@nimbus-dev/connectors 0.1.0

package/connectors/slack/src/server.ts

@@ -0,0 +1,360 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+  type McpListResult,
+  putOptionalBoolean,
+  putOptionalNonEmptyString,
+  requireProcessEnv,
+} from "../../../shared/mcp-tool-kit.ts";
+
+type SlackApiRecord = Record<string, unknown>;
+
+async function slackApi(
+  token: string,
+  method: string,
+  body: Record<string, unknown>,
+): Promise<{ ok: boolean; json: SlackApiRecord; text: string }> {
+  const res = await fetch(`https://slack.com/api/${method}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json; charset=utf-8",
+    },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text) as unknown;
+  } catch {
+    return { ok: false, json: {}, text };
+  }
+  const json =
+    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as SlackApiRecord)
+      : {};
+  const okField = json["ok"];
+  return { ok: okField === true && res.ok, json, text };
+}
+
+async function slackInvokeJsonWithToken(
+  token: string,
+  method: string,
+  body: Record<string, unknown>,
+  errorLabel: string,
+): Promise<McpListResult> {
+  const res = await slackApi(token, method, body);
+  if (!res.ok) {
+    throw new Error(`${errorLabel}: ${res.text.slice(0, 400)}`);
+  }
+  return jsonResult(res.json);
+}
+
+async function slackInvokeJson(
+  method: string,
+  body: Record<string, unknown>,
+  errorLabel: string,
+): Promise<McpListResult> {
+  return slackInvokeJsonWithToken(
+    requireProcessEnv("SLACK_USER_ACCESS_TOKEN"),
+    method,
+    body,
+    errorLabel,
+  );
+}
+
+const slackConversationsHistorySchema = z.object({
+  channel: z.string().min(1),
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().optional(),
+  oldest: z.string().optional(),
+  inclusive: z.boolean().optional(),
+});
+
+type SlackConversationsHistoryParsed = z.infer<typeof slackConversationsHistorySchema>;
+
+function buildConversationsHistoryBody(
+  parsed: SlackConversationsHistoryParsed,
+): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    channel: parsed.channel,
+    limit: parsed.limit ?? 50,
+  };
+  putOptionalNonEmptyString(body, "cursor", parsed.cursor);
+  putOptionalNonEmptyString(body, "oldest", parsed.oldest);
+  putOptionalBoolean(body, "inclusive", parsed.inclusive);
+  return body;
+}
+
+const server = new McpServer({ name: "nimbus-slack", version: "0.1.0" });
+
+const registerSimpleTool = createRegisterSimpleTool(server);
+
+import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+
+const reg = createZodToolRegistrar(registerSimpleTool);
+
+/**
+ * Every MUTATING slack tool goes through here. Outside the gateway this adds the
+ * consent gate, the write-scope allow-list, the mutation budget and the audit record; inside
+ * the gateway it is a pass-through, because executor.ts (I2) is the gate there.
+ */
+const registerWriteTool = createWriteToolRegistrar(server, {
+  connector: "slack",
+  scopeEnv: "NIMBUS_MCP_SLACK_WRITE_SCOPE",
+  scopeKinds: ["channel"],
+});
+
+const slackChannelListSchema = z.object({
+  types: z.string().optional(),
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().optional(),
+});
+
+reg(
+  "slack_channel_list",
+  "List channels the user is a member of (public, private, mpim, im).",
+  slackChannelListSchema,
+  async (parsed) => {
+    const body: Record<string, unknown> = {
+      types: parsed.types ?? "public_channel,private_channel,mpim,im",
+      limit: parsed.limit ?? 200,
+      exclude_archived: true,
+    };
+    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
+    return slackInvokeJson("conversations.list", body, "Slack conversations.list");
+  },
+);
+
+reg(
+  "slack_channel_history",
+  "Fetch message history for a channel, DM, or mpim.",
+  slackConversationsHistorySchema,
+  async (parsed) =>
+    slackInvokeJson(
+      "conversations.history",
+      buildConversationsHistoryBody(parsed),
+      "Slack conversations.history",
+    ),
+);
+
+const slackThreadRepliesSchema = z.object({
+  channel: z.string().min(1),
+  ts: z.string().min(1),
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().optional(),
+});
+
+reg(
+  "slack_thread_replies",
+  "Fetch replies in a thread (channel + thread parent ts).",
+  slackThreadRepliesSchema,
+  async (parsed) => {
+    const body: Record<string, unknown> = {
+      channel: parsed.channel,
+      ts: parsed.ts,
+      limit: parsed.limit ?? 50,
+    };
+    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
