@convisoappsec/mcp 0.6.4 → 0.7.0

package/README.md

@@ -25,7 +25,7 @@ The server exposes the following tools to the LLM (see `node/manifest.json` for
 | **Metrics** | `get_mttr_over_time` | Get Mean Time To Resolution (MTTR) metrics over time for a company. Returns resolution times by severity level. |
 | **Metrics** | `get_overall_risk_score_history` | Get overall risk score history for a company, including current score and difference from last period. |
 | **Tickets** | `get_tickets` / `get_ticket` | List or fetch support/bug tickets. |
-| **Requirements** | `get_requirements` / `get_requirement` / `get_project_requirements` | Browse security requirements/checklists. |
+| **Requirements** | `get_requirements` / `get_requirement` / `get_project_requirements` / `get_project_requirement_activities` | Browse requirements/checklists and the instantiated activities of a requirement within a project. When only the project is known, use `get_project_requirements` first to discover the required `project_requirement_id`. |
 | **Applications** | `get_applications` / `get_application` | List or fetch applications and their assets. |
 | **Scans** | `get_scan_histories` / `get_asset_scans_count` | Scan execution history and coverage counts. |
 | **Supply chain** | `get_sbom_components` | SBOM / dependency components per company. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@convisoappsec/mcp",
-  "version": "0.6.4",
+  "version": "0.7.0",
   "description": "MCP Server for Conviso Platform integration",
   "type": "module",
   "main": "src/conviso_mcp/server.js",

package/src/conviso_mcp/graphql_client.js

@@ -454,6 +454,29 @@ export function buildProjectsVariables(companyId, page = 1, limit = 1000, opts =
   return { page, limit, params, sortBy, descending };
 }
 
+export function buildProjectRequirementActivitiesVariables(projectId, projectRequirementId, {
+  page = 1,
+  limit = 10,
+  title = '',
+  sortBy = 'SORT',
+  descending = false,
+  attachmentActionsOnly,
+} = {}) {
+  return {
+    page,
+    limit,
+    sortBy,
+    descending,
+    historyPagination: { page: 1, perPage: limit },
+    attachmentActionsOnly,
+    params: compact({
+      projectId,
+      projectRequirementId,
+      title,
+    }),
+  };
+}
+
 // Shared HTTP client: keep-alive reuses the TLS connection across the many sequential
 // calls an agent session makes; the timeout stops a hung upstream from hanging a tool
 // call (and the MCP client) forever.
@@ -911,6 +934,36 @@ class GraphQLClient {
     return this.execute(query, { projectId: project_id });
   }
 
+  async get_project_requirement_activities(project_id, project_requirement_id, options = {}) {
+    const query = `
+      query GetProjectRequirementActivities(
+        $page: Int
+        $limit: Int
+        $sortBy: ActivitySortByEnum
+        $descending: Boolean
+        $historyPagination: PaginationInput!
+        $attachmentActionsOnly: Boolean
+        $params: ActivitiesSearch!
+      ) {
+        activities(page: $page, limit: $limit, params: $params, sortBy: $sortBy, descending: $descending) {
+          collection {
+            id title status permittedStatus description reference updatedAt reason
+            history(pagination: $historyPagination, attachmentActionsOnly: $attachmentActionsOnly) {
+              metadata { totalCount }
+            }
+            portalUser { avatarUrl email name }
+            check { description id label }
+            assignedUsers { avatarUrl name email }
+          }
+          metadata { currentPage limitValue totalCount totalPages }
+        }
+      }`;
+    return this.execute(
+      query,
+      buildProjectRequirementActivitiesVariables(project_id, project_requirement_id, options),
+    );
+  }
+
   async get_applications(company_id, search = null) {
     const query = `
       query GetApplications($companyId: ID!, $search: String) {

package/src/conviso_mcp/server.js

@@ -400,10 +400,35 @@ function buildServer() {
 
   tool('get_project_requirements', {
     title: 'Project Requirements',
-    desc: 'List the requirements/checklists attached to a project.',
+    desc: 'List the requirements/checklists attached to a project. The returned project-requirement id is the project_requirement_id used by get_project_requirement_activities. When the user knows only the project, call this tool first, choose the requested requirement from the results (ask only if ambiguous), then call get_project_requirement_activities.',
     schema: z.object({ project_id: z.number() }),
   }, ({ project_id }) => gql.get_project_requirements(project_id));
 
+  tool('get_project_requirement_activities', {
+    title: 'Project Requirement Activities',
+    desc: 'List the instantiated activities for one requirement/checklist within a project, including status, permitted transitions, assignees, references, reason, and history count. Requires the project-requirement association id, not the requirement template id. If the user provides only a project, first call get_project_requirements(project_id) to discover project_requirement_id, then call this tool for the relevant requirement; repeat for each returned requirement when the user asks for all project checklist activities.',
+    schema: z.object({
+      project_id: z.number(),
+      project_requirement_id: z.number(),
+      page: z.number().optional(),
+      limit: z.number().optional(),
+      title: z.string().optional(),
+      sort_by: z.string().optional().describe('ActivitySortByEnum value; defaults to SORT.'),
+      descending: z.boolean().optional(),
+      attachment_actions_only: z.boolean().optional(),
+    }),
+  }, ({
+    project_id, project_requirement_id, page, limit, title, sort_by,
+    descending, attachment_actions_only,
+  }) => gql.get_project_requirement_activities(project_id, project_requirement_id, {
+    page,
+    limit,
+    title,
+    sortBy: sort_by,
+    descending,
+    attachmentActionsOnly: attachment_actions_only,
+  }));
+
   tool('get_applications', {
     title: 'List Applications',
     desc: 'List a company\'s applications (name, url, riskScore, assetsCount). Optional: search by name.',