@rad-security/mcp-server 0.0.26 → 0.0.30-2.g4ae51ae

package/README.md

@@ -1,5 +1,7 @@
 # RAD Security MCP Server
 
+[![npm version](https://img.shields.io/npm/v/@rad-security/mcp-server)](https://npmjs.com/package/@rad-security/mcp-server)
+
 A Model Context Protocol (MCP) server for RAD Security, providing AI-powered security insights for Kubernetes and cloud environments.
 
 <a href="https://glama.ai/mcp/servers/@rad-security/mcp-server">
@@ -46,13 +48,10 @@ Available toolkits:
 - `clusters` - Kubernetes cluster operations
 - `identities` - Identity management operations
 - `audit` - Audit log operations
-- `cloud_inventory` - Cloud resource inventory
 - `images` - Container image operations
 - `kubeobject` - Kubernetes resource operations
 - `misconfigs` - Misconfiguration detection
 - `runtime` - Runtime analysis operations
-- `runtime_network` - Network traffic analysis
-- `threats` - Threat vector operations
 - `findings` - Security findings operations
 - `cves` - CVE database operations
 - `inbox` - Inbox item operations
@@ -72,8 +71,8 @@ INCLUDE_TOOLKITS="containers,images"
 # Exclude workflow toolkit (enable all others)
 EXCLUDE_TOOLKITS="workflows"
 