+    return slackInvokeJson("conversations.replies", body, "Slack conversations.replies");
+  },
+);
+
+const slackDmListSchema = z.object({
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().optional(),
+});
+
+reg(
+  "slack_dm_list",
+  "List direct message conversations (im + mpim).",
+  slackDmListSchema,
+  async (parsed) => {
+    const body: Record<string, unknown> = {
+      types: "im,mpim",
+      limit: parsed.limit ?? 200,
+      exclude_archived: true,
+    };
+    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
+    return slackInvokeJson("conversations.list", body, "Slack dm list");
+  },
+);
+
+reg(
+  "slack_dm_history",
+  "Fetch DM / mpim history (same as channel history; convenience alias).",
+  slackConversationsHistorySchema,
+  async (parsed) =>
+    slackInvokeJson(
+      "conversations.history",
+      buildConversationsHistoryBody(parsed),
+      "Slack dm history",
+    ),
+);
+
+const slackUserListSchema = z.object({
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().optional(),
+});
+
+reg(
+  "slack_user_list",
+  "List users in the workspace (paginated).",
+  slackUserListSchema,
+  async (parsed) => {
+    const body: Record<string, unknown> = { limit: parsed.limit ?? 100 };
+    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
+    return slackInvokeJson("users.list", body, "Slack users.list");
+  },
+);
+
+const slackUserGetSchema = z.object({ user: z.string().min(1) });
+
+reg("slack_user_get", "Get a single user profile by ID.", slackUserGetSchema, async (parsed) =>
+  slackInvokeJson("users.info", { user: parsed.user }, "Slack users.info"),
+);
+
+const slackSearchSchema = z.object({
+  query: z.string().min(1),
+  count: z.number().int().min(1).max(100).optional(),
+  page: z.number().int().min(1).optional(),
+  sort: z.enum(["timestamp", "score"]).optional(),
+  sort_dir: z.enum(["asc", "desc"]).optional(),
+});
+
+reg("slack_search", "Search messages (workspace search).", slackSearchSchema, async (parsed) => {
+  const body: Record<string, unknown> = {
+    query: parsed.query,
+    count: parsed.count ?? 20,
+    page: parsed.page ?? 1,
+  };
+  if (parsed.sort !== undefined) {
+    body["sort"] = parsed.sort;
+  }
+  if (parsed.sort_dir !== undefined) {
+    body["sort_dir"] = parsed.sort_dir;
+  }
+  return slackInvokeJson("search.messages", body, "Slack search.messages");
+});
+
+const slackMessagePostSchema = z.object({
+  channel: z.string().min(1),
+  text: z.string().min(1),
+  thread_ts: z.string().optional(),
+});
+
+registerWriteTool(
+  "slack_message_post",
+  {
+    mutates: "slack.message.post",
+    recoverable: true,
+    scopeTargetOf: (p) => ({ kind: "channel", value: p.channel }),
+  },
+  "Post a message to a channel.",
+  slackMessagePostSchema,
+  async (parsed) => {
+    const body: Record<string, unknown> = {
+      channel: parsed.channel,
+      text: parsed.text,
+    };
+    putOptionalNonEmptyString(body, "thread_ts", parsed.thread_ts);
+    return slackInvokeJson("chat.postMessage", body, "Slack chat.postMessage");
+  },
+);
+
+const slackMessagePostDmSchema = z.object({
+  user_ids: z.string().min(1),
+  text: z.string().min(1),
+});
+
+reg(
+  "slack_message_post_dm",
+  "Open or find a DM with user id(s) and send a message (requires HITL slack.message.post).",
+  slackMessagePostDmSchema,
+  async (parsed) => {
+    const token = requireProcessEnv("SLACK_USER_ACCESS_TOKEN");
+    const open = await slackApi(token, "conversations.open", {
+      users: parsed.user_ids,
+      return_im: true,
+    });
+    if (!open.ok) {
+      throw new Error(`Slack conversations.open: ${open.text.slice(0, 400)}`);
+    }
+    const ch = open.json["channel"];
+    const chRec =
+      ch !== null && typeof ch === "object" && !Array.isArray(ch)
+        ? (ch as SlackApiRecord)
+        : undefined;
+    const channelId = chRec !== undefined && typeof chRec["id"] === "string" ? chRec["id"] : "";
+    if (channelId === "") {
+      throw new Error("Slack conversations.open: missing channel id");
+    }
+    const post = await slackApi(token, "chat.postMessage", {
+      channel: channelId,
+      text: parsed.text,
+    });
+    if (!post.ok) {
+      throw new Error(`Slack chat.postMessage (dm): ${post.text.slice(0, 400)}`);
+    }
+    return jsonResult({ open: open.json, post: post.json });
+  },
+);
+
+// --- ChatOps operational tools (Slice 5) -------------------------------------------------------
+// These use the bot/app tokens (xoxb-/xapp-), distinct from the user token the read tools use.
