage. Flags: deprecated API key auth (Nov 2022), hardcoded client secret, missing webhook HMAC validation, v1/v2 legacy API endpoints

Analyze image upload and processing security; warns on missing MIME type validation, no extension allowlist, no size limit, non-random filenames (path traversal), missing EXIF metadata stripping, serving original uploads without re-encoding

Analyze importmap.php packages: pinned versions, external URLs, polyfills, local packages, unpinned package warning

Detect Infection PHP mutation testing configuration: reads infection.json5/json/yaml, checks composer.json for infection/infection in require-dev, checks var/build for infection log files; warns on missing config when package installed, missing MSI threshold, unconfigured mutators, source dirs not limited, no log output, infection absent from CI pipeline

List controller actions using #[MapRequestPayload], #[MapQueryString], #[MapQueryParameter] (Symfony 6.2+) with DTO types and validation groups

Scan the Symfony application for Intercom PHP integration patterns: missing Messenger identity verification, PII in custom attributes, hardcoded access tokens, createOrUpdate without external_id, and absent rate-limit handling.

Analyse Jenkinsfile (Jenkinsfile, Jenkinsfile.groovy, jenkins/Jenkinsfile) for plain-text credentials, missing timeout, missing post failure block, and dangerous rm -rf usage

Analyze Kafka integration in Symfony Messenger; warns on PLAINTEXT transport without TLS/SASL, missing consumer group.id, auto-commit risk, no topic configuration, producer without idempotence, manual serialization without Schema Registry

Scan for Confluent Schema Registry / Avro schema patterns: composer packages (flix-tech/avro-serde-php, etc.), env vars (SCHEMA_REGISTRY_URL), PHP usage (AvroSerializer, SchemaRegistryClient), and .avsc schema files. Flags open registry, LATEST version in production, missing compatibility mode, and Avro fields without defaults.

Show Kernel configuration: MicroKernelTrait, build() compiler passes, all registered bundles by environment, dev-only bundles loaded in prod warning

Scan k8s/, kubernetes/, deploy/, .k8s/, infra/ for Kubernetes YAML manifests; analyzes Deployment (resource limits, liveness/readinessProbe, latest image tag, low replicas), Service (LoadBalancer in dev, NodePort risk), Ingress (missing TLS, rate limiting), Secret (hardcoded base64 data), HPA (missing CPU target), PodDisruptionBudget

Scan for League OAuth2 client provider patterns: composer.json league/oauth2-client/google/github/facebook/linkedin, thenetworg/oauth2-azure, .env* OAuth2 client secrets (masked), PHP GenericProvider/Google/Github/Facebook/LinkedIn/getAuthorizationUrl/getAccessToken/getResourceOwner. Detects PKCE S256 usage. Flags missing state validation (CSRF), client_secret in URL, token stored in session without expiry, hardcoded redirect_uri.

Show Symfony UX Live Components: #[AsLiveComponent] classes with #[LiveProp] (writable flag), #[LiveAction] methods, form trait usage, security audit (writable props without validation, actions without security check, sensitive field names)

Show Symfony Lock component config: lock stores (Redis/flock/PDO), LockFactory usages in src/ with resource names and TTL, deadlock risk warnings

List all available log files in var/log directory with file sizes and modification times

Scan for Grafana Loki / Promtail log shipping configuration including promtail.yml, loki.yaml, docker-compose services, and Monolog handlers. Flags missing retention policies, plaintext credentials in URLs, boltdb_shipper without remote storage, and unstructured log shipping.

Check mailer DKIM signing and bounce config from mailer.yaml DSN: DKIM presence, Return-Path/bounce address, envelope-sender, missing DKIM warning

Analyze Mailgun integration: detect mailgun/mailgun-php and symfony/mailgun-mailer in composer.json; scan .env* for MAILGUN_API_KEY/DOMAIN/MAILER_DSN; scan src/**/*.php for MailgunClient/messages()->send/suppressions; check mailer.yaml; flag hardcoded API key, missing EU endpoint for GDPR, no webhook signature validation, sandbox domain in prod; masks API key values

Analyze Meilisearch search engine integration configuration and detect issues

Analyze Memcached integration; warns on missing SASL auth, session handler volatility, missing namespace prefix causing key collisions

