Skip to content

Commit ccd9f29

Browse files
author
Array Fleet
committed
feat: add repository security advisory create, update, and CVE request tools
Add MCP tools for creating and updating repository security advisories and requesting CVE assignment. Reject empty enum values on update, move shared advisory constants into the read module, and align ecosystem enums with swift.
1 parent 33849e9 commit ccd9f29

10 files changed

Lines changed: 2404 additions & 6 deletions

‎README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1357,6 +1357,21 @@ The following sets of tools are available:
13571357

13581358
<summary><picture><source media="(prefers-color-scheme: dark)" srcset="pkg/octicons/icons/shield-dark.png"><source media="(prefers-color-scheme: light)" srcset="pkg/octicons/icons/shield-light.png"><img src="pkg/octicons/icons/shield-light.png" width="20" height="20" alt="shield"></picture> Security Advisories</summary>
13591359

1360+
- **create_repository_security_advisory** - Create repository security advisory
1361+
- **Required OAuth Scopes**: `security_events`
1362+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1363+
- `credits`: Users credited for the advisory. (object[], optional)
1364+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1365+
- `cvssVectorString`: The CVSS vector string for the advisory. Exactly one of severity or cvssVectorString is required. (string, optional)
1366+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). (string[], optional)
1367+
- `description`: A detailed description of the security advisory. (string, required)
1368+
- `owner`: The owner of the repository. (string, required)
1369+
- `repo`: The name of the repository. (string, required)
1370+
- `severity`: The severity of the advisory. Exactly one of severity or cvssVectorString is required. (string, optional)
1371+
- `startPrivateFork`: Whether to create a temporary private fork for collaborating on a fix. (boolean, optional)
1372+
- `summary`: A short summary of the security advisory. (string, required)
1373+
- `vulnerabilities`: Affected products and version ranges. (object[], required)
1374+
13601375
- **get_global_security_advisory** - Get a global security advisory
13611376
- **Required OAuth Scopes**: `security_events`
13621377
- **Accepted OAuth Scopes**: `repo`, `security_events`
@@ -1394,6 +1409,29 @@ The following sets of tools are available:
13941409
- `sort`: Sort field. (string, optional)
13951410
- `state`: Filter by advisory state. (string, optional)
13961411

1412+
- **request_cve_for_repository_security_advisory** - Request CVE for repository security advisory
1413+
- **Required OAuth Scopes**: `security_events`
1414+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1415+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1416+
- `owner`: The owner of the repository. (string, required)
1417+
- `repo`: The name of the repository. (string, required)
1418+
1419+
- **update_repository_security_advisory** - Update repository security advisory
1420+
- **Required OAuth Scopes**: `security_events`
1421+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1422+
- `credits`: Users credited for the advisory. Omit to leave unchanged; empty arrays are rejected and clearing this field is not supported. (object[], optional)
1423+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1424+
- `cvssVectorString`: The CVSS vector string for the advisory. Cannot be set together with severity. (string, optional)
1425+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). Omit to leave unchanged; empty arrays are rejected and clearing this field is not supported. (string[], optional)
1426+
- `description`: A detailed description of the security advisory. (string, optional)
1427+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1428+
- `owner`: The owner of the repository. (string, required)
1429+
- `repo`: The name of the repository. (string, required)
1430+
- `severity`: The severity of the advisory. Cannot be set together with cvssVectorString. (string, optional)
1431+
- `state`: The advisory state. Set to "published" to publish the advisory. (string, optional)
1432+
- `summary`: A short summary of the security advisory. (string, optional)
1433+
- `vulnerabilities`: Affected products and version ranges. (object[], optional)
1434+
13971435
</details>
13981436

