@4da/mcp-server 5.0.4 → 6.0.0

package/dist/tools/vulnerability-scan.d.ts

@@ -4,14 +4,20 @@
  * Scans project dependencies for known vulnerabilities using OSV.dev.
  * Zero configuration — auto-detects stack from manifest files.
  * Returns CVEs, severity, fix versions across npm, Rust, Python, Go.
+ * Output shaping lives in vulnerability-scan-format.ts.
  */
 import type { FourDADatabase } from "../db.js";
 import { LiveIntelligence } from "../live/index.js";
+import { isMaintenanceNotice } from "../live/maintenance.js";
+export { isMaintenanceNotice };
+export { collapseAliases, platformFilterNote, relativeDir } from "./vulnerability-scan-format.js";
 export interface VulnerabilityScanParams {
     project_path?: string;
     severity_filter?: "critical" | "high" | "medium" | "low";
     include_dev?: boolean;
     force_refresh?: boolean;
+    response_format?: "concise" | "detailed";
+    package?: string;
 }
 export declare const vulnerabilityScanTool: {
     name: string;
@@ -36,27 +42,34 @@ export declare const vulnerabilityScanTool: {
                 type: string;
                 description: string;
             };
+            package: {
+                type: string;
+                description: string;
+            };
+            response_format: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
         };
     };
 };
 export declare function executeVulnerabilityScan(db: FourDADatabase, params: VulnerabilityScanParams, liveIntelligence: LiveIntelligence | null): Promise<{
     scan_time: string;
     project: string;
+    project_root: string;
+    workspaces_with_findings: string[];
     host_platform: string;
     ecosystems_scanned: string[];
     total_dependencies_scanned: number;
     total_vulnerable_packages: number;
     platform_inactive_packages: number;
-    by_severity: {
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        unknown: number;
-    };
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    advisory_by_severity: import("../live/severity-scope.js").SeverityCounts;
     vulnerabilities: {
         package: string;
         current_version: string;
+        source_dirs: string[];
         ecosystem: import("../live/types.js").OsvEcosystem;
         is_dev: boolean;
         is_direct: boolean;
@@ -65,7 +78,9 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         platform_active: boolean;
         vuln_id: string;
         aliases: string[];
-        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
@@ -75,6 +90,28 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
     platform_inactive_vulnerabilities: {
         package: string;
         current_version: string;
+        source_dirs: string[];
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    maintenance_notices: {
+        package: string;
+        current_version: string;
+        source_dirs: string[];
         ecosystem: import("../live/types.js").OsvEcosystem;
         is_dev: boolean;
         is_direct: boolean;
@@ -83,22 +120,74 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         platform_active: boolean;
         vuln_id: string;
         aliases: string[];
-        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
         published: string;
         references: string[];
     }[];
+    install_drift: Record<string, unknown>[];
     recommendations: string[];
     clean_dependencies: number;
     scan_duration_ms: number;
     _meta: {
         source: string;
         cached: boolean;
+        osv_cached: boolean;
         offline: boolean;
         privacy: string;
         relevance: string;
+        severity_rule: string;
+        resolution: {
+            resolved_at: string | null;
+            lockfiles: {
+                path: string;
+                kind: "lockfile" | "manifest";
+                mtime: string | null;
+            }[];
+            re_resolved_this_call: boolean;
+            note: string;
+        };
+    };
+} | {
+    scan_time: string;
+    project_root: string;
+    host_platform: string;
+    ecosystems_scanned: string[];
+    total_dependencies_scanned: number;
+    total_vulnerable_packages: number;
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    vulnerable_packages: import("./vulnerability-scan-concise.js").PackageRow[];
+    vulnerable_packages_note?: string | undefined;
+    recommendations: string[];
+    recommendations_note?: string | undefined;
+    not_listed: {
+        platform_inactive: {
+            count: number;
+            packages: string[];
+        };
+        maintenance_notices: {
+            count: number;
+            packages: string[];
+        };
+        install_drift: {
+            count: number;
+            vulnerable_installed: Record<string, unknown>[];
+        };
+        note: string;
+    };
+    _meta: {
+        source: string;
+        osv_cached: boolean;
+        offline: boolean;
+        relevance: string;
+        severity_rule: string;
+        lockfiles_read: number;
+        resolved_at: string | null;
+        privacy: string;
     };
 } | {
     error: null;
@@ -106,29 +195,176 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
     message: string;
     hint: string;
 } | {
+    hint?: undefined;
+    error: string;
+    offline?: undefined;
+    message?: undefined;
+} | {
+    hint?: undefined;
     error: null;
     offline: boolean;
     message: string;
+} | {
+    scan_time: string;
+    project: string;
+    project_root: string;
+    workspaces_with_findings: string[];
+    host_platform: string;
+    ecosystems_scanned: string[];
+    total_dependencies_scanned: number;
+    total_vulnerable_packages: number;
+    platform_inactive_packages: number;
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    advisory_by_severity: import("../live/severity-scope.js").SeverityCounts;
+    vulnerabilities: {
+        package: string;
+        current_version: string;
+        source_dirs: string[];
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    platform_inactive_vulnerabilities: {
+        package: string;
+        current_version: string;
+        source_dirs: string[];
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    maintenance_notices: {
