@nimbus-dev/connectors 0.2.1 → 0.2.2

package/connectors/semgrep/src/tools.ts

@@ -0,0 +1,92 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders, requiredEnv } from "../../../shared/env-json-api.ts";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSemgrepFindings } from "./search-filter.ts";
+
+const SEMGREP_API = "https://semgrep.dev/api/v1";
+const SEVERITIES = ["critical", "high", "medium", "low", "info"] as const;
+const STATUSES = ["open", "ignored", "fixed", "removed"] as const;
+
+const semgrepGet = createJsonGetter({
+  base: SEMGREP_API,
+  label: "Semgrep",
+  headers: envAuthHeaders({ env: "SEMGREP_TOKEN" }),
+});
+
+function requireSlug(): string {
+  return requiredEnv("SEMGREP_DEPLOYMENT_SLUG");
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const SEMGREP_TOOL_NAMES = ["semgrep_get", "semgrep_list", "semgrep_search"] as const;
+
+export function registerSemgrepTools(reg: ZodToolRegistrar): void {
+  reg(
+    "semgrep_list",
+    "List Semgrep deployments, or open findings for the configured deployment. When called without filters, returns the user's deployments (`/deployments`). Provide a `severity` or `status` filter to query findings under the deployment slug from `SEMGREP_DEPLOYMENT_SLUG` env.",
+    z.object({
+      severity: z.array(z.enum(SEVERITIES)).min(1).optional(),
+      status: z.array(z.enum(STATUSES)).min(1).optional(),
+      repository: z.string().min(1).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      if (p.severity === undefined && p.status === undefined && p.repository === undefined) {
+        return jsonResult(await semgrepGet("/deployments"));
+      }
+      const slug = requireSlug();
+      const search = new URLSearchParams({
+        page_size: String(p.limit ?? 100),
+      });
+      if (p.severity !== undefined && p.severity.length > 0) {
+        search.set("severities", p.severity.join(","));
+      }
+      if (p.status !== undefined && p.status.length > 0) {
+        search.set("statuses", p.status.join(","));
+      }
+      if (p.repository !== undefined) {
+        search.set("repos", p.repository);
+      }
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      return jsonResult(await semgrepGet(path));
+    },
+  );
+
+  reg(
+    "semgrep_get",
+    "Fetch one Semgrep finding by id from the configured deployment. Returns the matching finding envelope; throws when no match is found.",
+    z.object({
+      findingId: z.string().min(1),
+    }),
+    async (p) => {
+      const slug = requireSlug();
+      const search = new URLSearchParams({ ids: p.findingId, page_size: "1" });
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      const root = await semgrepGet(path);
+      const findings = (root as { findings?: unknown[] } | null)?.findings;
+      if (!Array.isArray(findings) || findings.length === 0) {
+        throw new Error(`Semgrep: finding ${p.findingId} not found`);
+      }
+      return jsonResult(findings[0]);
+    },
+  );
+
+  reg(
+    "semgrep_search",
+    "Substring search across the deployment's open findings. Matches the query against `rule_name`, `rule_message`, `location.file_path`, and `repository.name` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const slug = requireSlug();
+      const search = new URLSearchParams({
+        statuses: "open",
+        page_size: "500",
+      });
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      const root = await semgrepGet(path);
+      const findings = (root as { findings?: unknown[] } | null)?.findings;
+      return matchesResult(findings, filterSemgrepFindings, p);
+    },
+  );
+}

package/connectors/sentry/src/server.ts

@@ -1,66 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-
-import {
-  createRegisterSimpleTool,
-  createZodToolRegistrar,
-  mcpJsonResult as jsonResult,
-} from "../../../shared/mcp-tool-kit.ts";
-
-function apiRoot(): string {
-  const u = process.env["SENTRY_URL"]?.trim() || "https://sentry.io";
-  return `${u.replace(/\/$/, "")}/api/0`;
-}
-
-function org(): string {
-  const o = process.env["SENTRY_ORG_SLUG"]?.trim();
-  if (o === undefined || o === "") {
-    throw new Error("SENTRY_ORG_SLUG is not set");
-  }
-  return o;
-}
-
-function headers(): Record<string, string> {
-  const t = process.env["SENTRY_AUTH_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("SENTRY_AUTH_TOKEN is not set");
-  }
-  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
-}
-
-async function sentryGet(path: string): Promise<unknown> {
-  const res = await fetch(`${apiRoot()}${path}`, { headers: headers() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Sentry ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
+import { registerSentryTools } from "./tools.ts";
 
 const mcp = new McpServer({ name: "nimbus-sentry", version: "0.1.0" });
-const reg = createZodToolRegistrar(createRegisterSimpleTool(mcp));
-
-reg(
-  "sentry_issue_list",
-  "List unresolved issues for a project.",
-  z.object({ projectSlug: z.string().min(1), limit: z.number().int().min(1).max(100).optional() }),
-  async (p) => {
-    const lim = p.limit ?? 20;
-    return jsonResult(
-      await sentryGet(
-        `/projects/${org()}/${p.projectSlug}/issues/?query=is:unresolved&limit=${String(lim)}`,
-      ),
-    );
-  },
-);
 
