| command | Deprecated, do not use. | — | — |
| config | A file path to a .gdnconfig file. | — | — |
| policy | The name of the well known policy to use. Defaults to GitHub. | — | GitHub |
| categories | A comma separated list of analyzer categories to run. Values secrets, code, artifacts, IaC, containers. Example IaC,secrets. Defaults to all. | — | — |
| languages | A comma separated list of languages to analyze. Example javascript, typescript. Defaults to all. | — | — |
| tools | A comma separated list of analyzer to run. Example bandit, binskim, container-mapping, eslint, templateanalyzer, terrascan, trivy. | — | — |
| includeTools | Deprecated | — | — |
| break-on-detections | If true, the action will fail the build when vulnerabilities are detected at or above the configured severity. Requires toolkit support for MSDO_BREAK. | — | false |
| existingFilename | A SARIF filename that already exists. If it does, then the normal run will not take place and the file will instead be uploaded to MSDO backend. | — | — |