@convisoappsec/mcp 0.5.0 → 0.6.1

package/README.md

@@ -2,7 +2,7 @@
 
 # Conviso MCP Server
 
-This repository contains both a Python and a Node.js MCP server. This `node/` folder is the Node.js bundle and is packaged into the `.mcpb` bundle for MCP clients that run Node runtimes.
+This `node/` folder contains the Conviso MCP server (Node.js). It is published to npm as `@convisoappsec/mcp` and packaged into the `.mcpb` bundle for MCP clients.
 
 ## 🛠 Available Tools (Capabilities)
 
@@ -15,8 +15,6 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Vulnerabilities** | `get_issues` | List vulnerabilities by company or project. |
 | **Vulnerabilities** | `get_issue` | Technical details, including **code snippets** and raw requests/responses. |
 | **Vulnerabilities** | `get_top_vulnerabilities` | Risk overview (vulnerability count by severity). |
-| **Vulnerabilities** | `get_issues_by_asset_id` | List vulnerabilities for a company filtered by a single asset ID. |
-| **Vulnerabilities** | `get_issues_by_project_id` | List vulnerabilities for a company filtered by a project ID. |
 | **Management** | `get_projects` | List active security projects. |
 | **Management** | `get_project` | Get specific project in Conviso Platform by project ID. |
 | **Assets** | `get_assets` | List assets mapped within the platform. |
@@ -33,15 +31,18 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Supply chain** | `get_sbom_components` | SBOM / dependency components per company. |
 | **AI-Pentest** | `get_pentest_artifacts` / `get_pentest_artifact` / `get_pentest_execution` | Pentest artifacts, scope and execution results. |
 | **Threat Modeling** | `get_threat_model_artifacts` / `get_threat_model_artifact` | Threat model artifacts and versions. |
-| **Write engine** | `list_mutations` / `describe_mutation` / `execute_mutation` | Discover, describe and run any of the allowlisted mutations. |
-| **Write (curated)** | `change_issue_status` | Change an issue/vulnerability status. |
-| **Write (curated)** | `create_source_code_vulnerability` | Create a manual source-code vulnerability. |
-| **Write (curated)** | `create_project` / `create_asset` / `create_ticket` | Create a project, asset or ticket. |
-| **Write (curated)** | `run_dast` | Start a Conviso DAST scan on an asset. |
-| **Write (curated)** | `trigger_pentest` / `create_pentest_artifact` | Trigger an AI-Pentest execution / create its artifact. |
-
-> Write tools are **Node-only**. Mutations are restricted to an allowlist
-> (`src/conviso_mcp/operation_allowlist.js`); see the root `README.md` for the write workflow.
+| **Writes — engine** | `list_mutations` / `describe_mutation` / `execute_mutation` | Discover, describe and run the permitted write operations below. |
+| **Writes — Issues** | `execute_mutation` | Create, update, delete and change status of vulnerabilities/issues. |
+| **Writes — Assets** | `execute_mutation` | Create and update assets; run a DAST scan. |
+| **Writes — Tickets** | `execute_mutation` | Create tickets. |
+| **Writes — Projects** | `execute_mutation` | Create, update, change status and remove projects. |
+| **Writes — Requirements** | `execute_mutation` | Create and update requirements. |
+| **Writes — AI-Pentest** | `execute_mutation` | Create artifacts, schedule, trigger executions and retests. |
+| **Writes — Applications** | `execute_mutation` | Create and update applications. |
+| **Writes — Threat Modeling** | `execute_mutation` | Create and update threat-model artifacts and versions. |
+
+> Write tools are **Node-only** and limited to the supported client-facing capabilities; see
+> the root `README.md` for the write workflow.
 