Show Mercure hub config (URL masked, JWT presence, public flag), Update() call sites in src/ with topics and private flag

Show API Platform Mercure push integration: mercure:true/#[ApiResource(mercure:...)] per resource, private topics, custom topic patterns, hub URL configuration, direct HubInterface::publish() usages, try/catch around publish, static topic warning, hub-not-configured warning

List all message classes in src/Message/ and check whether a handler class exists for each

Show complete Messenger handler map: message→handler(s), fan-out detection, bus/priority/from_transport per handler, transport retry strategies

Show Symfony Messenger bus middleware chains (built-in and custom), custom MiddlewareInterface classes, and custom StampInterface implementations

Show Symfony Messenger routing rules — which message classes are sent to which transports

Detect Messenger message serializer: config (native/symfony/custom), MessageSerializerInterface encode/decode implementation, native PHP serializer warning

List all Symfony Messenger transport configurations (AMQP, Redis, Doctrine, SQS, etc.) with DSN and options

Scan for Microsoft Graph API patterns: composer packages (microsoft/microsoft-graph, microsoft/kiota-*, thenetworg/oauth2-azure), env vars (MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_TENANT_ID, AZURE_CLIENT_SECRET), PHP usage (new Graph, setAccessToken, GraphServiceClient, users/mail API). Flags hardcoded client secrets, over-privileged permissions (Mail.ReadWrite, User.ReadWrite.All, Directory.ReadWrite.All), missing token caching, and access token logging.

Show Doctrine migration history: chronological file listing, timestamp gap detection (> 90 days), squash migration identification, missing down() method, empty down() warning, all_or_nothing configuration, recent migrations summary

Analyze MongoDB integration: detect composer packages (mongodb/mongodb, doctrine/mongodb-odm), query injection via $where, missing typeMap on find/findOne, unindexed queries without hint(), $regex ReDoS risk with user input, hardcoded connection URIs (credentials masked)

Show Monolog channel-to-handler routing: channel definitions, handler inclusions/exclusions, channels with no explicit routing, too-many-handlers warning

Show Monolog handlers (type, level, channels, path), alert handlers (Slack/email/Sentry), fingers-crossed buffers, custom channels and processors

Show multi-tenancy patterns: tenant root entities (Tenant/Organization/Company), Doctrine SQL filters for row-level isolation, tenant context listeners, multiple DBAL connections, tenant env files, isolation risk if no filter found

Detect suspected N+1 query patterns: repository/EntityManager calls inside foreach/for/while loops, missing JOIN FETCH suggestion (static analysis — verify with Symfony Profiler)

Show NelmioApiDocBundle configuration: areas with path/host patterns, cache status, OA annotated file count, OA\Info presence, security scheme definitions, missing 404 response annotation detection

Scan NelmioSecurityBundle config for security headers: content_type.nosniff, xss_protection, frame_options (DENY/SAMEORIGIN), CSP default-src, forced_ssl in prod, clickjacking paths, referrer_policy; detects missing headers and misconfiguration; also checks NelmioCorsBundle presence

Analyze netlify.toml: parse [build] command/publish, [build.environment] secrets (masked), [[redirects]] from/to/status/force (SPA fallback detection, security path force=false), [[headers]] security headers (X-Frame-Options, X-Content-Type-Options, CSP, Permissions-Policy), [functions] directory/node_bundler, [dev], [context.production/deploy-preview]. Flags: missing security headers, hardcoded secrets, no SPA fallback, esbuild without NODE_VERSION

Analyze New Relic APM integration; warns on hardcoded license key, capture_params=true sending PII, high_security mode disabled, sensitive data in custom attributes, controllers without transaction naming, caught exceptions not reported to New Relic

Scan New Relic PHP agent INI configs (php.ini, newrelic.ini, conf.d/, docker/php/) and src/ PHP files for newrelic_* calls — flags missing/empty license, record_sql=raw, PII in custom parameters, disabled monitoring

Analyze nginx.conf and php-fpm.conf; warns on large client_max_body_size, server_tokens on, missing security headers (CSP/HSTS/X-Frame-Options), bad try_files, pm=static, excessive max_children, request_terminate_timeout=0

Scan for NGINX Unit application server configuration (unit.json, nginx-unit.json). Parses listeners, routes, applications, and settings. Flags HTTP-only listeners, applications running as root, missing process limits, and PHP apps without disable_functions.

