@convisoappsec/mcp 0.3.0 → 0.5.0

package/README.md

@@ -15,6 +15,8 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Vulnerabilities** | `get_issues` | List vulnerabilities by company or project. |
 | **Vulnerabilities** | `get_issue` | Technical details, including **code snippets** and raw requests/responses. |
 | **Vulnerabilities** | `get_top_vulnerabilities` | Risk overview (vulnerability count by severity). |
+| **Vulnerabilities** | `get_issues_by_asset_id` | List vulnerabilities for a company filtered by a single asset ID. |
+| **Vulnerabilities** | `get_issues_by_project_id` | List vulnerabilities for a company filtered by a project ID. |
 | **Management** | `get_projects` | List active security projects. |
 | **Management** | `get_project` | Get specific project in Conviso Platform by project ID. |
 | **Assets** | `get_assets` | List assets mapped within the platform. |
@@ -24,12 +26,28 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Utilities** | `get_today_date` | Return current day/month/year (utility). |
 | **Metrics** | `get_mttr_over_time` | Get Mean Time To Resolution (MTTR) metrics over time for a company. Returns resolution times by severity level. |
 | **Metrics** | `get_overall_risk_score_history` | Get overall risk score history for a company, including current score and difference from last period. |
+| **Tickets** | `get_tickets` / `get_ticket` | List or fetch support/bug tickets. |
+| **Requirements** | `get_requirements` / `get_requirement` / `get_project_requirements` | Browse security requirements/checklists. |
+| **Applications** | `get_applications` / `get_application` | List or fetch applications and their assets. |
+| **Scans** | `get_scan_histories` / `get_asset_scans_count` | Scan execution history and coverage counts. |
+| **Supply chain** | `get_sbom_components` | SBOM / dependency components per company. |
+| **AI-Pentest** | `get_pentest_artifacts` / `get_pentest_artifact` / `get_pentest_execution` | Pentest artifacts, scope and execution results. |
+| **Threat Modeling** | `get_threat_model_artifacts` / `get_threat_model_artifact` | Threat model artifacts and versions. |
+| **Write engine** | `list_mutations` / `describe_mutation` / `execute_mutation` | Discover, describe and run any of the allowlisted mutations. |
+| **Write (curated)** | `change_issue_status` | Change an issue/vulnerability status. |
+| **Write (curated)** | `create_source_code_vulnerability` | Create a manual source-code vulnerability. |
+| **Write (curated)** | `create_project` / `create_asset` / `create_ticket` | Create a project, asset or ticket. |
+| **Write (curated)** | `run_dast` | Start a Conviso DAST scan on an asset. |
+| **Write (curated)** | `trigger_pentest` / `create_pentest_artifact` | Trigger an AI-Pentest execution / create its artifact. |
+
+> Write tools are **Node-only**. Mutations are restricted to an allowlist
+> (`src/conviso_mcp/operation_allowlist.js`); see the root `README.md` for the write workflow.
 
 ## 🚀 Installation and Configuration (Node.js bundle)
 
 ### Prerequisites
 
-* Node.js 18 or later.
+* Node.js 20.10 or later.
 * A Conviso Platform API Key (obtained from your profile settings).
 * An MCP-compatible client (e.g., Claude Desktop, Cursor, etc.).
 

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@convisoappsec/mcp",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "MCP Server for Conviso Platform integration",
   "type": "module",
   "main": "src/conviso_mcp/server.js",
   "scripts": {
     "start": "node src/conviso_mcp/server.js",
     "dev": "node src/conviso_mcp/server.js",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "gen:mutations": "node scripts/generate_mutation_catalog.mjs",
+    "test": "node --test"
   },
   "bin": {
     "conviso-mcp": "src/conviso_mcp/server.js"
@@ -16,7 +17,7 @@
     "src"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.10.0"
   },
   "publishConfig": {
     "access": "public"
@@ -43,8 +44,11 @@
   "dependencies": {
     "@hono/node-server": "^1.19.11",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "axios": "^1.13.5",
+    "axios": "^1.16.1",
     "dotenv": "^16.6.1",
     "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "graphql": "^16.9.0"
   }
 }

package/src/conviso_mcp/feed_gateway.js

@@ -1,5 +1,6 @@
 import 'dotenv/config';
 import { GraphQLClient } from './graphql_client.js';
+import { listMutations, describeMutation } from './mutations.js';
 
 class FeedGateway {
   constructor(graphql_api_key = '') {
@@ -8,8 +9,9 @@ class FeedGateway {
     this.graphql = new GraphQLClient(`${this.base_url}/graphql`, apiKey);
   }
 