-# Exclude runtime and threat toolkits
-EXCLUDE_TOOLKITS="runtime,threats"
+# Exclude runtime toolkit
+EXCLUDE_TOOLKITS="runtime"
 ```
 
 Note: If `INCLUDE_TOOLKITS` is set, `EXCLUDE_TOOLKITS` is ignored.
@@ -220,10 +219,6 @@ docker run \
   - List Kubernetes resources*
   - List Kubernetes resource misconfiguration policies*
 
-- Threat Vector
-  - List threat vectors*
-  - Get details of a specific threat vector*
-
 - CVEs
   - List CVEs
   - Get details of a specific CVE
@@ -257,4 +252,4 @@ npm run build
 
 ## License
 
-MIT License - see the [LICENSE](LICENSE) file for details
+MIT License - see the [LICENSE](LICENSE) file for details

package/dist/index.js

@@ -13,15 +13,13 @@ import express from "express";
 import { RadSecurityClient } from "./client.js";
 import * as containers from "./operations/containers.js";
 import * as audit from "./operations/audit.js";
-import * as cloudInventory from "./operations/cloud-inventory.js";
 import * as clusters from "./operations/clusters.js";
 import * as identities from "./operations/identities.js";
 import * as images from "./operations/images.js";
+import * as cveDispositions from "./operations/cve-dispositions.js";
 import * as kubeobject from "./operations/kubeobject.js";
 import * as misconfigs from "./operations/misconfigs.js";
 import * as runtime from "./operations/runtime.js";
-import * as runtimeNetwork from "./operations/runtime_network.js";
-import * as threats from "./operations/threats.js";
 import * as findings from "./operations/findings.js";
 import * as cves from "./operations/cves.js";
 import * as inbox from "./operations/inbox.js";
@@ -29,8 +27,8 @@ import * as workflows from "./operations/workflows.js";
 import * as customWorkflows from "./operations/custom-workflows.js";
 import * as knowledgeBase from "./operations/knowledge-base.js";
 import * as radql from "./operations/radql.js";
-import * as cloudCompliance from "./operations/cloud-compliance.js";
 import * as dashboards from "./operations/dashboards.js";
+import * as integrations from "./operations/integrations.js";
 import { VERSION } from "./version.js";
 import { logger } from "./logger.js";
 // Parse toolkit filters from environment variables
@@ -139,66 +137,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Cloud Inventory tools
-            ...(isToolkitEnabled("cloud_inventory", toolkitFilters)
-                ? [
-                    {
-                        name: "list_cloud_resources",
-                        description: "List cloud resources for a specific provider with optional filtering",
-                        inputSchema: zodToJsonSchema(cloudInventory.ListCloudResourcesSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_details",
-                        description: "Get detailed information about a specific cloud resource",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceDetailsSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_facets",
-                        description: "Get available facets for filtering cloud resources from a provider",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceFacetsSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_facet_value",
-                        description: "Get values for a specific facet from a cloud provider",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceFacetValuesSchema),
-                    },
-                ]
-                : []),
-            // Cloud Compliance tools
-            ...(isToolkitEnabled("cloud_compliance", toolkitFilters)
-                ? [
-                    {
-                        name: "list_compliance_frameworks",
-                        description: "List all compliance frameworks available for cloud resources (e.g., CIS, SOC2, PCI-DSS)",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListComplianceFrameworksSchema),
-                    },
-                    {
-                        name: "list_framework_requirements",
-                        description: "List all requirements for a specific compliance framework",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListFrameworkRequirementsSchema),
-                    },
-                    {
-                        name: "list_requirement_controls",
-                        description: "List controls associated with a specific requirement within a compliance framework",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListRequirementControlsSchema),
-                    },
-                    {
-                        name: "list_compliance_controls",
-                        description: "List all compliance control summaries for the account",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListComplianceControlsSchema),
-                    },
-                    {
-                        name: "get_compliance_control",
-                        description: "Get detailed information about a specific compliance control",
-                        inputSchema: zodToJsonSchema(cloudCompliance.GetComplianceControlSchema),
-                    },
-                    {
-                        name: "list_control_resources",
-                        description: "List cloud resources associated with a specific compliance control",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListControlResourcesSchema),
-                    },
-                ]
-                : []),
             // Image tools
             ...(isToolkitEnabled("images", toolkitFilters)
                 ? [
@@ -222,6 +160,21 @@ async function newServer() {
                         description: "Get the SBOM of a container image",
                         inputSchema: zodToJsonSchema(images.GetImageSBOMSchema),
                     },
+                    {
+                        name: "ignore_cve",
+                        description: "Ignore a CVE for this account so it no longer appears in vulnerability reporting. Use for confirmed false positives, accepted risks, or won't-fix decisions. Do NOT use for remediated CVEs — those drop off automatically on the next scan.",
+                        inputSchema: zodToJsonSchema(cveDispositions.ignoreCveSchema),
+                    },
+                    {
+                        name: "unignore_cve",
+                        description: "Remove an account-wide CVE disposition, restoring the CVE to vulnerability reporting.",
+                        inputSchema: zodToJsonSchema(cveDispositions.unignoreCveSchema),
+                    },
+                    {
+                        name: "list_cve_dispositions",
+                        description: "List active CVE dispositions (ignored / false positive) for this account, with reason and author.",
+                        inputSchema: zodToJsonSchema(cveDispositions.listCveDispositionsSchema),
+                    },
                 ]
                 : []),
             // Kubernetes Object tools
@@ -279,36 +232,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Runtime Network tools
-            ...(isToolkitEnabled("runtime_network", toolkitFilters)
-                ? [
-                    {
-                        name: "list_http_requests",
-                        description: "List HTTP requests insights with optional filtering by method, path, source and destination workloads, and PII detection",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listHttpRequestsSchema),
-                    },
-                    {
-                        name: "list_network_connections",
-                        description: "List network connections with optional filtering",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listNetworkConnectionsSchema),
-                    },
-                    {
-                        name: "list_network_connection_srcs",
-                        description: "List network connection sources with optional filtering by source and destination workloads",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listNetworkConnectionSourcesSchema),
-                    },
-                ]
-                : []),
-            // Threat Vectors tools
-            ...(isToolkitEnabled("threats", toolkitFilters)
-                ? [
-                    {
-                        name: "list_threat_vectors",
-                        description: "List threat vectors",
-                        inputSchema: zodToJsonSchema(threats.listThreatVectorsSchema),
-                    },
-                ]
-                : []),
             // Findings tools
             ...(isToolkitEnabled("findings", toolkitFilters)
                 ? [
@@ -463,7 +386,7 @@ async function newServer() {
                 ? [
                     {
                         name: "radql_list_data_types",
-                        description: "List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'vulnerabilities', etc. with descriptions.",
+                        description: "List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'cloud_resources', 'cloud_benchmarks', 'cloud_benchmark_summaries', etc. with descriptions.",
                         inputSchema: zodToJsonSchema(radql.RadQLListDataTypesSchema),
                     },
                     {
@@ -487,7 +410,7 @@ containers: name, image_name, image_repo, owner_kind, cluster_id, created_at
   Example: image_name:*nginx* AND owner_kind:Pod
 
 finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp
-  Types: k8s_misconfiguration, k8s_audit_logs_anomaly, threat_vector