+// Only `chatops/reply-dispatcher.ts` + `chatops/transport/` reference `slack_chat_post` (static D17).
+
+const slackUserInfoSchema = z.object({ user: z.string().min(1) });
+reg(
+  "slack_user_info",
+  "Fetch a Slack user's profile (incl. email) by user id (ChatOps identity mapping; bot token).",
+  slackUserInfoSchema,
+  async (parsed) =>
+    slackInvokeJsonWithToken(
+      requireProcessEnv("SLACK_BOT_TOKEN"),
+      "users.info",
+      { user: parsed.user },
+      "Slack users.info",
+    ),
+);
+
+const slackChatPostSchema = z.object({ channel: z.string().min(1), text: z.string().min(1) });
+registerWriteTool(
+  "slack_chat_post",
+  {
+    mutates: "slack.chat.post",
+    recoverable: true,
+    scopeTargetOf: (p) => ({ kind: "channel", value: p.channel }),
+  },
+  "Post an operational bot message to a channel (ChatOps reply surface; bot token).",
+  slackChatPostSchema,
+  async (parsed) =>
+    slackInvokeJsonWithToken(
+      requireProcessEnv("SLACK_BOT_TOKEN"),
+      "chat.postMessage",
+      { channel: parsed.channel, text: parsed.text },
+      "Slack chat.postMessage",
+    ),
+);
+
+const slackSocketOpenSchema = z.object({});
+reg(
+  "slack_socket_open",
+  "Open a Slack Socket Mode connection and return the short-lived wss:// URL (app-level token).",
+  slackSocketOpenSchema,
+  async () =>
+    slackInvokeJsonWithToken(
+      requireProcessEnv("SLACK_APP_TOKEN"), // xapp-… (Socket Mode app-level token)
+      "apps.connections.open",
+      {},
+      "Slack apps.connections.open",
+    ),
+);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/connectors/snowflake/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.snowflake",
+  "displayName": "Snowflake",
+  "version": "0.1.0",
+  "description": "Snowflake connector. Indexes Snowflake databases/schemas/tables (column names + tags only, NEVER row data) as `snowflake:data_model` items in the local index and exposes read tools (`snowflake_list`, `snowflake_get`, `snowflake_search`) plus HITL-gated governance write tools (`snowflake_tag_set`, `snowflake_comment_set`). Uses the Snowflake SQL REST API (`POST /api/v2/statements`) with OAuth token or key-pair JWT auth. The account identifier is supplied via the `snowflake.account` vault key and added to the sandbox network list at spawn time by `phase3AddSnowflakeMcp`, so the static manifest network list is intentionally empty.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": ["write"],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.5.0"
+}

package/connectors/snowflake/src/search-filter.ts

@@ -0,0 +1,26 @@
+import {
+  asRecord,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type SnowflakeSearchMatchOptions = SearchMatchOptions;
+
+function stringAt(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  return typeof v === "string" ? v : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asRecord(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [
+    stringAt(row, "table_name"),
+    stringAt(row, "schema_name"),
+    stringAt(row, "database_name"),
+  ];
+}
+
+export const filterSnowflakeTables = makeQueryFilter(fieldsOf);

package/connectors/snowflake/src/server.ts

@@ -0,0 +1,236 @@
+import { z } from "zod";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { fetchWithTimeout, mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import {
+  runReadOnlyMcpConnector,
+  type ZodToolRegistrar,
+} from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSnowflakeTables } from "./search-filter.ts";
+
+function snowflakeAccount(): string {
+  const v = process.env["SNOWFLAKE_ACCOUNT"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("SNOWFLAKE_ACCOUNT is not set");
+  }
+  return v;
+}
+
+function authHeader(): Record<string, string> {
+  const t = process.env["SNOWFLAKE_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SNOWFLAKE_TOKEN is not set");
+  }
+  return {
+    Authorization: `Bearer ${t}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  };
+}
+
+/**
+ * POST a single SQL statement to the Snowflake SQL REST API (`/api/v2/statements`) with the
+ * connector's Bearer auth. Returns the parsed JSON response; throws on a non-OK status. Shared by
+ * the read-only `fetchTables` path and the HITL-gated write tools so auth/transport stays in one place.