13991437
<details>

‎pkg/github/__toolsnaps__/create_repository_security_advisory.snap‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
{
2+
"annotations": {
3+
"destructiveHint": true,
4+
"openWorldHint": true,
5+
"title": "Create repository security advisory"
6+
},
7+
"description": "Create a draft repository security advisory. Exactly one of severity or cvssVectorString must be provided. When startPrivateFork is true, a temporary private fork is created for collaborating on a fix.",
8+
"inputSchema": {
9+
"properties": {
10+
"credits": {
11+
"description": "Users credited for the advisory.",
12+
"items": {
13+
"properties": {
14+
"login": {
15+
"description": "The GitHub username of the credited user.",
16+
"type": "string"
17+
},
18+
"type": {
19+
"description": "The credit type.",
20+
"enum": [
21+
"analyst",
22+
"finder",
23+
"reporter",
24+
"coordinator",
25+
"remediation_developer",
26+
"remediation_reviewer",
27+
"remediation_verifier",
28+
"tool",
29+
"sponsor",
30+
"other"
31+
],
32+
"type": "string"
33+
}
34+
},
35+
"required": [
36+
"login",
37+
"type"
38+
],
39+
"type": "object"
40+
},
41+
"type": "array"
42+
},
43+
"cveId": {
44+
"description": "The CVE ID to assign to the advisory.",
45+
"type": "string"
46+
},
47+
"cvssVectorString": {
48+
"description": "The CVSS vector string for the advisory. Exactly one of severity or cvssVectorString is required.",
49+
"type": "string"
50+
},
51+
"cweIds": {
52+
"description": "Common Weakness Enumeration IDs (for example, [\"CWE-79\"]).",
53+
"items": {
54+
"type": "string"
55+
},
56+
"type": "array"
57+
},
58+
"description": {
59+
"description": "A detailed description of the security advisory.",
60+
"type": "string"
61+
},
62+
"owner": {
63+
"description": "The owner of the repository.",
64+
"type": "string"
65+
},
66+
"repo": {
67+
"description": "The name of the repository.",
68+
"type": "string"
69+
},
70+
"severity": {
71+
"description": "The severity of the advisory. Exactly one of severity or cvssVectorString is required.",
72+
"enum": [
73+
"low",
74+
"medium",
75+
"high",
76+
"critical"
77+
],
78+
"type": "string"
79+
},
80+
"startPrivateFork": {
81+
"description": "Whether to create a temporary private fork for collaborating on a fix.",
82+
"type": "boolean"
83+
},
84+
"summary": {
85+
"description": "A short summary of the security advisory.",
86+
"type": "string"
87+
},
88+
"vulnerabilities": {
89+
"description": "Affected products and version ranges.",
90+
"items": {
91+
"properties": {
92+
"package": {
93+
"properties": {
94+
"ecosystem": {
95+
"description": "The package ecosystem.",
96+
"enum": [
97+
"actions",
98+
"composer",
99+
"erlang",
100+
"go",
101+
"maven",
102+
"npm",
103+
"nuget",
104+
"other",
105+
"pip",
106+
"pub",
107+
"rubygems",
108+
"rust",
109+
"swift"
110+
],
111+
"type": "string"
112+
},
113+
"name": {
114+
"description": "The package name.",
115+
"type": "string"
116+
}
117+
},
118+
"required": [
119+
"ecosystem",
120+
"name"
121+
],
122+
"type": "object"
123+
},
124+
"patched_versions": {
125+
"description": "The version that patches the vulnerability.",
126+
"type": "string"
127+
},
128+
"vulnerable_functions": {
129+
"description": "Functions in the package that are affected.",
130+
"items": {
131+
"type": "string"
132+
},
133+
"type": "array"
134+
},
135+
"vulnerable_version_range": {
136+
"description": "The range of affected versions (for example, \"\u003c 2.0.0\").",
137+
"type": "string"
138+
}
139+
},
140+
"required": [
141+
"package"
142+
],
143+
"type": "object"
144+
},
145+
"type": "array"
146+
}
147+
},
148+
"required": [
149+
"owner",
150+
"repo",
151+
"summary",
152+
"description",
153+
"vulnerabilities"
154+
],
155+
"type": "object"
156+
},
157+
"name": "create_repository_security_advisory"
158+
}

‎pkg/github/__toolsnaps__/list_global_security_advisories.snap‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@
3535
"pip",
3636
"pub",
3737
"rubygems",
38-
"rust"
38+
"rust",
39+
"swift"
3940
],
4041
"type": "string"
4142
},

‎pkg/github/__toolsnaps__/request_cve_for_repository_security_advisory.snap‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"annotations": {
3+
"destructiveHint": true,
4+
"openWorldHint": true,
5+
"title": "Request CVE for repository security advisory"
6+
},
7+
"description": "Request a CVE ID from GitHub for a draft repository security advisory.",
8+
"inputSchema": {
9+
"properties": {
10+
"ghsaId": {
11+
"description": "GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx).",
12+
"type": "string"
13+
},
14+
"owner": {
15+
"description": "The owner of the repository.",
16+
"type": "string"
17+
},
18+
"repo": {
19+
"description": "The name of the repository.",
20+
"type": "string"
21+
}
22+
},
23+
"required": [
24+
"owner",
25+
"repo",
26+
"ghsaId"
27+
],
28+
"type": "object"
29+
},
30+
"name": "request_cve_for_repository_security_advisory"
31+
}

0 commit comments

Comments
 (0)