@doraincident/mcp-server 0.2.0 → 0.3.0

package/dist/client.d.ts

@@ -31,5 +31,29 @@ export declare class DoraIncidentClient {
         priority?: string;
     }): Promise<unknown>;
     getTicket(id: string): Promise<unknown>;
+    describeFilterFields(): Promise<unknown>;
+    searchTickets(query: string, params?: {
+        limit?: number;
+        cursor?: string;
+        count?: boolean;
+    }): Promise<unknown>;
+    listSavedFilters(): Promise<unknown>;
+    runSavedFilter(id: string, params?: {
+        limit?: number;
+        cursor?: string;
+        count?: boolean;
+    }): Promise<unknown>;
     searchKnowledgeBase(query: string, limit?: number): Promise<unknown>;
+    roiValidationReport(): Promise<unknown>;
+    roiConcentration(): Promise<unknown>;
+    listRoiProviders(): Promise<unknown>;
+    listRoiArrangements(status?: string): Promise<unknown>;
+    getRoiArrangement(id: string): Promise<unknown>;
+    tagIncidentProvider(incidentId: string, providerId: string, note?: string): Promise<unknown>;
+    checkProviderGleif(providerId: string): Promise<unknown>;
+    listAiSystems(): Promise<unknown>;
+    getAiSystem(id: string): Promise<unknown>;
+    aiActValidationReport(): Promise<unknown>;
+    tagIncidentAiSystem(incidentId: string, aiSystemId: string, note?: string): Promise<unknown>;
+    assessAiIncident(incidentId: string, aiSystemId: string, bases: string[], widespread?: boolean, note?: string): Promise<unknown>;
 }

package/dist/client.js

@@ -99,6 +99,29 @@ export class DoraIncidentClient {
     async getTicket(id) {
         return this.request(`/api/tickets/${id}`);
     }
+    // --- Ticket filtering (DIQL + saved filters) ---
+    async describeFilterFields() {
+        return this.request('/api/tickets/filter-fields');
+    }
+    async searchTickets(query, params) {
+        const q = new URLSearchParams({ q: query });
+        if (params?.limit)
+            q.set('limit', String(params.limit));
+        if (params?.cursor)
+            q.set('cursor', params.cursor);
+        if (params?.count)
+            q.set('count', 'true');
+        return this.request(`/api/tickets?${q.toString()}`);
+    }
+    async listSavedFilters() {
+        return this.request('/api/saved-filters');
+    }
+    async runSavedFilter(id, params) {
+        return this.request(`/api/saved-filters/${id}/run`, {
+            method: 'POST',
+            body: JSON.stringify(params ?? {}),
+        });
+    }
     // --- Knowledge base ---
     async searchKnowledgeBase(query, limit) {
         return this.request('/api/knowledge-base/search', {
@@ -106,4 +129,56 @@ export class DoraIncidentClient {
             body: JSON.stringify({ query, ...(limit ? { limit } : {}) }),
         });
     }
+    // --- Register of Information (DORA Chapter V) ---
+    async roiValidationReport() {
+        return this.request('/api/roi/validation');
+    }
+    async roiConcentration() {
+        return this.request('/api/roi/concentration');
+    }
+    async listRoiProviders() {
+        return this.request('/api/roi/providers');
+    }
+    async listRoiArrangements(status) {
+        const q = status ? `?status=${encodeURIComponent(status)}` : '';
+        return this.request(`/api/roi/arrangements${q}`);
+    }
+    async getRoiArrangement(id) {
+        return this.request(`/api/roi/arrangements/${encodeURIComponent(id)}`);
+    }
+    async tagIncidentProvider(incidentId, providerId, note) {
+        return this.request(`/api/incidents/${encodeURIComponent(incidentId)}/providers`, {
+            method: 'POST',
+            body: JSON.stringify({ roi_provider_id: providerId, ...(note ? { note } : {}) }),
+        });
+    }
+    async checkProviderGleif(providerId) {
+        return this.request(`/api/roi/providers/${encodeURIComponent(providerId)}/gleif`, { method: 'POST' });
+    }
+    // --- EU AI Act module ---
+    async listAiSystems() {
+        return this.request('/api/roi/ai-systems');
+    }
+    async getAiSystem(id) {
+        return this.request(`/api/roi/ai-systems/${encodeURIComponent(id)}`);
+    }
+    async aiActValidationReport() {
+        return this.request('/api/roi/ai-systems/validation');
+    }
+    async tagIncidentAiSystem(incidentId, aiSystemId, note) {
+        return this.request(`/api/incidents/${encodeURIComponent(incidentId)}/ai-systems`, {
+            method: 'POST',
+            body: JSON.stringify({ ai_system_id: aiSystemId, ...(note ? { note } : {}) }),
+        });
+    }
+    async assessAiIncident(incidentId, aiSystemId, bases, widespread, note) {
+        return this.request(`/api/incidents/${encodeURIComponent(incidentId)}/ai-systems/${encodeURIComponent(aiSystemId)}`, {
+            method: 'PUT',
+            body: JSON.stringify({
+                bases,
+                ...(widespread !== undefined ? { widespread } : {}),
+                ...(note ? { assessment_note: note } : {}),
+            }),
+        });
+    }
 }