+ */
+async function executeStatement(statement: string): Promise<unknown> {
+  const url = `https://${snowflakeAccount()}.snowflakecomputing.com/api/v2/statements`;
+  const res = await fetchWithTimeout(url, {
+    method: "POST",
+    headers: authHeader(),
+    body: JSON.stringify({ statement, timeout: 60 }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Snowflake ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+// Each dot-separated part is an unquoted identifier OR a fully double-quoted token (no embedded ").
+const SF_IDENT_PART = /^(?:[A-Za-z_][A-Za-z0-9_$]*|"[^"]+")$/;
+function assertSfIdentifier(name: string, label: string): string {
+  const parts = name.split(".");
+  for (const part of parts) {
+    if (!SF_IDENT_PART.test(part)) {
+      throw new Error(`unsafe Snowflake identifier component for ${label}: ${part} in ${name}`);
+    }
+  }
+  return name;
+}
+
+// String literals are escaped by doubling single quotes (the only Snowflake literal-injection vector).
+function sfLiteral(v: string): string {
+  return `'${v.replaceAll("'", "''")}'`;
+}
+
+const TABLES_SQL =
+  "SELECT table_catalog AS database_name, table_schema AS schema_name, table_name, " +
+  "row_count, last_altered FROM information_schema.tables WHERE table_schema <> 'INFORMATION_SCHEMA'";
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return undefined;
+  }
+  return value as Record<string, unknown>;
+}
+
+function rowsFromStatementsResponse(parsed: unknown): Record<string, unknown>[] {
+  const root = asRecord(parsed);
+  const meta = asRecord(root?.["resultSetMetaData"]);
+  const rowType = Array.isArray(meta?.["rowType"]) ? meta["rowType"] : [];
+  const names = rowType.map(
+    (c) => (asRecord(c)?.["name"] as string | undefined)?.toLowerCase() ?? "",
+  );
+  const data = Array.isArray(root?.["data"]) ? root["data"] : [];
+  const out: Record<string, unknown>[] = [];
+  for (const rr of data) {
+    if (!Array.isArray(rr)) continue;
+    const obj: Record<string, unknown> = {};
+    names.forEach((name, i) => {
+      if (name !== "") obj[name] = rr[i];
+    });
+    if (typeof obj["row_count"] === "string" && obj["row_count"] !== "") {
+      obj["row_count"] = Number(obj["row_count"]);
+    }
+    out.push(obj);
+  }
+  return out;
+}
+
+/**
+ * Fetch table metadata. With no `page`, returns the full set (used by `snowflake_get` /
+ * `snowflake_search`, which must scan every table). With a `page`, appends a deterministic
+ * `ORDER BY … LIMIT … OFFSET …` so `snowflake_list` can drain pages — only numbers are
+ * interpolated, so there is no SQL-injection surface.
+ */
+async function fetchTables(page?: {
+  limit: number;
+  offset: number;
+}): Promise<Record<string, unknown>[]> {
+  const statement =
+    page === undefined
+      ? TABLES_SQL
+      : // (table_catalog, table_schema, table_name) uniquely identifies a table in INFORMATION_SCHEMA
+        // — a TOTAL order, so OFFSET paging cannot skip or duplicate rows across pages.
+        `${TABLES_SQL} ORDER BY table_catalog, table_schema, table_name LIMIT ${page.limit} OFFSET ${page.offset}`;
+  return rowsFromStatementsResponse(await executeStatement(statement));
+}
+
+function tableKey(row: Record<string, unknown>): string {
+  const db = typeof row["database_name"] === "string" ? row["database_name"].toLowerCase() : "";
+  const schema = typeof row["schema_name"] === "string" ? row["schema_name"].toLowerCase() : "";
+  const table = typeof row["table_name"] === "string" ? row["table_name"].toLowerCase() : "";
+  return `${db}.${schema}.${table}`;
+}
+
+/**
+ * Register the three read-only Snowflake tools on `reg`. Exported (rather than inlined into the
+ * `runReadOnlyMcpConnector` call) so the tool handlers can be exercised in unit tests without
+ * starting a real stdio transport.
+ */
+export function registerSnowflakeTools(reg: ZodToolRegistrar, server: unknown): void {
+  // Despite the read-only helper's name, this connector exposes write tools. The consent
+  // kit needs the real server, which the helper now passes through as its second argument.