-reg(
-  "sentry_release_list",
-  "List releases for a project.",
-  z.object({ projectSlug: z.string().min(1) }),
-  async (p) => jsonResult(await sentryGet(`/projects/${org()}/${p.projectSlug}/releases/`)),
-);
+registerSentryTools(mcp);
 
 const transport = new StdioServerTransport();
 await mcp.connect(transport);

package/connectors/sentry/src/tools.ts

@@ -0,0 +1,53 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders, requiredEnv } from "../../../shared/env-json-api.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+
+function apiRoot(): string {
+  const u = process.env["SENTRY_URL"]?.trim() || "https://sentry.io";
+  return `${u.replace(/\/$/, "")}/api/0`;
+}
+
+function org(): string {
+  return requiredEnv("SENTRY_ORG_SLUG");
+}
+
+const sentryGet = createJsonGetter({
+  base: apiRoot,
+  label: "Sentry",
+  headers: envAuthHeaders({ env: "SENTRY_AUTH_TOKEN" }),
+});
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const SENTRY_TOOL_NAMES = ["sentry_issue_list", "sentry_release_list"] as const;
+
+export function registerSentryTools(server: { tool: (...args: never) => unknown }): void {
+  const reg = createZodToolRegistrar(createRegisterSimpleTool(server));
+
+  reg(
+    "sentry_issue_list",
+    "List unresolved issues for a project.",
+    z.object({
+      projectSlug: z.string().min(1),
+      limit: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const lim = p.limit ?? 20;
+      return jsonResult(
+        await sentryGet(
+          `/projects/${org()}/${p.projectSlug}/issues/?query=is:unresolved&limit=${String(lim)}`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "sentry_release_list",
+    "List releases for a project.",
+    z.object({ projectSlug: z.string().min(1) }),
+    async (p) => jsonResult(await sentryGet(`/projects/${org()}/${p.projectSlug}/releases/`)),
+  );
+}

package/connectors/slack/src/server.ts

@@ -1,360 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-
-import {
-  createRegisterSimpleTool,
-  createZodToolRegistrar,
-  mcpJsonResult as jsonResult,
-  type McpListResult,
-  putOptionalBoolean,
-  putOptionalNonEmptyString,
-  requireProcessEnv,
-} from "../../../shared/mcp-tool-kit.ts";
-
-type SlackApiRecord = Record<string, unknown>;
-
-async function slackApi(
-  token: string,
-  method: string,
-  body: Record<string, unknown>,
-): Promise<{ ok: boolean; json: SlackApiRecord; text: string }> {
-  const res = await fetch(`https://slack.com/api/${method}`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json; charset=utf-8",
-    },
-    body: JSON.stringify(body),
-  });
-  const text = await res.text();
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(text) as unknown;
-  } catch {
-    return { ok: false, json: {}, text };
-  }
-  const json =
-    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
-      ? (parsed as SlackApiRecord)
-      : {};
-  const okField = json["ok"];
-  return { ok: okField === true && res.ok, json, text };
-}
-
-async function slackInvokeJsonWithToken(
-  token: string,
-  method: string,
-  body: Record<string, unknown>,
-  errorLabel: string,
-): Promise<McpListResult> {
-  const res = await slackApi(token, method, body);
-  if (!res.ok) {
-    throw new Error(`${errorLabel}: ${res.text.slice(0, 400)}`);
-  }
-  return jsonResult(res.json);
-}
-
-async function slackInvokeJson(
-  method: string,
-  body: Record<string, unknown>,
-  errorLabel: string,
-): Promise<McpListResult> {
-  return slackInvokeJsonWithToken(
-    requireProcessEnv("SLACK_USER_ACCESS_TOKEN"),
-    method,
-    body,
-    errorLabel,
-  );
-}
-
-const slackConversationsHistorySchema = z.object({
-  channel: z.string().min(1),
-  limit: z.number().int().min(1).max(200).optional(),
-  cursor: z.string().optional(),
-  oldest: z.string().optional(),
-  inclusive: z.boolean().optional(),
-});
-
-type SlackConversationsHistoryParsed = z.infer<typeof slackConversationsHistorySchema>;
-
-function buildConversationsHistoryBody(
-  parsed: SlackConversationsHistoryParsed,
-): Record<string, unknown> {
-  const body: Record<string, unknown> = {
-    channel: parsed.channel,
-    limit: parsed.limit ?? 50,
-  };
-  putOptionalNonEmptyString(body, "cursor", parsed.cursor);
-  putOptionalNonEmptyString(body, "oldest", parsed.oldest);
-  putOptionalBoolean(body, "inclusive", parsed.inclusive);
-  return body;
-}
+import { registerSlackTools } from "./tools.ts";
 
 const server = new McpServer({ name: "nimbus-slack", version: "0.1.0" });
 