+        package: string;
+        current_version: string;
+        source_dirs: string[];
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    install_drift: Record<string, unknown>[];
+    recommendations: string[];
+    clean_dependencies: number;
+    scan_duration_ms: number;
+    _meta: {
+        source: string;
+        cached: boolean;
+        osv_cached: boolean;
+        offline: boolean;
+        privacy: string;
+        relevance: string;
+        severity_rule: string;
+        resolution: {
+            resolved_at: string | null;
+            lockfiles: {
+                path: string;
+                kind: "lockfile" | "manifest";
+                mtime: string | null;
+            }[];
+            re_resolved_this_call: boolean;
+            note: string;
+        };
+    };
     hint?: undefined;
+    error?: undefined;
+    offline?: undefined;
+    message?: undefined;
+    note: string;
 } | {
+    scan_time: string;
+    project_root: string;
+    host_platform: string;
+    ecosystems_scanned: string[];
+    total_dependencies_scanned: number;
+    total_vulnerable_packages: number;
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    vulnerable_packages: import("./vulnerability-scan-concise.js").PackageRow[];
+    vulnerable_packages_note?: string | undefined;
+    recommendations: string[];
+    recommendations_note?: string | undefined;
+    not_listed: {
+        platform_inactive: {
+            count: number;
+            packages: string[];
+        };
+        maintenance_notices: {
+            count: number;
+            packages: string[];
+        };
+        install_drift: {
+            count: number;
+            vulnerable_installed: Record<string, unknown>[];
+        };
+        note: string;
+    };
+    _meta: {
+        source: string;
+        osv_cached: boolean;
+        offline: boolean;
+        relevance: string;
+        severity_rule: string;
+        lockfiles_read: number;
+        resolved_at: string | null;
+        privacy: string;
+    };
+    hint?: undefined;
+    error?: undefined;
+    offline?: undefined;
+    message?: undefined;
     note: string;
+} | {
     scan_time: string;
     project: string;
+    project_root: string;
+    workspaces_with_findings: string[];
     host_platform: string;
     ecosystems_scanned: string[];
     total_dependencies_scanned: number;
     total_vulnerable_packages: number;
     platform_inactive_packages: number;
-    by_severity: {
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        unknown: number;
-    };
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    advisory_by_severity: import("../live/severity-scope.js").SeverityCounts;
     vulnerabilities: {
         package: string;
         current_version: string;
+        source_dirs: string[];
         ecosystem: import("../live/types.js").OsvEcosystem;
         is_dev: boolean;
         is_direct: boolean;
@@ -137,7 +373,9 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         platform_active: boolean;
         vuln_id: string;
         aliases: string[];
-        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
@@ -147,6 +385,7 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
     platform_inactive_vulnerabilities: {
         package: string;
         current_version: string;
+        source_dirs: string[];
         ecosystem: import("../live/types.js").OsvEcosystem;
         is_dev: boolean;
         is_direct: boolean;
@@ -155,25 +394,106 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         platform_active: boolean;
         vuln_id: string;
         aliases: string[];
-        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
         published: string;
         references: string[];
     }[];
+    maintenance_notices: {
+        package: string;
+        current_version: string;
+        source_dirs: string[];
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "low" | "medium" | "unknown";
+        advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        severity_note?: string | undefined;
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    install_drift: Record<string, unknown>[];
     recommendations: string[];
     clean_dependencies: number;
     scan_duration_ms: number;
     _meta: {
         source: string;
         cached: boolean;
+        osv_cached: boolean;
         offline: boolean;
         privacy: string;
         relevance: string;
+        severity_rule: string;
+        resolution: {
+            resolved_at: string | null;
+            lockfiles: {
+                path: string;
+                kind: "lockfile" | "manifest";
+                mtime: string | null;
+            }[];
+            re_resolved_this_call: boolean;
+            note: string;
+        };
     };
+    hint?: undefined;
     error?: undefined;
     offline?: undefined;
     message?: undefined;
+    package_note: string;
+    note: string;
+} | {
+    scan_time: string;
+    project_root: string;
+    host_platform: string;
+    ecosystems_scanned: string[];
+    total_dependencies_scanned: number;
+    total_vulnerable_packages: number;
+    by_severity: import("../live/severity-scope.js").SeverityCounts;
+    vulnerable_packages: import("./vulnerability-scan-concise.js").PackageRow[];
+    vulnerable_packages_note?: string | undefined;
+    recommendations: string[];
+    recommendations_note?: string | undefined;
+    not_listed: {
+        platform_inactive: {
+            count: number;
+            packages: string[];
+        };
+        maintenance_notices: {
+            count: number;
+            packages: string[];
+        };
+        install_drift: {
+            count: number;
+            vulnerable_installed: Record<string, unknown>[];
+        };
+        note: string;
+    };
+    _meta: {
+        source: string;
+        osv_cached: boolean;
+        offline: boolean;
+        relevance: string;
+        severity_rule: string;
+        lockfiles_read: number;
+        resolved_at: string | null;
+        privacy: string;
+    };
     hint?: undefined;
+    error?: undefined;
+    offline?: undefined;
+    message?: undefined;
+    package_note: string;
+    note: string;
 }>;