List custom Notification classes in src/ with their channels and urgency level

Show Symfony Notifier transport DSNs: SMS/chat/push/email type detection, env var vs hardcoded credentials, credential exposure warning for Slack/Telegram/Vonage/Twilio transports

List Symfony Notifier transports (Slack, SMS, email, etc.) with channel type and masked DSN, plus channel policies

Show OAuth/SSO configuration: KnpUOAuth2ClientBundle clients (provider, scopes, redirect), HWIOAuthBundle resource owners, env-detected providers (Auth0/Keycloak/Google/GitHub), OAuth authenticator classes, security issues

Scan for league/oauth2-server authorization server patterns: grant types in use (AuthCode, ClientCredentials, Implicit, Password, RefreshToken), CryptKey handling, access token TTL, and refresh token rotation. Flags deprecated grants (Implicit, Password), insecure key handling, and unsafe TTL values.

Detect OPcache and APCu configuration from .ini files in docker/: enabled status, memory_consumption, preload script, validate_timestamps, APCu shm_size, missing preload/low memory warnings

Analyze OpenAI integration: detect composer packages (openai-php/client, openai-php/symfony), env credentials (OPENAI_API_KEY/ORGANIZATION), PHP OpenAI::client/chat/completions/embeddings usage, flag hardcoded API key, no timeout, prompt injection risk (user input in messages[]), no rate limiting

Show OpenAPI/Swagger documentation: NelmioApiDocBundle areas/UI path, #[OA\Get/Post/Put/…] annotated controllers, schema classes with #[OA\Property], missing response annotations

Detect OpenTelemetry configuration: bundle detection, exporters (Jaeger/Zipkin/OTLP), span processors, instrumentations, sampler, missing exporter/sampler warnings

Analyze OWASP dependency scanning: check for dependency-check.xml/.dependency-check/odc-reports, CI files (GitHub Actions/GitLab/Jenkinsfile) for dependency-check/retire.js/npm audit/composer audit, composer.json scripts, flag missing scan in CI, ignored results, outdated NVD data

Analyze Symfony Panther end-to-end testing configuration and detect issues

Audit password hashers: algorithm per entity, cost settings, security classification (critical/warning for plaintext/md5/weak bcrypt), migrate_from chains

Scan for PayPal Checkout SDK v2 (Orders API) patterns distinct from legacy PayPal integration: composer (paypal/paypal-checkout-sdk), env vars (PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_ENVIRONMENT), PHP usage (OrdersCreateRequest, OrdersCaptureRequest, SandboxEnvironment/ProductionEnvironment), and webhook validation. Flags sandbox in production, missing capture step, webhook without signature check.

Analyze Doctrine QueryBuilder usage: join count, setMaxResults/setFirstResult pagination, string concatenation in where() (injection risk), ->expr()->in() without parameter, getResult() in loops, native SQL with string interpolation

Show Doctrine repository patterns: ServiceEntityRepository vs EntityRepository detection, interface implementation (PostRepositoryInterface), entity class, direct getRepository() calls outside repositories, legacy EntityRepository warning, no-interface warning

Show HTTP response cache header usage in controllers: #[Cache] attribute, setPublic/setMaxAge/setEtag/setLastModified, Vary header values, public cache without Vary:Cookie warning, caching authenticated responses, Vary:* warning

List all Stimulus controllers: local ones in assets/controllers/ and package-provided ones from controllers.json with lazy/enabled status

List all database tables inferred from Doctrine entities (src/Entity/) or migration files

Show Doctrine timestampable entities: manual PrePersist/PreUpdate, Gedmo @Timestampable, trait-based; mixed style detection, mutable DateTime in callbacks, setCreatedAt() immutability violation, entities with timestamp fields but no automation

Search console commands by name, description, class, or alias

Search controllers by class name, namespace, method name, or route path

Search DI parameters by name or value, showing which services use each matched parameter

Search for entities by name

Search form types by name, data class, or field name/type

Search a log file for lines containing a specific term

Search for tables by name (case-insensitive substring match)

Read the last N lines from a log file

Validate Doctrine entity mappings: checks each entity for an @Id property and mapped columns