@geeks.ltd/geeks-amp-mcp 1.0.0 → 1.0.3

package/README.md

@@ -6,7 +6,7 @@ Local MCP server for Cursor that authenticates to your AMP backend via OAuth 2.0
 
 1. **First use** – When you call an AMP tool, the server opens your browser to AMP’s login. After you sign in, AMP redirects to `http://127.0.0.1:5005/callback`. The server exchanges the code for access and refresh tokens and stores them (e.g. in `~/.amp-mcp/credentials.json`).
 2. **Later uses** – The server reuses the stored access token. When it expires, it uses the refresh token; if refresh fails, it runs the browser flow again.
-3. **Tools** – `get_projects`, `get_amp_item_with_test_cases`, `get_auth_status`, `audit_tdd_amp` are forwarded to AMP with `Authorization: Bearer <token>`.
+3. **Tools** – `get_projects`, `get_amp_item_with_test_cases`, `submit_amp_progress_update`, `add_amp_test_case_references`, `submit_pen_test_review`, `get_auth_status`, `audit_tdd_amp`, `audit_pen_test_amp` are forwarded to AMP with `Authorization: Bearer <token>`.
 
 ## Prerequisites
 
@@ -65,5 +65,13 @@ In `.cursor/mcp.json` (project or global), use the **local server** via npx (no
 
 - **get_auth_status** – Returns `Authenticated: YES` or `Authenticated: NO` (no browser).
 - **get_projects** – List AMP projects (optional `searchTerm`, `limit`).
-- **get_amp_item_with_test_cases** – AMP item + test case refs by `ampReference` (e.g. `12345` or `AMP-12345`).
+- **get_amp_item_with_test_cases** – AMP item + test case refs by `ampReference` (e.g. `12345` or `AMP-12345`). Response JSON includes `ampItem.teamPercentageDone` (team board % done) alongside `progress` (workflow stage), and pen test review fields: `hasPenTestReview`, `penTestReviewCompleted`, `penTestReviewCompletedBy`, `penTestReviewCommentId`.
+- **submit_amp_progress_update** – Team board: optional `teamPercentageDone` (0, 10, …, 100) and/or `message`; at least one required. Omits `message` when only updating % so AMP can default the comment to `"{n}% completed"`.
+- **add_amp_test_case_references** – `ampReference`, required `testCaseReferences` (array of strings), optional `message` after refs; same as AMP “Update test cases” (`[#+REF#]` markers).
+- **submit_pen_test_review** – Record a completed Cursor AI pen test review: required `ampReference` and `scope` (branch, commits, files, or PR reviewed); optional `findings` (one per line, or `"None"`), `falsePositives` (`"N/A"` if none), `knownRisks` (`"N/A"` if none), `summary`. Posts a team comment with `[#PENTEST:COMPLETE#]` and sets review metadata on the work item.
 - **audit_tdd_amp** – Same as above plus auth status message for `/audit-tdd-amp` flows.
+- **audit_pen_test_amp** – AMP item + pen test review status + test cases, plus auth status message for `/run-pen-test` flows.
+
+## Cursor command: `/run-pen-test`
+
+Copy `.cursor/commands/run-pen-test.md` into your project (or use it from a repo that includes it). The command loads AMP context via MCP, runs a security review, and after human confirmation calls `submit_pen_test_review` to persist the outcome on AMP.