package/dist/index.js

@@ -5,6 +5,9 @@ import { DoraIncidentClient } from './client.js';
 import { alertToolDefs, handleAlertTool } from './tools/alerts.js';
 import { incidentToolDefs, handleIncidentTool } from './tools/incidents.js';
 import { knowledgeToolDefs, handleKnowledgeTool } from './tools/knowledge.js';
+import { filterToolDefs, handleFilterTool } from './tools/filters.js';
+import { roiToolDefs, handleRoiTool } from './tools/roi.js';
+import { aiactToolDefs, handleAiactTool } from './tools/aiact.js';
 const DORAINCIDENT_URL = process.env.DORAINCIDENT_URL ?? 'https://www.doraincident.io';
 const DORAINCIDENT_API_KEY = process.env.DORAINCIDENT_API_KEY ?? '';
 if (!DORAINCIDENT_API_KEY) {
@@ -13,10 +16,13 @@ if (!DORAINCIDENT_API_KEY) {
     process.exit(1);
 }
 const client = new DoraIncidentClient(DORAINCIDENT_URL, DORAINCIDENT_API_KEY);
-const ALL_TOOLS = [...alertToolDefs, ...incidentToolDefs, ...knowledgeToolDefs];
+const ALL_TOOLS = [...alertToolDefs, ...incidentToolDefs, ...knowledgeToolDefs, ...filterToolDefs, ...roiToolDefs, ...aiactToolDefs];
 const ALERT_TOOL_NAMES = new Set(alertToolDefs.map(t => t.name));
 const INCIDENT_TOOL_NAMES = new Set(incidentToolDefs.map(t => t.name));
 const KNOWLEDGE_TOOL_NAMES = new Set(knowledgeToolDefs.map(t => t.name));
+const FILTER_TOOL_NAMES = new Set(filterToolDefs.map(t => t.name));
+const ROI_TOOL_NAMES = new Set(roiToolDefs.map(t => t.name));
+const AIACT_TOOL_NAMES = new Set(aiactToolDefs.map(t => t.name));
 const server = new Server({ name: 'doraincident', version: '0.1.0' }, {
     capabilities: {
         tools: {},
@@ -70,6 +76,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         else if (KNOWLEDGE_TOOL_NAMES.has(name)) {
             text = await handleKnowledgeTool(name, safeArgs, client);
         }
+        else if (FILTER_TOOL_NAMES.has(name)) {
+            text = await handleFilterTool(name, safeArgs, client);
+        }
+        else if (ROI_TOOL_NAMES.has(name)) {
+            text = await handleRoiTool(name, safeArgs, client);
+        }
+        else if (AIACT_TOOL_NAMES.has(name)) {
+            text = await handleAiactTool(name, safeArgs, client);
+        }
         else {
             throw new Error(`Unknown tool: ${name}`);
         }

package/dist/tools/aiact.d.ts

@@ -0,0 +1,4 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { DoraIncidentClient } from '../client.js';
+export declare const aiactToolDefs: Tool[];
+export declare function handleAiactTool(name: string, args: Record<string, unknown>, client: DoraIncidentClient): Promise<string>;