-const registerSimpleTool = createRegisterSimpleTool(server);
-
-import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
-
-const reg = createZodToolRegistrar(registerSimpleTool);
-
-/**
- * Every MUTATING slack tool goes through here. Outside the gateway this adds the
- * consent gate, the write-scope allow-list, the mutation budget and the audit record; inside
- * the gateway it is a pass-through, because executor.ts (I2) is the gate there.
- */
-const registerWriteTool = createWriteToolRegistrar(server, {
-  connector: "slack",
-  scopeEnv: "NIMBUS_MCP_SLACK_WRITE_SCOPE",
-  scopeKinds: ["channel"],
-});
-
-const slackChannelListSchema = z.object({
-  types: z.string().optional(),
-  limit: z.number().int().min(1).max(200).optional(),
-  cursor: z.string().optional(),
-});
-
-reg(
-  "slack_channel_list",
-  "List channels the user is a member of (public, private, mpim, im).",
-  slackChannelListSchema,
-  async (parsed) => {
-    const body: Record<string, unknown> = {
-      types: parsed.types ?? "public_channel,private_channel,mpim,im",
-      limit: parsed.limit ?? 200,
-      exclude_archived: true,
-    };
-    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
-    return slackInvokeJson("conversations.list", body, "Slack conversations.list");
-  },
-);
-
-reg(
-  "slack_channel_history",
-  "Fetch message history for a channel, DM, or mpim.",
-  slackConversationsHistorySchema,
-  async (parsed) =>
-    slackInvokeJson(
-      "conversations.history",
-      buildConversationsHistoryBody(parsed),
-      "Slack conversations.history",
-    ),
-);
-
-const slackThreadRepliesSchema = z.object({
-  channel: z.string().min(1),
-  ts: z.string().min(1),
-  limit: z.number().int().min(1).max(200).optional(),
-  cursor: z.string().optional(),
-});
-
-reg(
-  "slack_thread_replies",
-  "Fetch replies in a thread (channel + thread parent ts).",
-  slackThreadRepliesSchema,
-  async (parsed) => {
-    const body: Record<string, unknown> = {
-      channel: parsed.channel,
-      ts: parsed.ts,
-      limit: parsed.limit ?? 50,
-    };
-    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
-    return slackInvokeJson("conversations.replies", body, "Slack conversations.replies");
-  },
-);
-
-const slackDmListSchema = z.object({
-  limit: z.number().int().min(1).max(200).optional(),
-  cursor: z.string().optional(),
-});
-
-reg(
-  "slack_dm_list",
-  "List direct message conversations (im + mpim).",
-  slackDmListSchema,
-  async (parsed) => {
-    const body: Record<string, unknown> = {
-      types: "im,mpim",
-      limit: parsed.limit ?? 200,
-      exclude_archived: true,
-    };
-    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
-    return slackInvokeJson("conversations.list", body, "Slack dm list");
-  },
-);
-
-reg(
-  "slack_dm_history",
-  "Fetch DM / mpim history (same as channel history; convenience alias).",
-  slackConversationsHistorySchema,
-  async (parsed) =>
-    slackInvokeJson(
-      "conversations.history",
-      buildConversationsHistoryBody(parsed),
-      "Slack dm history",
-    ),
-);
-
-const slackUserListSchema = z.object({
-  limit: z.number().int().min(1).max(200).optional(),
-  cursor: z.string().optional(),
-});
-
-reg(
-  "slack_user_list",
-  "List users in the workspace (paginated).",
-  slackUserListSchema,
-  async (parsed) => {
-    const body: Record<string, unknown> = { limit: parsed.limit ?? 100 };
-    putOptionalNonEmptyString(body, "cursor", parsed.cursor);
-    return slackInvokeJson("users.list", body, "Slack users.list");
-  },
-);
-
-const slackUserGetSchema = z.object({ user: z.string().min(1) });
-
-reg("slack_user_get", "Get a single user profile by ID.", slackUserGetSchema, async (parsed) =>
-  slackInvokeJson("users.info", { user: parsed.user }, "Slack users.info"),
-);
-
-const slackSearchSchema = z.object({
-  query: z.string().min(1),
-  count: z.number().int().min(1).max(100).optional(),
-  page: z.number().int().min(1).optional(),
-  sort: z.enum(["timestamp", "score"]).optional(),
-  sort_dir: z.enum(["asc", "desc"]).optional(),
-});
-
-reg("slack_search", "Search messages (workspace search).", slackSearchSchema, async (parsed) => {