package/dist/index.js

@@ -8,6 +8,29 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { ensureAccessToken, getAuthStatus } from "./auth.js";
 import { callAmpTool } from "./tools.js";
+const submitAmpProgressUpdateSchema = z
+    .object({
+    ampReference: z.string().min(1).describe("e.g. '12345' or 'AMP-12345'"),
+    teamPercentageDone: z
+        .number()
+        .int()
+        .min(0)
+        .max(100)
+        .refine((n) => n % 10 === 0, "Must be a multiple of 10 (0, 10, …, 100)")
+        .optional()
+        .describe("Team % done (same as AMP team board dropdown)"),
+    message: z.string().optional().describe("Team comment text"),
+})
+    .superRefine((val, ctx) => {
+    const hasPct = val.teamPercentageDone !== undefined;
+    const hasMsg = val.message !== undefined && val.message.trim().length > 0;
+    if (!hasPct && !hasMsg) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "Provide teamPercentageDone and/or a non-empty message.",
+        });
+    }
+});
 async function main() {
     const server = new McpServer({
         name: "geeks-amp-mcp",
@@ -42,12 +65,79 @@ async function main() {
         return callAmpTool("get_projects", args, token);
     });
     // get_amp_item_with_test_cases – ensure token, then call AMP
-    server.tool("get_amp_item_with_test_cases", "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress, project, and a list of test case references (e.g. +AVFD) with the comment they appear in.", {
+    server.tool("get_amp_item_with_test_cases", "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done, 0–100 in steps of 10), project, pen test review status (hasPenTestReview, penTestReviewCompleted, penTestReviewCompletedBy, penTestReviewCommentId), and a list of test case references (e.g. +AVFD) with the comment they appear in.", {
         ampReference: z.string().describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
     }, async ({ ampReference }) => {
         const token = await ensureAccessToken();
         return callAmpTool("get_amp_item_with_test_cases", { ampReference }, token);
     });
+    // submit_amp_progress_update – team board % done and/or team comment (AMP MCPServer parity)
+    server.tool("submit_amp_progress_update", "Update the AMP team board: set team % done (0, 10, …, 100) and/or append a team-column comment. Not the same as workflow progress. At least one of teamPercentageDone or a non-empty message is required.", {
+        ampReference: z.string().min(1).describe("e.g. '12345' or 'AMP-12345'"),
+        teamPercentageDone: z
+            .number()
+            .int()
+            .min(0)
+            .max(100)
+            .optional()
+            .describe("Team % done (multiple of 10); omit if only posting a comment"),
+        message: z.string().optional().describe("Team comment text"),
+    }, async (raw) => {
+        const parsed = submitAmpProgressUpdateSchema.parse(raw);
+        const token = await ensureAccessToken();
+        const args = { ampReference: parsed.ampReference };
+        if (parsed.teamPercentageDone !== undefined)
+            args.teamPercentageDone = parsed.teamPercentageDone;
+        if (parsed.message !== undefined && parsed.message.trim() !== "")
+            args.message = parsed.message.trim();
+        return callAmpTool("submit_amp_progress_update", args, token);
+    });
+    // add_amp_test_case_references – team comment with [#+REF#] markers (AMP “Update test cases”)
+    server.tool("add_amp_test_case_references", "Add test case refs to an AMP item via a team comment; uses [#+REF#] markers (same as AMP \"Update test cases\").", {
+        ampReference: z.string().min(1).describe("e.g. '12345' or 'AMP-12345'"),
+        testCaseReferences: z
+            .array(z.string().min(1))
+            .min(1)
+            .describe('Test case refs, e.g. ["+AVFD", "LKJH"] or bare ids; server normalizes'),
+        message: z
+            .string()
+            .optional()
+            .describe("Text after the refs (like the form's Comment field)"),
+    }, async ({ ampReference, testCaseReferences, message, }) => {
+        const token = await ensureAccessToken();
+        const args = {
+            ampReference,
+            testCaseReferences,
+        };
+        if (message !== undefined && message.trim() !== "")
+            args.message = message.trim();
+        return callAmpTool("add_amp_test_case_references", args, token);
+    });
+    // submit_pen_test_review – record completed Cursor AI pen test review on AMP
+    server.tool("submit_pen_test_review", "Record a completed Cursor AI pen test review on an AMP work item. Posts a structured team comment and sets review metadata. Use after run-pen-test and human confirmation.", {
+        ampReference: z
+            .string()
+            .describe("AMP reference, e.g. '12345' or 'AMP-12345'"),
+        scope: z
+            .string()
+            .describe("Branch, commits, files, or PR reviewed"),
+        findings: z
+            .string()
+            .optional()
+            .describe("Findings, one per line; 'None' if none"),
+        falsePositives: z
+            .string()
+            .optional()
+            .describe("False positives explained; 'N/A' if none"),
+        knownRisks: z
+            .string()
+            .optional()
+            .describe("Accepted known risks; 'N/A' if none"),
+        summary: z.string().optional().describe("Short overall outcome"),
+    }, async (args) => {
+        const token = await ensureAccessToken();
+        return callAmpTool("submit_pen_test_review", args, token);
+    });
     // Optional: audit-tdd-amp – get AMP item + test cases and report auth status (for /audit-tdd-amp in Cursor)
     server.tool("audit_tdd_amp", "Get AMP item and its test case references, and report auth status. Use for /audit-tdd-amp flows in Cursor.", {
         ampReference: z.string().describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
@@ -67,6 +157,27 @@ async function main() {
             ],
         };
     });
+    // Optional: audit-pen-test-amp – get AMP item + pen test review status and report auth (for /run-pen-test in Cursor)
+    server.tool("audit_pen_test_amp", "Get AMP item, pen test review status, and test case references, plus auth status. Use for /run-pen-test flows in Cursor.", {
+        ampReference: z
+            .string()
+            .describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
+    }, async ({ ampReference }) => {
+        const token = await ensureAccessToken();
+        const result = await callAmpTool("get_amp_item_with_test_cases", { ampReference }, token);
+        const status = getAuthStatus();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        message: status.message,
+                        ampItemAndPenTestReview: result.content[0]?.text,
+                    }),
+                },
+            ],
+        };
+    });
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/tools.d.ts

