---
title: "Mcp List Code Scan Findings"
method: GET
path: "/v1/mcp/projects/{project_id}/code-scan/findings"
tags: ["mcp"]
---

# Mcp List Code Scan Findings

`GET /v1/mcp/projects/{project_id}/code-scan/findings`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/mcp/projects/{project_id}/code-scan/findings`
- Auth: none declared

Hardcoded, non-i18n strings found in the code (mcp:*, read-only, 0 credit).

MCP twin of `GET /v1/projects/{id}/code-scan/findings`. Filter with
`status`: **new** = still hardcoded and untouched · **treated** = already
turned into a key (if it is still listed, the raw literal is STILL in the
source — the code was never switched over) · **gone** = no longer found.

`excluded` defaults to `exclude`: strings a human put on the project's
exclusion list are hidden here too, so an agent walking `new` findings does
not re-treat something already dismissed.

A `new` count of 0 on a project that was never scanned is NOT "no hardcoded
strings" — check `code-scan/summary.measured` before reporting cleanliness.

## Path parameters

- `project_id` string, required

## Query parameters

- `status` string, nullable
- `file` string, nullable: Exact repo-relative path — process one file at a time.
- `excluded` string: Exclusion-rule filter (default `exclude`): findings the project's exclusion list masks are hidden, so you do NOT re-surface or re-treat a string a human excluded. `only` = just the masked ones · `include` = raw (ignore rules).
- `limit` integer
- `offset` integer

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)