package/dist/tools/aiact.js

@@ -0,0 +1,92 @@
+// EU AI Act module tools. Read-heavy by design, like the RoI set. The two
+// writes (tagging a system on an incident, recording the Article 73
+// assessment) are additive and audited; classification decisions, obligation
+// states and FRIA content are deliberately NOT exposed here - those are
+// formal compliance decisions recorded by a named person in the UI, and
+// nothing on this surface can submit anything to any authority.
+export const aiactToolDefs = [
+    {
+        name: 'list_ai_systems',
+        description: 'List the EU AI Act inventory: every registered AI system with its name, customer role (provider/deployer/' +
+            'both), deployment status, supplier, GPAI dependency, and current classification (high_risk / ' +
+            'not_high_risk_art6_3 / out_of_scope with the Annex III point). Use the id with get_ai_system, ' +
+            'tag_incident_ai_system or assess_ai_incident.',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'get_ai_system',
+        description: 'Full detail of one AI system: classification decision history (append-only, with rationale, Annex III ' +
+            'point, Article 6(3) condition, profiling flag), the twelve Article 26 deployer obligations with their ' +
+            'states and the automatic audit-log evidence, the Article 27 FRIA record, linked DORA business functions, ' +
+            'incident history, and the activation-gate status.',
+        inputSchema: {
+            type: 'object',
+            properties: { id: { type: 'string', description: 'AI system id (uuid) from list_ai_systems.' } },
+            required: ['id'],
+        },
+    },
+    {
+        name: 'ai_act_validation_report',
+        description: 'Run the EU AI Act module validation and return the report: systems in use without classification ' +
+            'decisions, missing rationales, outstanding Article 26 obligations, missing or overdue Article 73 ' +
+            'assessments, FRIA gaps for Annex III 5(b)/(c) deployers, and GPAI due-diligence gaps. Use this to answer ' +
+            '"where do we stand on AI Act readiness?".',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'tag_incident_ai_system',
+        description: 'Tag an AI system on an incident (the dual-threshold hook). Additive and audited: incidents never require ' +
+            'a tag, and tagging never changes register content. Tagging a HIGH-RISK system is what opens the Article ' +
+            '73 serious-incident assessment alongside the DORA deadlines - follow up with assess_ai_incident.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                incident_id: { type: 'string', description: 'Incident id (uuid).' },
+                ai_system_id: { type: 'string', description: 'AI system id (uuid) from list_ai_systems.' },
+                note: { type: 'string', description: 'Optional note on how the system was involved.' },
+            },
+            required: ['incident_id', 'ai_system_id'],
+        },
+    },
+    {
+        name: 'assess_ai_incident',
+        description: 'Record the Article 73 serious-incident assessment for a tagged, high-risk AI system. Pass the Article ' +
+            '3(49) bases that apply: 49a (death or serious harm to health), 49b (serious and irreversible disruption ' +
+            'of critical infrastructure), 49c (infringement of fundamental-rights obligations), 49d (serious harm to ' +
+            'property or environment) - or an empty list for a documented negative assessment. The platform computes ' +
+            'the outer clock (15 days default, 10 on death, 2 on widespread infringement or 49b) and the role-aware ' +
+            'duty (a deployer informs the PROVIDER first per Art 26(5)). It drafts and tracks; a human submits any ' +
+            'report; nothing is ever transmitted by the platform.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                incident_id: { type: 'string', description: 'Incident id (uuid).' },
+                ai_system_id: { type: 'string', description: 'AI system id (uuid); must already be tagged on the incident.' },
+                bases: {
+                    type: 'array',
+                    items: { type: 'string', enum: ['49a', '49b', '49c', '49d'] },
+                    description: 'The Article 3(49) bases that apply; empty for a negative assessment.',
+                },
+                widespread: { type: 'boolean', description: 'Widespread infringement (Art 73(3): 2-day clock).' },
+                note: { type: 'string', description: 'Optional assessment note.' },
+            },
+            required: ['incident_id', 'ai_system_id', 'bases'],
+        },
+    },
+];
+export async function handleAiactTool(name, args, client) {
+    switch (name) {
+        case 'list_ai_systems':
+            return JSON.stringify(await client.listAiSystems(), null, 2);
+        case 'get_ai_system':
+            return JSON.stringify(await client.getAiSystem(args.id), null, 2);
+        case 'ai_act_validation_report':
+            return JSON.stringify(await client.aiActValidationReport(), null, 2);
+        case 'tag_incident_ai_system':
+            return JSON.stringify(await client.tagIncidentAiSystem(args.incident_id, args.ai_system_id, args.note), null, 2);
+        case 'assess_ai_incident':
+            return JSON.stringify(await client.assessAiIncident(args.incident_id, args.ai_system_id, args.bases ?? [], args.widespread, args.note), null, 2);
+        default:
+            throw new Error(`Unknown AI Act tool: ${name}`);
+    }
+}

package/dist/tools/filters.d.ts

@@ -0,0 +1,4 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { DoraIncidentClient } from '../client.js';
+export declare const filterToolDefs: Tool[];
+export declare function handleFilterTool(name: string, args: Record<string, unknown>, client: DoraIncidentClient): Promise<string>;