 ## 🚀 Installation and Configuration (Node.js bundle)
 
@@ -66,20 +67,6 @@ export CONVISO_API_KEY=your_api_key_here
 npm start
 ```
 
-## Staging (optional)
-
-Set the `STAGING` environment variable to `true` to make the server use
-`https://staging.convisoappsec.com` instead of the production API.
-
-Example:
-
-```bash
-# staging (testing only)
-export STAGING=true
-npm start
-```
-
-
 ## Client configuration examples
 
 Below are quick examples showing how to configure Claude Desktop to run the Node bundle locally or via Docker. Paste the appropriate JSON into your Claude Desktop configuration file (see Claude docs for exact path on your OS).
@@ -137,6 +124,11 @@ docker build -t conviso-mcp-node-image .
 
 ---
 
-## Privacy
+## Privacy Policy
+
+This connector communicates only with the Conviso Platform API (`https://app.convisoappsec.com`)
+using the API key you provide. It does not collect, store, or share your data with any third
+party — requests and responses stay between your MCP client and the Conviso Platform. Error
+logs go to `stderr` only.
 
-This bundle references the project's privacy policy. See `node/manifest.json` privacy_policies for details.
+Full privacy policy: https://www.iubenda.com/privacy-policy/55589285

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@convisoappsec/mcp",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "MCP Server for Conviso Platform integration",
   "type": "module",
   "main": "src/conviso_mcp/server.js",

package/src/conviso_mcp/graphql_client.js

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import https from 'node:https';
 import * as F from './filters.js';
 import { buildMutationQuery } from './mutations.js';
 
@@ -450,6 +451,16 @@ export function buildProjectsVariables(companyId, page = 1, limit = 1000, opts =
   return { page, limit, params, sortBy, descending };
 }
 
+// Shared HTTP client: keep-alive reuses the TLS connection across the many sequential
+// calls an agent session makes; the timeout stops a hung upstream from hanging a tool
+// call (and the MCP client) forever.
+const httpClient = axios.create({
+  timeout: 30_000,
+  httpsAgent: new https.Agent({ keepAlive: true }),
+});
+
+const RETRYABLE_STATUS = new Set([429, 502, 503]);
+
 class GraphQLClient {
   constructor(endpoint, apiKey) {
     this.endpoint = endpoint;
@@ -462,16 +473,30 @@ class GraphQLClient {
   }
 
   async execute(query, variables = {}) {
-    const payload = { query, variables };
+    // Queries are idempotent — retry a transient failure once. Mutations never retry.
+    const isRead = /^\s*query\b/i.test(query);
+    try {
+      return await this.#post(query, variables);
+    } catch (err) {
+      const transient = RETRYABLE_STATUS.has(err.status) || err.code === 'ECONNRESET';
+      if (!isRead || !transient) throw err;
+      await new Promise((r) => setTimeout(r, 300));
+      return this.#post(query, variables);
+    }
+  }
 
+  async #post(query, variables) {
     let response;
-
     try {
-      response = await axios.post(this.endpoint, payload, { headers: this.headers });
+      response = await httpClient.post(this.endpoint, { query, variables }, { headers: this.headers });
     } catch (err) {
       if (err.response) {
+        const status = err.response.status;
         const e = new Error('GraphQL request failed');
-        e.status = err.response.status;
+        e.status = status;
+        if (status === 401 || status === 403) {
+          e.authHint = 'Authentication failed — check that CONVISO_API_KEY is set to a valid Conviso Platform API key.';
+        }
         throw e;
       }
 
@@ -481,7 +506,7 @@ class GraphQLClient {
         throw e;
       }
 
-      if (err.code === 'ETIMEDOUT') {
+      if (err.code === 'ETIMEDOUT' || err.code === 'ECONNABORTED') {
         const e = new Error('Upstream request timeout');
         e.status = 504;
         throw e;
@@ -508,18 +533,6 @@ class GraphQLClient {
     return this.execute(ISSUES_QUERY, variables);
   }
 
-  // Backward-compatible positional-argument wrapper used by existing FeedGateway callers.
-  async get_issues(company_id, search, page = 1, limit = 1, project_id = null, issue_ids = [], asset_ids = []) {
-    return this.getIssues(company_id, {
-      page,
-      limit,
-      search,