-  async get_companies(page = 1, limit = 10, search = '') {
-    return this.graphql.get_companies(page, limit, search);
+  // search = name contains; label_eq = exact name match.
+  async get_companies(page = 1, limit = 10, search = '', label_eq = null) {
+    return this.graphql.get_companies(page, limit, search, label_eq);
   }
 
   async get_company_by_id(company_id) {
@@ -20,36 +22,43 @@ class FeedGateway {
     return this.graphql.get_issue_by_id(issue_id, return_snippets);
   }
 
-  async get_issues(company_id, search = '', page = 1, limit = 1, project_id = null) {
-    return this.graphql.get_issues(company_id, search, page, limit, project_id);
+  // Single rich issues passthrough (parity with Python gateway.get_issues kwargs).
+  async getIssues(company_id, opts = {}) {
+    return this.graphql.getIssues(company_id, opts);
   }
 
   async get_issue_with_company_id(company_id, issue_id) {
     return this.graphql.get_issues(company_id, '', 1, 5, null, [issue_id]);
   }
 
-  async get_issues_by_asset_ids(company_id, page = 1, limit = 1, asset_ids = []) {
-    return this.graphql.get_issues(company_id, '', page, limit, null, [], asset_ids);
+  async get_issues_by_asset_ids(company_id, page = 1, limit = 10, asset_ids = [], search = '', opts = {}) {
+    return this.graphql.getIssues(company_id, {
+      ...opts,
+      page,
+      limit,
+      search,
+      assetIds: asset_ids,
+    });
   }
 
-  async get_projects(company_id, page = 1, limit = 1000, search = '') {
-    return this.graphql.get_projects(company_id, page, limit, search);
+  async get_projects(company_id, page = 1, limit = 1000, search = '', opts = {}) {
+    return this.graphql.get_projects(company_id, page, limit, search, opts);
   }
 
   async get_project_by_id(project_id) {
     return this.graphql.get_project_by_id(project_id);
   }
 
-  async get_assets(company_id, page = 1, limit = 1000) {
-    return this.graphql.get_assets_by_company(company_id, page, limit);
+  async get_assets(company_id, page = 1, limit = 1000, opts = {}) {
+    return this.graphql.get_assets_by_company(company_id, page, limit, opts);
   }
 
   async get_asset_by_id(asset_id) {
     return this.graphql.get_asset_by_id(asset_id);
   }
 
-  async get_top_vulnerabilities(company_id) {
-    return this.graphql.get_top_vulnerabilities(company_id);
+  async get_top_vulnerabilities(company_id, opts = {}) {
+    return this.graphql.get_top_vulnerabilities(company_id, opts);
   }
 
   async generate_project_report(project_id, language = 'en', vulnerability_criticity = null, vulnerability_statuses = null, requirements = true, evidences = true) {
@@ -75,6 +84,115 @@ class FeedGateway {
   async get_overall_risk_score_history(company_id) {
     return this.graphql.get_overall_risk_score_history(company_id);
   }
+
+  // --- Mutations -------------------------------------------------------------
+
+  // Discovery/introspection are pure (no network) — answered straight from the catalog.
+  list_mutations(opts = {}) {
+    return listMutations(opts);
+  }
+
+  describe_mutation(name) {
+    return describeMutation(name);
+  }
+
+  async execute_mutation(name, variables = {}, returnFields = null) {
+    return this.graphql.executeMutation(name, variables, returnFields);
+  }
+
+  async change_issue_status(a = {}) {
+    return this.graphql.change_issue_status(a);
+  }
+
+  async create_source_code_vulnerability(a = {}) {
+    return this.graphql.create_source_code_vulnerability(a);
+  }
+
+  async create_project(a = {}) {
+    return this.graphql.create_project(a);
+  }
+
+  async create_asset(a = {}) {
+    return this.graphql.create_asset(a);
+  }
+
+  async create_ticket(a = {}) {
+    return this.graphql.create_ticket(a);
+  }
+
+  async run_dast(a = {}) {
+    return this.graphql.run_dast(a);
+  }
+
+  async trigger_pentest(a = {}) {
+    return this.graphql.trigger_pentest(a);
+  }
+
+  async create_pentest_artifact(a = {}) {
+    return this.graphql.create_pentest_artifact(a);
+  }
+
+  // --- Reads (curated query tools) -------------------------------------------
+
+  async get_tickets(company_id, opts = {}) {
+    return this.graphql.get_tickets(company_id, opts);
+  }
+
+  async get_ticket(company_id, ticket_id) {
+    return this.graphql.get_ticket(company_id, ticket_id);
+  }
+
+  async get_requirements(scope_id, opts = {}) {
+    return this.graphql.get_requirements(scope_id, opts);
+  }
+
+  async get_requirement(company_id, requirement_id) {
+    return this.graphql.get_requirement(company_id, requirement_id);
+  }
+
+  async get_project_requirements(project_id) {
+    return this.graphql.get_project_requirements(project_id);
+  }
+
+  async get_applications(company_id, search = null) {
+    return this.graphql.get_applications(company_id, search);
+  }
+
+  async get_application(company_id, application_id) {
+    return this.graphql.get_application(company_id, application_id);
+  }
+
+  async get_scan_histories(company_id, opts = {}) {
+    return this.graphql.get_scan_histories(company_id, opts);
+  }
+
+  async get_asset_scans_count(company_id) {
+    return this.graphql.get_asset_scans_count(company_id);
+  }
+
+  async get_sbom_components(company_id, opts = {}) {
+    return this.graphql.get_sbom_components(company_id, opts);
+  }
+
+  async get_pentest_artifacts(company_id, opts = {}) {
+    return this.graphql.get_pentest_artifacts(company_id, opts);
+  }
+
+  async get_pentest_artifact(artifact_id) {
+    return this.graphql.get_pentest_artifact(artifact_id);
+  }
+
+  async get_pentest_execution(execution_id) {
+    return this.graphql.get_pentest_execution(execution_id);
+  }
+
+  async get_threat_model_artifacts(company_id, opts = {}) {
+    return this.graphql.get_threat_model_artifacts(company_id, opts);
+  }
+
+  async get_threat_model_artifact(artifact_id) {
+    return this.graphql.get_threat_model_artifact(artifact_id);
+  }
 }
 