+  Types: k8s_misconfiguration, k8s_audit_logs_anomaly
   Example: type:k8s_misconfiguration AND severity:critical
 
 inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at
@@ -496,6 +419,16 @@ inbox_items: severity (High|Medium|Low), type, title, archived, false_positive,
 kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at
   Example: kind:Deployment AND namespace:production
 
+CLOUD RESOURCES & COMPLIANCE (use these RadQL data types instead of dedicated cloud tools):
+cloud_resources: cloud_provider, cloud_account_id, resource_type, resource_name, resource_id, resource_json, last_seen_at
+  Example: cloud_provider:aws AND resource_type:aws_iam_policy
+
+cloud_benchmark_summaries: cloud_provider, cloud_account_id, benchmark_id, title, description, fail_count, pass_count, total_count, last_seen_at
+  Example: cloud_provider:aws AND fail_count>0
+
+cloud_benchmarks: cloud_provider, cloud_account_id, benchmark_id, control_id, control_title, severity, status, reason, resource_id, last_seen_at
+  Example: status:fail AND benchmark_id:*cis*
+
 CRITICAL QUOTING RULES:
 MUST quote when value contains:
   - Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01)
@@ -561,6 +494,16 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                     },
                 ]
                 : []),
+            // Integrations tools
+            ...(isToolkitEnabled("integrations", toolkitFilters)
+                ? [
+                    {
+                        name: "list_external_integrations",
+                        description: "List external integrations configured for the tenant (e.g., Slack, AWS CloudTrail, Okta). Returns integration details including capabilities, configuration, mcp support and sync status.",
+                        inputSchema: zodToJsonSchema(integrations.ListExternalIntegrationsSchema),
+                    },
+                ]
+                : []),
         ];
         return {
             tools: allTools,
@@ -642,128 +585,63 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Cloud Inventory tools
-                case "list_cloud_resources": {
-                    const args = cloudInventory.ListCloudResourcesSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.listCloudResources(client, args.provider, args.filters, args.offset, args.limit, args.q);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_details": {
-                    const args = cloudInventory.GetCloudResourceDetailsSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceDetails(client, args.provider, args.resource_type, args.resource_id);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_facets": {
-                    const args = cloudInventory.GetCloudResourceFacetsSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceFacets(client, args.provider);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_facet_value": {
-                    const args = cloudInventory.GetCloudResourceFacetValuesSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceFacetValues(client, args.provider, args.facet_id);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                // Cloud Compliance tools
-                case "list_compliance_frameworks": {
-                    const args = cloudCompliance.ListComplianceFrameworksSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listComplianceFrameworks(client, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_framework_requirements": {
-                    const args = cloudCompliance.ListFrameworkRequirementsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listFrameworkRequirements(client, args.framework_name, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_requirement_controls": {
-                    const args = cloudCompliance.ListRequirementControlsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listRequirementControls(client, args.framework_name, args.requirement_id, args.datasource_ids, args.page, args.page_size);
+                // Image tools
+                case "list_images": {
+                    const args = images.ListImagesSchema.parse(request.params.arguments);
+                    const response = await images.listImages(client, args.limit, args.offset, args.sort, args.filters, args.q);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "list_compliance_controls": {
-                    const args = cloudCompliance.ListComplianceControlsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listComplianceControls(client, args.status, args.providers, args.page, args.page_size);
+                case "list_image_vulnerabilities": {
+                    const args = images.ListImageVulnerabilitiesSchema.parse(request.params.arguments);
+                    const response = await images.listImageVulnerabilities(client, args.digest, args.severities, args.page, args.page_size);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "get_compliance_control": {
-                    const args = cloudCompliance.GetComplianceControlSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.getComplianceControl(client, args.control_name, args.datasource_ids);
+                case "get_top_vulnerable_images": {
+                    const response = await images.getTopVulnerableImages(client);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "list_control_resources": {
-                    const args = cloudCompliance.ListControlResourcesSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listControlResources(client, args.control_name, args.datasource_ids, args.page, args.page_size);
+                case "get_image_sbom": {
+                    const args = images.GetImageSBOMSchema.parse(request.params.arguments);
+                    const response = await images.getImageSBOM(client, args.digest);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                // Image tools
-                case "list_images": {
-                    const args = images.ListImagesSchema.parse(request.params.arguments);
-                    const response = await images.listImages(client, args.limit, args.offset, args.sort, args.filters, args.q);
+                case "ignore_cve": {
+                    const args = cveDispositions.ignoreCveSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.ignoreCve(client, args.cve_name, args.disposition, args.reason);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "list_image_vulnerabilities": {
-                    const args = images.ListImageVulnerabilitiesSchema.parse(request.params.arguments);
-                    const response = await images.listImageVulnerabilities(client, args.digest, args.severities, args.page, args.page_size);
+                case "unignore_cve": {
+                    const args = cveDispositions.unignoreCveSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.unignoreCve(client, args.cve_name);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "get_top_vulnerable_images": {
-                    const response = await images.getTopVulnerableImages(client);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_image_sbom": {
-                    const args = images.GetImageSBOMSchema.parse(request.params.arguments);
-                    const response = await images.getImageSBOM(client, args.digest);
+                case "list_cve_dispositions": {
+                    cveDispositions.listCveDispositionsSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.listCveDispositions(client);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
@@ -844,44 +722,6 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Runtime Network tools
-                case "list_http_requests": {
-                    const args = runtimeNetwork.listHttpRequestsSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listHttpRequests(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_network_connections": {
-                    const args = runtimeNetwork.listNetworkConnectionsSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listNetworkConnections(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_network_connection_srcs": {
-                    const args = runtimeNetwork.listNetworkConnectionSourcesSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listNetworkConnectionSources(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                // Threat Vectors tools
-                case "list_threat_vectors": {
-                    const args = threats.listThreatVectorsSchema.parse(request.params.arguments);
-                    const response = await threats.listThreatVectors(client, args.clustersIds, args.namespaces, args.resource_uid, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
                 // Findings tools
                 case "list_security_findings": {
                     const args = findings.listFindingsSchema.parse(request.params.arguments);
@@ -1212,6 +1052,16 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
+                // Integrations tools
+                case "list_external_integrations": {
+                    const args = integrations.ListExternalIntegrationsSchema.parse(request.params.arguments);
+                    const response = await integrations.listExternalIntegrations(client, args.offset, args.limit);
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response, null, 2) },
+                        ],
+                    };
+                }
                 default:
                     throw new Error(`Unknown tool: ${toolName}`);
             }