The request asks for variant analysis, meaning hunting for other instances of one root-cause bug across a codebase. Trail of Bits offers a variant-analysis action that does exactly this 1, with a related trailmark-variant-neighborhood action that expands a known vulnerability into variant candidates 1. Other sources show general-purpose or unrelated 'variant' features, such as Cloudflare image variants 4, and GitHub's CodeQL and static analysis tooling 5 is a partial fit for finding code
- 1
- 2
GitHub OSSARgithub.comverified and signed
Runs open source security static analysis tools across a repository, which can surface code patterns similar to a known bug 5.
official:MCP server · @github/mcp-registrySDK · @github/copilot-sdklibrary · CodeQL: StubCLI · specifyrepository · copilot-engine-sdk+2,577 community tools built for it
for agents: threat-model-analyst · datanalysis-credit-risk · github/ossar-action
Sources
- 1Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
- 4Cloudflare: Build for the agent eracloudflare.com · read 2026-10-29
- 5GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
For agents: the 10 actions behind this answer
variant-analysis · variant-analysis verified and signed
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there othe
test-gap-analysis · test-gap-analysis verified and signed
Find caller-visible production changes existing tests would miss through pseudo-mutation analysis; verify candidates or close gaps only when requested. Includes read-only per-test composition for grading. Polyglot. USE FOR: would tests catch a bug, behavioral blind spots, surviving mutations. DO NOT
variance-analysis · variance-analysis verified and signed
Decompose financial variances into drivers with narrative explanations and waterfall analysis. Use when analyzing budget vs. actual, period-over-period changes, revenue or expense variances, or preparing variance commentary for leadership.
cloudflare-images-variants-variant-details · Cloudflare API verified and signed
Variant details
threat-model-analyst · threat-model-analyst verified and signed
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2)
google-deepmind/gemma-2-2b-it · google-deepmind/gemma-2-2b-it verified and signed
Gemma2 2b Instruction-tuned variant by Google
get_product_variant · Shopify (Activepieces) verified and signed
Get Product Variant — Get a product variant.
deep-agent · deepagents verified and signed
analysis · posthog-node verified and signed
get_variant_analyze · BioLink API verified and signed
Returns list of matches
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.