+  const registerWriteTool = createWriteToolRegistrar(server as ConsentServer, {
+    connector: "snowflake",
+    scopeEnv: "NIMBUS_MCP_SNOWFLAKE_WRITE_SCOPE",
+    scopeKinds: ["object"],
+  });
+
+  reg(
+    "snowflake_list",
+    "List Snowflake tables across all databases and schemas. Paginated: `cursor` (opaque offset) + `limit` (default 200, max 500) → `{ items, nextCursor }`.",
+    z.object({
+      cursor: z.string().nullable().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const limit = p.limit ?? 200;
+      const offset =
+        p.cursor === null || p.cursor === undefined || p.cursor === ""
+          ? 0
+          : Math.max(0, Number.parseInt(p.cursor, 10) || 0);
+      const items = await fetchTables({ limit, offset });
+      const nextCursor = items.length === limit ? String(offset + limit) : null;
+      return jsonResult({ items, nextCursor });
+    },
+  );
+
+  reg(
+    "snowflake_get",
+    "Fetch one Snowflake table by its fully-qualified id (`database.schema.table`, case-insensitive). Throws when the table is not found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      const tables = await fetchTables();
+      const needle = p.id.toLowerCase();
+      const found = tables.find((row) => tableKey(row) === needle);
+      if (found === undefined) {
+        throw new Error(`Snowflake table not found: ${p.id}`);
+      }
+      return jsonResult(found);
+    },
+  );
+
+  reg(
+    "snowflake_search",
+    "Substring search across Snowflake tables. Matches the query (case-insensitive) against table name, schema name, and database name. Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const tables = await fetchTables();
+      const matches = filterSnowflakeTables(tables, { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+
+  registerWriteTool(
+    "snowflake_tag_set",
+    {
+      mutates: "snowflake.tag.set",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "object", value: p.object }),
+    },
+    "Set or unset a governance TAG on a table. `ALTER TABLE <object> SET TAG <tag> = '<value>'`; omit `value` to UNSET.",
+    z.object({
+      object: z.string().min(1),
+      tag: z.string().min(1),
+      value: z.string().optional(),
+    }),
+    async (p) => {
+      const obj = assertSfIdentifier(p.object, "object");
+      const tag = assertSfIdentifier(p.tag, "tag");
+      const statement =
+        p.value === undefined
+          ? `ALTER TABLE ${obj} UNSET TAG ${tag}`
+          : `ALTER TABLE ${obj} SET TAG ${tag} = ${sfLiteral(p.value)}`;
+      await executeStatement(statement);
+      return jsonResult({ status: "ok", object: obj, tag });
+    },
+  );
+
+  registerWriteTool(
+    "snowflake_comment_set",
+    {
+      mutates: "snowflake.comment.set",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "object", value: p.object }),
+    },
+    "Set a COMMENT on a table. `COMMENT ON TABLE <object> IS '<comment>'`.",
+    z.object({ object: z.string().min(1), comment: z.string() }),
+    async (p) => {
+      const obj = assertSfIdentifier(p.object, "object");
+      await executeStatement(`COMMENT ON TABLE ${obj} IS ${sfLiteral(p.comment)}`);
+      return jsonResult({ status: "ok", object: obj });
+    },
+  );
+}
+
+// Exported so the bundled-connector registry can start this server explicitly: `import.meta.main`
+// is false under an import, and the module must stay importable by tests without connecting stdio.
+export async function startConnector(): Promise<void> {
+  await runReadOnlyMcpConnector("nimbus-snowflake", registerSnowflakeTools);
+}
+
+if (import.meta.main) await startConnector();

package/connectors/snyk/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.snyk",
+  "displayName": "Snyk",
+  "version": "0.1.0",
+  "description": "Snyk REST connector (issues, projects). Read-only; enables CVE-to-repo-to-PR correlation queries from the local index. Self-hosted Snyk endpoints are a Task 14 follow-up.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.snyk.io"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/snyk/src/search-filter.ts

@@ -0,0 +1,28 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type SnykSearchMatchOptions = SearchMatchOptions;
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  const dataField = row["issueData"];
+  const data =
+    dataField !== null && typeof dataField === "object"
+      ? (dataField as Record<string, unknown>)
+      : {};
+  const title = typeof data["title"] === "string" ? data["title"] : "";
+  const cveField = data["cve"];
+  const cves = Array.isArray(cveField)
+    ? cveField.filter((c): c is string => typeof c === "string")
+    : [];
+  const pkg = typeof row["pkgName"] === "string" ? row["pkgName"] : "";
+  return [title, cves.join(" "), pkg];
+}
+
+export const filterSnykAggregatedIssues = makeQueryFilter(fieldsOf);