@convisoappsec/mcp 0.3.1 → 0.6.0

package/README.md

@@ -2,7 +2,7 @@
 
 # Conviso MCP Server
 
-This repository contains both a Python and a Node.js MCP server. This `node/` folder is the Node.js bundle and is packaged into the `.mcpb` bundle for MCP clients that run Node runtimes.
+This `node/` folder contains the Conviso MCP server (Node.js). It is published to npm as `@convisoappsec/mcp` and packaged into the `.mcpb` bundle for MCP clients.
 
 ## 🛠 Available Tools (Capabilities)
 
@@ -24,12 +24,31 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Utilities** | `get_today_date` | Return current day/month/year (utility). |
 | **Metrics** | `get_mttr_over_time` | Get Mean Time To Resolution (MTTR) metrics over time for a company. Returns resolution times by severity level. |
 | **Metrics** | `get_overall_risk_score_history` | Get overall risk score history for a company, including current score and difference from last period. |
+| **Tickets** | `get_tickets` / `get_ticket` | List or fetch support/bug tickets. |
+| **Requirements** | `get_requirements` / `get_requirement` / `get_project_requirements` | Browse security requirements/checklists. |
+| **Applications** | `get_applications` / `get_application` | List or fetch applications and their assets. |
+| **Scans** | `get_scan_histories` / `get_asset_scans_count` | Scan execution history and coverage counts. |
+| **Supply chain** | `get_sbom_components` | SBOM / dependency components per company. |
+| **AI-Pentest** | `get_pentest_artifacts` / `get_pentest_artifact` / `get_pentest_execution` | Pentest artifacts, scope and execution results. |
+| **Threat Modeling** | `get_threat_model_artifacts` / `get_threat_model_artifact` | Threat model artifacts and versions. |
+| **Writes — engine** | `list_mutations` / `describe_mutation` / `execute_mutation` | Discover, describe and run the permitted write operations below. |
+| **Writes — Issues** | `execute_mutation` | Create, update, delete and change status of vulnerabilities/issues. |
+| **Writes — Assets** | `execute_mutation` | Create and update assets; run a DAST scan. |
+| **Writes — Tickets** | `execute_mutation` | Create tickets. |
+| **Writes — Projects** | `execute_mutation` | Create, update, change status and remove projects. |
+| **Writes — Requirements** | `execute_mutation` | Create and update requirements. |
+| **Writes — AI-Pentest** | `execute_mutation` | Create artifacts, schedule, trigger executions and retests. |
+| **Writes — Applications** | `execute_mutation` | Create and update applications. |
+| **Writes — Threat Modeling** | `execute_mutation` | Create and update threat-model artifacts and versions. |
+
+> Write tools are **Node-only** and limited to the supported client-facing capabilities; see
+> the root `README.md` for the write workflow.
 
 ## 🚀 Installation and Configuration (Node.js bundle)
 
 ### Prerequisites
 
-* Node.js 18 or later.
+* Node.js 20.10 or later.
 * A Conviso Platform API Key (obtained from your profile settings).
 * An MCP-compatible client (e.g., Claude Desktop, Cursor, etc.).
 