@@ -10,6 +10,9 @@ export interface ToolDefinition {
         properties: Record<string, {
             type: string;
             description?: string;
+            items?: {
+                type: string;
+            };
         }>;
         required?: string[];
     };

package/dist/tools.js

@@ -23,7 +23,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "get_amp_item_with_test_cases",
-        description: "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress, project, and a list of test case references (e.g. +AVFD) with the comment they appear in.",
+        description: "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done), project, pen test review status (hasPenTestReview, penTestReviewCompleted, penTestReviewCompletedBy, penTestReviewCommentId), and a list of test case references (e.g. +AVFD) with the comment they appear in.",
         inputSchema: {
             type: "object",
             properties: {
@@ -35,6 +35,85 @@ export const TOOL_DEFINITIONS = [
             required: ["ampReference"],
         },
     },
+    {
+        name: "submit_amp_progress_update",
+        description: "Set team board % done (0–100, multiple of 10) and/or append a team-column comment. At least one of teamPercentageDone or non-empty message required. If only teamPercentageDone is sent, AMP sets comment text to \"{n}% completed\".",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ampReference: {
+                    type: "string",
+                    description: "e.g. '12345' or 'AMP-12345'",
+                },
+                teamPercentageDone: {
+                    type: "number",
+                    description: "Team % done (same as AMP team board dropdown); integer 0–100, multiple of 10",
+                },
+                message: {
+                    type: "string",
+                    description: "Team comment text",
+                },
+            },
+            required: ["ampReference"],
+        },
+    },
+    {
+        name: "add_amp_test_case_references",
+        description: "Add test case refs to an AMP item via a team comment; uses [#+REF#] markers (same as AMP \"Update test cases\").",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ampReference: {
+                    type: "string",
+                    description: "e.g. '12345' or 'AMP-12345'",
+                },
+                testCaseReferences: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: 'Refs such as "+AVFD", "LKJH", or bare ids; AMP normalizes',
+                },
+                message: {
+                    type: "string",
+                    description: "Text after the refs (like the form's Comment field)",
+                },
+            },
+            required: ["ampReference", "testCaseReferences"],
+        },
+    },
+    {
+        name: "submit_pen_test_review",
+        description: "Record a completed Cursor AI pen test review on an AMP work item. Posts a structured team comment and sets review metadata. Use after run-pen-test and human confirmation.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ampReference: {
+                    type: "string",
+                    description: "AMP reference, e.g. '12345' or 'AMP-12345'",
+                },
+                scope: {
+                    type: "string",
+                    description: "Branch, commits, files, or PR reviewed",
+                },
+                findings: {
+                    type: "string",
+                    description: "Findings, one per line; 'None' if none",
+                },
+                falsePositives: {
+                    type: "string",
+                    description: "False positives explained; 'N/A' if none",
+                },
+                knownRisks: {
+                    type: "string",
+                    description: "Accepted known risks; 'N/A' if none",
+                },
+                summary: {
+                    type: "string",
+                    description: "Short overall outcome",
+                },
+            },
+            required: ["ampReference", "scope"],
+        },
+    },
     {
         name: "get_auth_status",
         description: "Report whether the MCP server is authenticated to AMP. Returns 'Authenticated: YES' or 'Authenticated: NO' without opening the browser.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geeks.ltd/geeks-amp-mcp",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "Local MCP server for AMP (OAuth 2.0 PKCE, token storage, proxy to AMP MCPServer.ashx)",
   "type": "module",
   "main": "dist/index.js",