-      projectId: project_id,
-      issueIds: issue_ids,
-      assetIds: asset_ids,
-    });
-  }
-
   async get_issue_by_id(issue_id, return_snippets = false) {
     let query = `
         query GetIssue($id: ID!) {
@@ -544,6 +557,29 @@ class GraphQLClient {
     return this.execute(PROJECTS_QUERY, variables);
   }
 
+  async get_project_types(search = null) {
+    const query = `
+      query GetProjectTypes($page: Int, $limit: Int, $params: ProjectTypeSearch) {
+        projectTypes(page: $page, limit: $limit, params: $params) {
+          collection { id code label description defaultDuration }
+          metadata { totalCount totalPages currentPage limitValue }
+        }
+      }`;
+    const params = search ? { labelCont: search } : undefined;
+    return this.execute(query, { page: 1, limit: 100, params });
+  }
+
+  async get_project_statuses() {
+    const query = `
+      query GetProjectStatuses($page: Int, $limit: Int) {
+        projectStatuses(page: $page, limit: $limit) {
+          collection { id label isInitial }
+          metadata { totalCount }
+        }
+      }`;
+    return this.execute(query, { page: 1, limit: 100 });
+  }
+
   async get_project_by_id(project_id) {
     const query = `
         query GetProject($id: ID!) {
@@ -687,56 +723,6 @@ class GraphQLClient {
     return this.execute(query, variables);
   }
 
-  async generate_project_report(project_id, language = 'en', vulnerability_criticity = null, vulnerability_statuses = null, requirements = true, evidences = true) {
-    const query = `
-        query GenerateProjectReport(
-            $projectId: ID!,
-            $language: String!,
-            $vulnerabilityCriticity: [SeverityCategory!],
-            $vulnerabilityStatuses: [IssueStatusLabel!],
-            $requirements: Boolean!,
-            $evidences: Boolean!
-        ) {
-            generateProjectReport(
-                projectId: $projectId,
-                language: $language,
-                vulnerabilityCriticity: $vulnerabilityCriticity,
-                vulnerabilityStatuses: $vulnerabilityStatuses,
-                requirements: $requirements,
-                evidences: $evidences
-            ) {
-                id
-                reportUrl
-                status
-            }
-        }
-        `;
-    const variables = {
-      projectId: project_id,
-      language,
-      vulnerabilityCriticity: vulnerability_criticity || ["CRITICAL", "HIGH", "MEDIUM", "LOW", "NOTIFICATION"],
-      vulnerabilityStatuses: vulnerability_statuses || ["IDENTIFIED", "IN_PROGRESS", "AWAITING_VALIDATION", "FIX_ACCEPTED", "RISK_ACCEPTED", "FALSE_POSITIVE"],
-      requirements,
-      evidences
-    };
-    return this.execute(query, variables);
-  }
-
-  async generate_project_report_progress(project_id, report_id) {
-    const query = `
-        query GenerateProjectReport($projectId: ID!, $reportId: ID!) {
-            projectReport(projectId: $projectId, reportId: $reportId) {
-                id
-                progress
-                reportUrl
-                status
-            }
-        }
-        `;
-    const variables = { projectId: project_id, reportId: report_id };
-    return this.execute(query, variables);
-  }
-
   // --- Mutations -------------------------------------------------------------
 
   // Generic engine: run any catalogued mutation. Builds the GraphQL document from the

package/src/conviso_mcp/mutations.js

@@ -107,6 +107,15 @@ export function buildMutationQuery(name, variables = {}, returnFields = null) {
   if (!m) {
     throw new Error(`Unknown mutation '${name}'. Call list_mutations to discover valid names.`);
   }
+  // Every catalogued mutation takes a single `input` object. Callers often pass the input
+  // fields bare (without the { input: ... } wrapper) — accept that instead of failing.
+  if (
+    m.args.length === 1 && m.args[0].name === 'input' &&
+    variables && typeof variables === 'object' && !Array.isArray(variables) &&
+    !('input' in variables) && Object.keys(variables).length > 0
+  ) {
+    variables = { input: variables };
+  }
   const opName = name.charAt(0).toUpperCase() + name.slice(1);
   const decls = m.args.map((a) => `$${a.name}: ${a.type}`).join(', ');
   const pass = m.args.map((a) => `${a.name}: $${a.name}`).join(', ');