@convisoappsec/mcp 0.3.1 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -18
- package/package.json +8 -4
- package/src/conviso_mcp/filters.js +54 -0
- package/src/conviso_mcp/graphql_client.js +538 -162
- package/src/conviso_mcp/mutations.js +126 -0
- package/src/conviso_mcp/mutations_catalog.json +3174 -0
- package/src/conviso_mcp/operation_allowlist.js +74 -0
- package/src/conviso_mcp/server.js +552 -326
- package/src/conviso_mcp/feed_gateway.js +0 -80
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Allowlist of the only platform mutations this MCP is permitted to expose.
|
|
3
|
+
*
|
|
4
|
+
* Everything else in the Conviso GraphQL schema is intentionally excluded. The catalog
|
|
5
|
+
* generator (scripts/generate_mutation_catalog.mjs) filters mutations_catalog.json down to
|
|
6
|
+
* exactly this set, so list_mutations / describe_mutation / execute_mutation — and the
|
|
7
|
+
* curated tools — can never reach a mutation outside it.
|
|
8
|
+
*
|
|
9
|
+
* Scope (client-facing capabilities):
|
|
10
|
+
* 1. Issues/Vulnerabilities create / update / delete / change status (manual only)
|
|
11
|
+
* 2. Assets create / update / run DAST
|
|
12
|
+
* 3. Tickets create (read via get_tickets/get_ticket)
|
|
13
|
+
* 4. Projects create / update / change status / remove (read via get_projects)
|
|
14
|
+
* 5. Requirements create / update (read via get_requirements/get_requirement)
|
|
15
|
+
* 6. AI-Pentest artifact / schedule / trigger / retest (read via get_pentest_*)
|
|
16
|
+
* 7. Supply chain read only -> get_sbom_components (no mutation)
|
|
17
|
+
* 8. Applications create / update (read via get_applications/get_application)
|
|
18
|
+
* 9. Scans read only -> get_scan_histories (no mutation)
|
|
19
|
+
* 10. Threat Modeling create / update / version (read via get_threat_model_*)
|
|
20
|
+
*/
|
|
21
|
+
export const ALLOWED_MUTATIONS = [
|
|
22
|
+
// 1. Issues / Vulnerabilities (manual management only — scanner-ingestion mutations excluded)
|
|
23
|
+
'changeIssueStatus',
|
|
24
|
+
'bulkChangeIssueStatus',
|
|
25
|
+
'bulkDeleteIssues',
|
|
26
|
+
'createSourceCodeVulnerability',
|
|
27
|
+
'createWebVulnerability',
|
|
28
|
+
'createNetworkVulnerability',
|
|
29
|
+
'updateSourceCodeVulnerability',
|
|
30
|
+
'updateWebVulnerability',
|
|
31
|
+
'updateNetworkVulnerability',
|
|
32
|
+
'updateIssueAssignee',
|
|
33
|
+
'markIssueAsAnalyzed',
|
|
34
|
+
|
|
35
|
+
// 2. Assets (+ run DAST)
|
|
36
|
+
'createAsset',
|
|
37
|
+
'updateAsset',
|
|
38
|
+
'startConvisoDast',
|
|
39
|
+
|
|
40
|
+
// 3. Tickets
|
|
41
|
+
'createTicket',
|
|
42
|
+
|
|
43
|
+
// 4. Projects
|
|
44
|
+
'createProject',
|
|
45
|
+
'updateProject',
|
|
46
|
+
'updateProjectStatus',
|
|
47
|
+
'bulkUpdateProjectStatus',
|
|
48
|
+
'bulkDeleteProjects',
|
|
49
|
+
|
|
50
|
+
// 5. Requirements
|
|
51
|
+
'createOrUpdateRequirement',
|
|
52
|
+
'createProjectRequirement',
|
|
53
|
+
'updateProjectRequirement',
|
|
54
|
+
|
|
55
|
+
// 6. AI-Pentest
|
|
56
|
+
'createPentestArtifact',
|
|
57
|
+
'updatePentestArtifact',
|
|
58
|
+
'createPentestExecution',
|
|
59
|
+
'cancelPentestExecution',
|
|
60
|
+
'createPentestRetest',
|
|
61
|
+
'submitPentestRetestResult',
|
|
62
|
+
|
|
63
|
+
// 8. Applications
|
|
64
|
+
'createApplication',
|
|
65
|
+
'updateApplication',
|
|
66
|
+
'addApplicationAssets',
|
|
67
|
+
'removeApplicationAssets',
|
|
68
|
+
|
|
69
|
+
// 10. Threat Modeling
|
|
70
|
+
'createThreatModelArtifact',
|
|
71
|
+
'createThreatModelArtifactVersion',
|
|
72
|
+
'updateThreatModelArtifact',
|
|
73
|
+
'createThreatModelingRequirements',
|
|
74
|
+
];
|