-  const body: Record<string, unknown> = {
-    query: parsed.query,
-    count: parsed.count ?? 20,
-    page: parsed.page ?? 1,
-  };
-  if (parsed.sort !== undefined) {
-    body["sort"] = parsed.sort;
-  }
-  if (parsed.sort_dir !== undefined) {
-    body["sort_dir"] = parsed.sort_dir;
-  }
-  return slackInvokeJson("search.messages", body, "Slack search.messages");
-});
-
-const slackMessagePostSchema = z.object({
-  channel: z.string().min(1),
-  text: z.string().min(1),
-  thread_ts: z.string().optional(),
-});
-
-registerWriteTool(
-  "slack_message_post",
-  {
-    mutates: "slack.message.post",
-    recoverable: true,
-    scopeTargetOf: (p) => ({ kind: "channel", value: p.channel }),
-  },
-  "Post a message to a channel.",
-  slackMessagePostSchema,
-  async (parsed) => {
-    const body: Record<string, unknown> = {
-      channel: parsed.channel,
-      text: parsed.text,
-    };
-    putOptionalNonEmptyString(body, "thread_ts", parsed.thread_ts);
-    return slackInvokeJson("chat.postMessage", body, "Slack chat.postMessage");
-  },
-);
-
-const slackMessagePostDmSchema = z.object({
-  user_ids: z.string().min(1),
-  text: z.string().min(1),
-});
-
-reg(
-  "slack_message_post_dm",
-  "Open or find a DM with user id(s) and send a message (requires HITL slack.message.post).",
-  slackMessagePostDmSchema,
-  async (parsed) => {
-    const token = requireProcessEnv("SLACK_USER_ACCESS_TOKEN");
-    const open = await slackApi(token, "conversations.open", {
-      users: parsed.user_ids,
-      return_im: true,
-    });
-    if (!open.ok) {
-      throw new Error(`Slack conversations.open: ${open.text.slice(0, 400)}`);
-    }
-    const ch = open.json["channel"];
-    const chRec =
-      ch !== null && typeof ch === "object" && !Array.isArray(ch)
-        ? (ch as SlackApiRecord)
-        : undefined;
-    const channelId = chRec !== undefined && typeof chRec["id"] === "string" ? chRec["id"] : "";
-    if (channelId === "") {
-      throw new Error("Slack conversations.open: missing channel id");
-    }
-    const post = await slackApi(token, "chat.postMessage", {
-      channel: channelId,
-      text: parsed.text,
-    });
-    if (!post.ok) {
-      throw new Error(`Slack chat.postMessage (dm): ${post.text.slice(0, 400)}`);
-    }
-    return jsonResult({ open: open.json, post: post.json });
-  },
-);
-
-// --- ChatOps operational tools (Slice 5) -------------------------------------------------------
-// These use the bot/app tokens (xoxb-/xapp-), distinct from the user token the read tools use.
-// Only `chatops/reply-dispatcher.ts` + `chatops/transport/` reference `slack_chat_post` (static D17).
-
-const slackUserInfoSchema = z.object({ user: z.string().min(1) });
-reg(
-  "slack_user_info",
-  "Fetch a Slack user's profile (incl. email) by user id (ChatOps identity mapping; bot token).",
-  slackUserInfoSchema,
-  async (parsed) =>
-    slackInvokeJsonWithToken(
-      requireProcessEnv("SLACK_BOT_TOKEN"),
-      "users.info",
-      { user: parsed.user },
-      "Slack users.info",
-    ),
-);
-
-const slackChatPostSchema = z.object({ channel: z.string().min(1), text: z.string().min(1) });
-registerWriteTool(
-  "slack_chat_post",
-  {
-    mutates: "slack.chat.post",
-    recoverable: true,
-    scopeTargetOf: (p) => ({ kind: "channel", value: p.channel }),
-  },
-  "Post an operational bot message to a channel (ChatOps reply surface; bot token).",
-  slackChatPostSchema,
-  async (parsed) =>
-    slackInvokeJsonWithToken(
-      requireProcessEnv("SLACK_BOT_TOKEN"),
-      "chat.postMessage",
-      { channel: parsed.channel, text: parsed.text },
-      "Slack chat.postMessage",
-    ),
-);
-
-const slackSocketOpenSchema = z.object({});
-reg(
-  "slack_socket_open",
-  "Open a Slack Socket Mode connection and return the short-lived wss:// URL (app-level token).",
-  slackSocketOpenSchema,
-  async () =>
-    slackInvokeJsonWithToken(
-      requireProcessEnv("SLACK_APP_TOKEN"), // xapp-… (Socket Mode app-level token)
-      "apps.connections.open",
-      {},
-      "Slack apps.connections.open",
-    ),
-);
+registerSlackTools(server);
 
 const transport = new StdioServerTransport();
 await server.connect(transport);