package/dist/tools/filters.js

@@ -0,0 +1,75 @@
+export const filterToolDefs = [
+    {
+        name: 'describe_filter_fields',
+        description: 'List the fields you can filter tickets by (built-in fields plus this tenant\'s custom fields), with each ' +
+            'field\'s key, type, and the comparators it allows. Call this FIRST before writing a search_tickets query so ' +
+            'you use real field keys and valid comparators instead of guessing. Custom fields are prefixed cf:.',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'search_tickets',
+        description: 'Search tickets with a DIQL query (a Jira-like filter language). Results are scoped to your permissions and ' +
+            'cursor-paginated. Examples:\n' +
+            '  status IN (open, in_progress) AND priority = P1 AND assignee = currentUser()\n' +
+            '  labels CONTAINS ANY (payments, sepa) AND created_at >= -30d ORDER BY created_at DESC\n' +
+            '  ticket_type = bug AND dora_applicable = true AND status != closed\n' +
+            'Comparators: =, !=, >, >=, <, <=, IN, NOT IN, CONTAINS [ANY|ALL|NONE], STARTS WITH, DOES NOT CONTAIN, ' +
+            'IS EMPTY, IS NOT EMPTY, BETWEEN x AND y. Values with spaces need double quotes. Reference fields ' +
+            '(project, sprint, release, epic, parent, incident_id) filter by record id, not display name. Use ' +
+            'describe_filter_fields to get valid field keys. To page, pass the returned next_cursor back as cursor.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: { type: 'string', description: 'A DIQL query string.' },
+                limit: { type: 'number', description: 'Page size (1-200, default 50).' },
+                cursor: { type: 'string', description: 'The next_cursor from a previous page.' },
+                count: { type: 'boolean', description: 'Also return a capped total count.' },
+            },
+            required: ['query'],
+        },
+    },
+    {
+        name: 'list_saved_filters',
+        description: 'List the saved ticket filters available to you: your own plus any shared with the tenant. Returns each ' +
+            'filter\'s id, name, description, visibility, and whether you have favourited it. Use run_saved_filter with an ' +
+            'id to execute one.',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'run_saved_filter',
+        description: 'Run a saved filter by id and return the matching tickets, scoped to YOUR permissions (so the same shared ' +
+            'filter can return different rows for different people). Cursor-paginated. Get ids from list_saved_filters.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'string', description: 'The saved filter id.' },
+                limit: { type: 'number', description: 'Page size (1-200, default 50).' },
+                cursor: { type: 'string', description: 'The next_cursor from a previous page.' },
+                count: { type: 'boolean', description: 'Also return a capped total count.' },
+            },
+            required: ['id'],
+        },
+    },
+];
+export async function handleFilterTool(name, args, client) {
+    switch (name) {
+        case 'describe_filter_fields':
+            return JSON.stringify(await client.describeFilterFields(), null, 2);
+        case 'search_tickets':
+            return JSON.stringify(await client.searchTickets(args.query, {
+                limit: args.limit,
+                cursor: args.cursor,
+                count: args.count,
+            }), null, 2);
+        case 'list_saved_filters':
+            return JSON.stringify(await client.listSavedFilters(), null, 2);
+        case 'run_saved_filter':
+            return JSON.stringify(await client.runSavedFilter(args.id, {
+                limit: args.limit,
+                cursor: args.cursor,
+                count: args.count,
+            }), null, 2);
+        default:
+            throw new Error(`Unknown filter tool: ${name}`);
+    }
+}

package/dist/tools/roi.d.ts

@@ -0,0 +1,4 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { DoraIncidentClient } from '../client.js';
+export declare const roiToolDefs: Tool[];
+export declare function handleRoiTool(name: string, args: Record<string, unknown>, client: DoraIncidentClient): Promise<string>;