@@ -48,20 +67,6 @@ export CONVISO_API_KEY=your_api_key_here
 npm start
 ```
 
-## Staging (optional)
-
-Set the `STAGING` environment variable to `true` to make the server use
-`https://staging.convisoappsec.com` instead of the production API.
-
-Example:
-
-```bash
-# staging (testing only)
-export STAGING=true
-npm start
-```
-
-
 ## Client configuration examples
 
 Below are quick examples showing how to configure Claude Desktop to run the Node bundle locally or via Docker. Paste the appropriate JSON into your Claude Desktop configuration file (see Claude docs for exact path on your OS).
@@ -119,6 +124,11 @@ docker build -t conviso-mcp-node-image .
 
 ---
 
-## Privacy
+## Privacy Policy
+
+This connector communicates only with the Conviso Platform API (`https://app.convisoappsec.com`)
+using the API key you provide. It does not collect, store, or share your data with any third
+party — requests and responses stay between your MCP client and the Conviso Platform. Error
+logs go to `stderr` only.
 
-This bundle references the project's privacy policy. See `node/manifest.json` privacy_policies for details.
+Full privacy policy: https://www.iubenda.com/privacy-policy/55589285

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@convisoappsec/mcp",
-  "version": "0.3.1",
+  "version": "0.6.0",
   "description": "MCP Server for Conviso Platform integration",
   "type": "module",
   "main": "src/conviso_mcp/server.js",
   "scripts": {
     "start": "node src/conviso_mcp/server.js",
     "dev": "node src/conviso_mcp/server.js",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "gen:mutations": "node scripts/generate_mutation_catalog.mjs",
+    "test": "node --test"
   },
   "bin": {
     "conviso-mcp": "src/conviso_mcp/server.js"
@@ -16,7 +17,7 @@
     "src"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.10.0"
   },
   "publishConfig": {
     "access": "public"
@@ -43,8 +44,11 @@
   "dependencies": {
     "@hono/node-server": "^1.19.11",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "axios": "^1.13.5",
+    "axios": "^1.16.1",
     "dotenv": "^16.6.1",
     "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "graphql": "^16.9.0"
   }
 }

package/src/conviso_mcp/filters.js

@@ -0,0 +1,54 @@
+// node/src/conviso_mcp/filters.js
+// Pure helpers for building GraphQL filter/sort variables. No network.
+
+export const SEVERITIES = ['NOTIFICATION', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+export const ISSUE_STATUSES = ['CREATED', 'DRAFT', 'IDENTIFIED', 'IN_PROGRESS', 'AWAITING_VALIDATION', 'FIX_ACCEPTED', 'RISK_ACCEPTED', 'FALSE_POSITIVE', 'SUPPRESSED'];
+export const SLA_STATES = ['ON_TRACK', 'APPROACHING', 'BREACHED', 'RESOLVED', 'NOT_TRACKED', 'NOT_PARAMETERIZED'];
+export const BUSINESS_IMPACT = ['LOW', 'MEDIUM', 'HIGH', 'NOT_DEFINED'];
+export const EXPLOITABILITY = ['INTERNET_FACING', 'INTERNAL', 'NOT_DEFINED'];
+export const REACHABILITY = ['STATIC_ANALYSIS', 'DYNAMIC_ANALYSIS'];
+export const ISSUE_SORT_BY = ['RISK_SCORE', 'SEVERITY', 'ID', 'CREATED_AT', 'UPDATED_AT', 'SLA_DUE_AT'];
+export const ASSET_SORT_BY = ['updated_at', 'name', 'business_impact', 'risk_score'];
+export const ORDER = ['ASC', 'DESC'];
+
+export function normalizeEnum(value, allowed, upper = true) {
+  if (value === null || value === undefined) return null;
+  let s = String(value).trim();
+  s = upper ? s.toUpperCase() : s.toLowerCase();
+  return allowed.includes(s) ? s : null;
+}
+
+export function normalizeEnumList(values, allowed, upper = true) {
+  if (!values || values.length === 0) return [];
+  const out = [];
+  for (const v of values) {
+    const s = normalizeEnum(v, allowed, upper);
+    if (s !== null) out.push(s);
+  }
+  return out;
+}
+
+export function buildDateRange(after, before) {
+  const rng = {};
+  if (after) rng.startDate = after;
+  if (before) rng.endDate = before;
+  return Object.keys(rng).length ? rng : null;
+}
+
+export function buildIssueSortOptions(sortBy, order) {
+  const sb = normalizeEnum(sortBy, ISSUE_SORT_BY);
+  if (sb === null) return [];
+  const ord = normalizeEnum(order, ORDER) || 'DESC';
+  return [{ sortBy: sb, order: ord }];
+}
+
+export function prune(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v === null || v === undefined || v === '') continue;
+    if (Array.isArray(v) && v.length === 0) continue;
+    if (typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length === 0) continue;
+    out[k] = v;
+  }
+  return out;
+}