 export { FeedGateway };

package/src/conviso_mcp/filters.js

@@ -0,0 +1,54 @@
+// node/src/conviso_mcp/filters.js
+// Pure helpers for building GraphQL filter/sort variables. No network.
+
+export const SEVERITIES = ['NOTIFICATION', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+export const ISSUE_STATUSES = ['CREATED', 'DRAFT', 'IDENTIFIED', 'IN_PROGRESS', 'AWAITING_VALIDATION', 'FIX_ACCEPTED', 'RISK_ACCEPTED', 'FALSE_POSITIVE', 'SUPPRESSED'];
+export const SLA_STATES = ['ON_TRACK', 'APPROACHING', 'BREACHED', 'RESOLVED', 'NOT_TRACKED', 'NOT_PARAMETERIZED'];
+export const BUSINESS_IMPACT = ['LOW', 'MEDIUM', 'HIGH', 'NOT_DEFINED'];
+export const EXPLOITABILITY = ['INTERNET_FACING', 'INTERNAL', 'NOT_DEFINED'];
+export const REACHABILITY = ['STATIC_ANALYSIS', 'DYNAMIC_ANALYSIS'];
+export const ISSUE_SORT_BY = ['RISK_SCORE', 'SEVERITY', 'ID', 'CREATED_AT', 'UPDATED_AT', 'SLA_DUE_AT'];
+export const ASSET_SORT_BY = ['updated_at', 'name', 'business_impact', 'risk_score'];
+export const ORDER = ['ASC', 'DESC'];
+
+export function normalizeEnum(value, allowed, upper = true) {
+  if (value === null || value === undefined) return null;
+  let s = String(value).trim();
+  s = upper ? s.toUpperCase() : s.toLowerCase();
+  return allowed.includes(s) ? s : null;
+}
+
+export function normalizeEnumList(values, allowed, upper = true) {
+  if (!values || values.length === 0) return [];
+  const out = [];
+  for (const v of values) {
+    const s = normalizeEnum(v, allowed, upper);
+    if (s !== null) out.push(s);
+  }
+  return out;
+}
+
+export function buildDateRange(after, before) {
+  const rng = {};
+  if (after) rng.startDate = after;
+  if (before) rng.endDate = before;
+  return Object.keys(rng).length ? rng : null;
+}
+
+export function buildIssueSortOptions(sortBy, order) {
+  const sb = normalizeEnum(sortBy, ISSUE_SORT_BY);
+  if (sb === null) return [];
+  const ord = normalizeEnum(order, ORDER) || 'DESC';
+  return [{ sortBy: sb, order: ord }];
+}
+
+export function prune(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v === null || v === undefined || v === '') continue;
+    if (Array.isArray(v) && v.length === 0) continue;
+    if (typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length === 0) continue;
+    out[k] = v;
+  }
+  return out;
+}