package/dist/tools/roi.js

@@ -0,0 +1,100 @@
+// Register of Information (DORA Chapter V third-party risk) tools.
+// Read-heavy by design: the register is compliance data. The two writes here
+// (incident tagging, GLEIF check) are additive and audited; neither can
+// change register content, and nothing here can submit anything anywhere.
+export const roiToolDefs = [
+    {
+        name: 'roi_validation_report',
+        description: 'Run the Register of Information validation and return the report: blocker/warning/info counts, whether the ' +
+            'register is exportable, and every finding with its rule id, category (technical/business/foreign_key/' +
+            'primary_key) and legal basis. Blockers prevent the register export. Use this to answer "is the register ' +
+            'ready?" or "what is missing for DORA third-party compliance?".',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'roi_concentration',
+        description: 'The Article 29 ICT concentration risk view, computed live from active arrangements and rolled up by provider ' +
+            'and identified ultimate-parent group. It includes dependency breadth, critical or important services, active ' +
+            'provider spend share, worst-case substitutability, latest monitoring status, GLEIF status, incident history, ' +
+            'and explainable risk indicators. No opaque score is invented.',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'list_roi_providers',
+        description: 'List the ICT third-party service providers in the Register of Information (B_05.01): id, legal name, ' +
+            'identification code and type, headquarters country, GLEIF status. Use the id with tag_incident_provider or ' +
+            'check_provider_gleif.',
+        inputSchema: { type: 'object', properties: {}, required: [] },
+    },
+    {
+        name: 'list_roi_arrangements',
+        description: 'List contractual arrangements (B_02.01): reference number, type, status (draft/active/terminated). ' +
+            'Optionally filter by status. Use get_roi_arrangement for the full picture of one.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                status: { type: 'string', enum: ['draft', 'active', 'terminated'], description: 'Filter by lifecycle status.' },
+            },
+            required: [],
+        },
+    },
+    {
+        name: 'get_roi_arrangement',
+        description: 'Full detail of one contractual arrangement: services (B_02.02) with provider/function/entity, signatories, ' +
+            'using entities, supply chain (B_05.02), assessments (B_07.01), the Article 30(2)/(3) provisions checklist, ' +
+            'the Article 28(4) due-diligence checklist, structured material-subcontracting assessments, the tested exit ' +
+            'strategy, whether the arrangement supports a critical or important function, and every outstanding item in ' +
+            'the complete draft-to-active compliance gate.',
+        inputSchema: {
+            type: 'object',
+            properties: { id: { type: 'string', description: 'Arrangement id (uuid) from list_roi_arrangements.' } },
+            required: ['id'],
+        },
+    },
+    {
+        name: 'tag_incident_provider',
+        description: 'Tag an ICT third-party provider on an incident (Article 28(6) ongoing monitoring). Additive and audited: ' +
+            'incidents never require a tag and tagging never changes register content, but the provider\'s incident ' +
+            'history feeds the concentration view. Use during or after an incident when a third-party provider was ' +
+            'involved (e.g. a cloud or payment-processor outage).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                incident_id: { type: 'string', description: 'Incident id (uuid).' },
+                provider_id: { type: 'string', description: 'RoI provider id (uuid) from list_roi_providers.' },
+                note: { type: 'string', description: 'Optional note on how the provider was involved.' },
+            },
+            required: ['incident_id', 'provider_id'],
+        },
+    },
+    {
+        name: 'check_provider_gleif',
+        description: 'Look up an LEI-coded provider\'s registration status on the public GLEIF API and cache it on the provider ' +
+            '(explicit enrichment; a lapsed LEI surfaces as a validation warning but never blocks anything).',
+        inputSchema: {
+            type: 'object',
+            properties: { provider_id: { type: 'string', description: 'RoI provider id (uuid) from list_roi_providers.' } },
+            required: ['provider_id'],
+        },
+    },
+];
+export async function handleRoiTool(name, args, client) {
+    switch (name) {
+        case 'roi_validation_report':
+            return JSON.stringify(await client.roiValidationReport(), null, 2);
+        case 'roi_concentration':
+            return JSON.stringify(await client.roiConcentration(), null, 2);
+        case 'list_roi_providers':
+            return JSON.stringify(await client.listRoiProviders(), null, 2);
+        case 'list_roi_arrangements':
+            return JSON.stringify(await client.listRoiArrangements(args.status), null, 2);
+        case 'get_roi_arrangement':
+            return JSON.stringify(await client.getRoiArrangement(args.id), null, 2);
+        case 'tag_incident_provider':
+            return JSON.stringify(await client.tagIncidentProvider(args.incident_id, args.provider_id, args.note), null, 2);
+        case 'check_provider_gleif':
+            return JSON.stringify(await client.checkProviderGleif(args.provider_id), null, 2);
+        default:
+            throw new Error(`Unknown RoI tool: ${name}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doraincident/mcp-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "MCP server for DoraIncident — query live incidents, acknowledge alerts, and track DORA regulatory deadlines from any AI assistant.",
   "type": "module",
   "private": false,
@@ -43,7 +43,9 @@
     "build": "tsc",
     "prepublishOnly": "npm run build",
     "start": "node dist/index.js",
-    "dev": "node --loader ts-node/esm src/index.ts"
+    "dev": "node --loader ts-node/esm src/index.ts",
+    "release": "npm publish --access public",
+    "release:patch": "npm version patch --no-git-tag-version && npm publish --access public"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"