Narrows a cargo-audit/RustSec finding from 'this crate is somewhere in the dependency tree' to 'these are the exact call sites in OUR source that reference it' -- cargo audit only version-matches Cargo.lock and cannot tell you whether the vulnerable API is ever actually invoked (this repo's own deny.toml ignore-list comments document that gap being closed by hand via `cargo tree` for 9 advisories already). Caches findings locally (.advisory-reach-cache/) and hands them to a fix pass one pseudonymized call site at a time, same small-pieces discipline as boundary-scan (whose classify/find_functions/pseudonym machinery this reuses rather than duplicating).
| Tier | tools |
| Role | unclassified (baselined) |
| Path | crates/tools/advisory-reach |
| Edition | 2021 |
| Targets | tools-advisory-reach, tools_advisory_reach |
| Public items | 9 across 0 modules |
| Tests | 3 |
What it is for
Narrows a cargo audit finding to real call sites.
cargo audit only version-matches Cargo.lock against the RustSec advisory database, then prints the dependency graph back to workspace members — it never checks whether the vulnerable API is actually called. This repo's own deny.toml/audit.toml ignore-list comments document that gap being closed by hand, per-advisory, via cargo tree (9 entries, each with a written "verified unreachable because ..." rationale). This tool makes that step repeatable instead of ad-hoc.
Note the identifier you search for is usually NOT the advisory's own crate (which may be several hops down and never imported directly) but the crate your code actually depends on and calls — e.g. RUSTSEC-2026-0119 is in hickory-proto, but nothing in this workspace imports hickory_proto directly; what's actually called is hickory_resolver, which internally exercises the vulnerable encoding path on every resolution. Pass --crate as whatever your code really imports.
Two-step, same shape as tools-boundary-scan: 1. scan: find every workspace crate that directly depends on --crate (via cargo metadata, not a lockfile graph walk — direct edges only, a transitive dependent's own source won't mention the identifier), then find every real (non-comment, non-string) reference to that crate's Rust identifier in their src/. Cached to .advisory-reach-cache/<crate>.json — "keeps those pieces for after" rather than dumping everything to stdout immediately. 2. shard: pull ONE cached site, pseudonymize its enclosing function via tools_boundary_scan::pseudonym (the same engine, same per-finding local map), and return a small packet sized to hand to a fix pass.
Capabilities
crate root
Narrows a cargo audit finding to real call sites.
| Item |
|---|
fn cache_path(workspace_root : & Path, crate_name : & str) -> PathBuf |
ReachSite
Narrows a cargo audit finding to real call sites.
| Item |
|---|
pub struct ReachSite |
ReachSite :: fn to_envelope(& self, tool : & str) -> tools_boundary_scan::report::Envelope |
ScanResult
Narrows a cargo audit finding to real call sites.
| Item |
|---|
pub struct ScanResult |
fn scan(workspace_root : & Path, crate_name : & str, advisory : Option <& str>) -> Result <ScanResult> |
fn save_scan(workspace_root : & Path, crate_name : & str, result : & ScanResult) -> Result <()> |
fn load_scan(workspace_root : & Path, crate_name : & str) -> Result <ScanResult> |
Shard
Narrows a cargo audit finding to real call sites.
| Item |
|---|
pub struct Shard |
fn shard(workspace_root : & Path, crate_name : & str, index : usize) -> Result <Shard> |
How to use it
No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.
Module structure
No public modules: the crate root is its whole surface.
Public surface
`crate root`
| Item | What it is |
|---|---|
pub struct ReachSite | — |
ReachSite :: fn to_envelope(& self, tool : & str) -> tools_boundary_scan::report::Envelope | The standardized cross-tool reporting shape — see tools_boundary_scan::report |
pub struct ScanResult | — |
fn scan(workspace_root : & Path, crate_name : & str, advisory : Option <& str>) -> Result <ScanResult> | — |
fn cache_path(workspace_root : & Path, crate_name : & str) -> PathBuf | — |
fn save_scan(workspace_root : & Path, crate_name : & str, result : & ScanResult) -> Result <()> | — |
fn load_scan(workspace_root : & Path, crate_name : & str) -> Result <ScanResult> | — |
pub struct Shard | One pseudonymized shard for a single cached site — small enough to hand to a fix pass without the rest of the file. |
fn shard(workspace_root : & Path, crate_name : & str, index : usize) -> Result <Shard> | — |
No pub use re-exports: every item above is declared in this crate.
Boundary
Depends on no other workspace tier.
Shares tier tools with 84 other crates: tools-archive-guard, tools-artifact-scaffold, tools-ask-ai-core, tools-ask-ais, tools-ask-gemini, tools-book, tools-book-report, tools-boundary-scan, … (84 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | tools |
| Architectural role (taxonomy) | unclassified (baselined) |
| Location | crates/tools/advisory-reach |
| Vocabulary in force (lexicon) | current |
Dependencies
Runtime, in this workspace.
| Crate | Tier | Optional | Only on |
|---|---|---|---|
| `tools-boundary-scan` | tools | no | always |
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
anyhow | ^1 | — | no | always |
serde | ^1 | derive | no | always |
serde_json | ^1 | — | no | always |
Development. None.
Build. None.
Depended on by. Nothing in this workspace.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR SELF["tools-advisory-reach"] SELF -->|runtime| n_tools_boundary_scan["tools-boundary-scan"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| bin | tools-advisory-reach | `src/main.rs` |
| lib | tools_advisory_reach | `src/lib.rs` |
Error model
No public error type was detected: no public item declares a type named *Error, and no public signature returns one.
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | none detected |
| database access | none detected |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | yes |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
| Variable | Read in |
|---|---|
CARGO_MANIFEST_DIR | src/main.rs |
Related capabilities
No workspace crate depends on this one.
Verification
| Kind | Count |
|---|---|
| Unit tests | 3 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 0 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
crate root | 8 | 0 | 0 |
What the tests establish, by name:
char_offset_relocates_the_correct_span_even_with_multiple_preceding_functions—src/lib.rsimported_local_names_covers_braced_aliased_and_glob—src/lib.rsunqualified_import_usage_is_attributed_to_the_correct_function—src/lib.rs
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 2 | 9 |
Public modules with a //! block | 0 | 0 |
pie showData
title Public items with rustdoc
"Documented" : 2
"No rustdoc detected" : 7
Metrics
| Metric | Value |
|---|---|
| Rust source files | 2 |
| Source lines | 626 |
| Code lines | 506 |
| Public API items | 9 |
| Public modules | 0 |
| Tests | 3 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 4 |
| Workspace reverse dependencies | 0 |
pie showData
title Public API by kind
"function" : 5
"method" : 1
"struct" : 3
pie showData
title Rust source composition
"Code" : 506
"Blank or comment" : 120
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.