@geeks.ltd/geeks-amp-mcp 1.0.1 → 1.0.3

package/README.md

@@ -6,7 +6,7 @@ Local MCP server for Cursor that authenticates to your AMP backend via OAuth 2.0
 
 1. **First use** – When you call an AMP tool, the server opens your browser to AMP’s login. After you sign in, AMP redirects to `http://127.0.0.1:5005/callback`. The server exchanges the code for access and refresh tokens and stores them (e.g. in `~/.amp-mcp/credentials.json`).
 2. **Later uses** – The server reuses the stored access token. When it expires, it uses the refresh token; if refresh fails, it runs the browser flow again.
-3. **Tools** – `get_projects`, `get_amp_item_with_test_cases`, `submit_amp_progress_update`, `add_amp_test_case_references`, `get_auth_status`, `audit_tdd_amp` are forwarded to AMP with `Authorization: Bearer <token>`.
+3. **Tools** – `get_projects`, `get_amp_item_with_test_cases`, `submit_amp_progress_update`, `add_amp_test_case_references`, `submit_pen_test_review`, `get_auth_status`, `audit_tdd_amp`, `audit_pen_test_amp` are forwarded to AMP with `Authorization: Bearer <token>`.
 
 ## Prerequisites
 
@@ -65,7 +65,13 @@ In `.cursor/mcp.json` (project or global), use the **local server** via npx (no
 
 - **get_auth_status** – Returns `Authenticated: YES` or `Authenticated: NO` (no browser).
 - **get_projects** – List AMP projects (optional `searchTerm`, `limit`).
-- **get_amp_item_with_test_cases** – AMP item + test case refs by `ampReference` (e.g. `12345` or `AMP-12345`). Response JSON includes `ampItem.teamPercentageDone` (team board % done) alongside `progress` (workflow stage).
+- **get_amp_item_with_test_cases** – AMP item + test case refs by `ampReference` (e.g. `12345` or `AMP-12345`). Response JSON includes `ampItem.teamPercentageDone` (team board % done) alongside `progress` (workflow stage), and pen test review fields: `hasPenTestReview`, `penTestReviewCompleted`, `penTestReviewCompletedBy`, `penTestReviewCommentId`.
 - **submit_amp_progress_update** – Team board: optional `teamPercentageDone` (0, 10, …, 100) and/or `message`; at least one required. Omits `message` when only updating % so AMP can default the comment to `"{n}% completed"`.
 - **add_amp_test_case_references** – `ampReference`, required `testCaseReferences` (array of strings), optional `message` after refs; same as AMP “Update test cases” (`[#+REF#]` markers).
+- **submit_pen_test_review** – Record a completed Cursor AI pen test review: required `ampReference` and `scope` (branch, commits, files, or PR reviewed); optional `findings` (one per line, or `"None"`), `falsePositives` (`"N/A"` if none), `knownRisks` (`"N/A"` if none), `summary`. Posts a team comment with `[#PENTEST:COMPLETE#]` and sets review metadata on the work item.
 - **audit_tdd_amp** – Same as above plus auth status message for `/audit-tdd-amp` flows.
+- **audit_pen_test_amp** – AMP item + pen test review status + test cases, plus auth status message for `/run-pen-test` flows.
+
+## Cursor command: `/run-pen-test`
+
+Copy `.cursor/commands/run-pen-test.md` into your project (or use it from a repo that includes it). The command loads AMP context via MCP, runs a security review, and after human confirmation calls `submit_pen_test_review` to persist the outcome on AMP.

