However other tools like gitlab sast, python black, and others have differential flags that only scan for changed files. Worst case on a precommit that can be wired to pass only git changed files to be reviewed.

Not for criticism, but is this targeting that “air gapped” git diff scanning area?