package/dist/index.js

@@ -65,7 +65,7 @@ async function main() {
         return callAmpTool("get_projects", args, token);
     });
     // get_amp_item_with_test_cases – ensure token, then call AMP
-    server.tool("get_amp_item_with_test_cases", "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done, 0–100 in steps of 10), project, and a list of test case references (e.g. +AVFD) with the comment they appear in.", {
+    server.tool("get_amp_item_with_test_cases", "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done, 0–100 in steps of 10), project, pen test review status (hasPenTestReview, penTestReviewCompleted, penTestReviewCompletedBy, penTestReviewCommentId), and a list of test case references (e.g. +AVFD) with the comment they appear in.", {
         ampReference: z.string().describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
     }, async ({ ampReference }) => {
         const token = await ensureAccessToken();
@@ -113,6 +113,31 @@ async function main() {
             args.message = message.trim();
         return callAmpTool("add_amp_test_case_references", args, token);
     });
+    // submit_pen_test_review – record completed Cursor AI pen test review on AMP
+    server.tool("submit_pen_test_review", "Record a completed Cursor AI pen test review on an AMP work item. Posts a structured team comment and sets review metadata. Use after run-pen-test and human confirmation.", {
+        ampReference: z
+            .string()
+            .describe("AMP reference, e.g. '12345' or 'AMP-12345'"),
+        scope: z
+            .string()
+            .describe("Branch, commits, files, or PR reviewed"),
+        findings: z
+            .string()
+            .optional()
+            .describe("Findings, one per line; 'None' if none"),
+        falsePositives: z
+            .string()
+            .optional()
+            .describe("False positives explained; 'N/A' if none"),
+        knownRisks: z
+            .string()
+            .optional()
+            .describe("Accepted known risks; 'N/A' if none"),
+        summary: z.string().optional().describe("Short overall outcome"),
+    }, async (args) => {
+        const token = await ensureAccessToken();
+        return callAmpTool("submit_pen_test_review", args, token);
+    });
     // Optional: audit-tdd-amp – get AMP item + test cases and report auth status (for /audit-tdd-amp in Cursor)
     server.tool("audit_tdd_amp", "Get AMP item and its test case references, and report auth status. Use for /audit-tdd-amp flows in Cursor.", {
         ampReference: z.string().describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
@@ -132,6 +157,27 @@ async function main() {
             ],
         };
     });
+    // Optional: audit-pen-test-amp – get AMP item + pen test review status and report auth (for /run-pen-test in Cursor)
+    server.tool("audit_pen_test_amp", "Get AMP item, pen test review status, and test case references, plus auth status. Use for /run-pen-test flows in Cursor.", {
+        ampReference: z
+            .string()
+            .describe("AMP item reference number, e.g. '12345' or 'AMP-12345'"),
+    }, async ({ ampReference }) => {
+        const token = await ensureAccessToken();
+        const result = await callAmpTool("get_amp_item_with_test_cases", { ampReference }, token);
+        const status = getAuthStatus();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        message: status.message,
+                        ampItemAndPenTestReview: result.content[0]?.text,
+                    }),
+                },
+            ],
+        };
+    });
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/tools.js

@@ -23,7 +23,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "get_amp_item_with_test_cases",
-        description: "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done), project, and a list of test case references (e.g. +AVFD) with the comment they appear in.",
+        description: "Get AMP (work item) details and all its test case references for a given AMP item. Use the reference number (e.g. 12345) or AMP-12345 format. Returns subject, note, status, progress (workflow stage), teamPercentageDone (team board % done), project, pen test review status (hasPenTestReview, penTestReviewCompleted, penTestReviewCompletedBy, penTestReviewCommentId), and a list of test case references (e.g. +AVFD) with the comment they appear in.",
         inputSchema: {
             type: "object",
             properties: {
@@ -80,6 +80,40 @@ export const TOOL_DEFINITIONS = [
             required: ["ampReference", "testCaseReferences"],
         },
     },
+    {
+        name: "submit_pen_test_review",
+        description: "Record a completed Cursor AI pen test review on an AMP work item. Posts a structured team comment and sets review metadata. Use after run-pen-test and human confirmation.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ampReference: {
+                    type: "string",
+                    description: "AMP reference, e.g. '12345' or 'AMP-12345'",
+                },
+                scope: {
+                    type: "string",
+                    description: "Branch, commits, files, or PR reviewed",
+                },
+                findings: {
+                    type: "string",
+                    description: "Findings, one per line; 'None' if none",
+                },
+                falsePositives: {
+                    type: "string",
+                    description: "False positives explained; 'N/A' if none",
+                },
+                knownRisks: {
+                    type: "string",
+                    description: "Accepted known risks; 'N/A' if none",
+                },
+                summary: {
+                    type: "string",
+                    description: "Short overall outcome",
+                },
+            },
+            required: ["ampReference", "scope"],
+        },
+    },
     {
         name: "get_auth_status",
         description: "Report whether the MCP server is authenticated to AMP. Returns 'Authenticated: YES' or 'Authenticated: NO' without opening the browser.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geeks.ltd/geeks-amp-mcp",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Local MCP server for AMP (OAuth 2.0 PKCE, token storage, proxy to AMP MCPServer.ashx)",
   "type": "module",
   "main": "dist/index.js",
@@ -45,4 +45,4 @@
     "tsx": "^4.0.0",
     "typescript": "^5.0.0"
   }
-}
+}