@rad-security/mcp-server 0.0.27 → 0.0.31-2.g635c655

package/dist/index.js

@@ -13,23 +13,17 @@ import express from "express";
 import { RadSecurityClient } from "./client.js";
 import * as containers from "./operations/containers.js";
 import * as audit from "./operations/audit.js";
-import * as cloudInventory from "./operations/cloud-inventory.js";
 import * as clusters from "./operations/clusters.js";
-import * as identities from "./operations/identities.js";
 import * as images from "./operations/images.js";
+import * as cveDispositions from "./operations/cve-dispositions.js";
 import * as kubeobject from "./operations/kubeobject.js";
-import * as misconfigs from "./operations/misconfigs.js";
 import * as runtime from "./operations/runtime.js";
-import * as runtimeNetwork from "./operations/runtime_network.js";
-import * as threats from "./operations/threats.js";
 import * as findings from "./operations/findings.js";
-import * as cves from "./operations/cves.js";
 import * as inbox from "./operations/inbox.js";
 import * as workflows from "./operations/workflows.js";
 import * as customWorkflows from "./operations/custom-workflows.js";
 import * as knowledgeBase from "./operations/knowledge-base.js";
 import * as radql from "./operations/radql.js";
-import * as cloudCompliance from "./operations/cloud-compliance.js";
 import * as dashboards from "./operations/dashboards.js";
 import * as integrations from "./operations/integrations.js";
 import { VERSION } from "./version.js";
@@ -115,21 +109,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Identity tools
-            ...(isToolkitEnabled("identities", toolkitFilters)
-                ? [
-                    {
-                        name: "list_identities",
-                        description: "Get list of identities for a specific Kubernetes cluster",
-                        inputSchema: zodToJsonSchema(identities.ListIdentitiesSchema),
-                    },
-                    {
-                        name: "get_identity_details",
-                        description: "Get detailed information about a specific identity in a Kubernetes cluster",
-                        inputSchema: zodToJsonSchema(identities.GetIdentityDetailsSchema),
-                    },
-                ]
-                : []),
             // Audit tools
             ...(isToolkitEnabled("audit", toolkitFilters)
                 ? [
@@ -140,66 +119,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Cloud Inventory tools
-            ...(isToolkitEnabled("cloud_inventory", toolkitFilters)
-                ? [
-                    {
-                        name: "list_cloud_resources",
-                        description: "List cloud resources for a specific provider with optional filtering",
-                        inputSchema: zodToJsonSchema(cloudInventory.ListCloudResourcesSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_details",
-                        description: "Get detailed information about a specific cloud resource",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceDetailsSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_facets",
-                        description: "Get available facets for filtering cloud resources from a provider",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceFacetsSchema),
-                    },
-                    {
-                        name: "get_cloud_resource_facet_value",
-                        description: "Get values for a specific facet from a cloud provider",
-                        inputSchema: zodToJsonSchema(cloudInventory.GetCloudResourceFacetValuesSchema),
-                    },
-                ]
-                : []),
-            // Cloud Compliance tools
-            ...(isToolkitEnabled("cloud_compliance", toolkitFilters)
-                ? [
-                    {
-                        name: "list_compliance_frameworks",
-                        description: "List all compliance frameworks available for cloud resources (e.g., CIS, SOC2, PCI-DSS)",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListComplianceFrameworksSchema),
-                    },
-                    {
-                        name: "list_framework_requirements",
-                        description: "List all requirements for a specific compliance framework",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListFrameworkRequirementsSchema),
-                    },
-                    {
-                        name: "list_requirement_controls",
-                        description: "List controls associated with a specific requirement within a compliance framework",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListRequirementControlsSchema),
-                    },
-                    {
-                        name: "list_compliance_controls",
-                        description: "List all compliance control summaries for the account",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListComplianceControlsSchema),
-                    },
-                    {
-                        name: "get_compliance_control",
-                        description: "Get detailed information about a specific compliance control",
-                        inputSchema: zodToJsonSchema(cloudCompliance.GetComplianceControlSchema),
-                    },
-                    {
-                        name: "list_control_resources",
-                        description: "List cloud resources associated with a specific compliance control",
-                        inputSchema: zodToJsonSchema(cloudCompliance.ListControlResourcesSchema),
-                    },
-                ]
-                : []),
             // Image tools
             ...(isToolkitEnabled("images", toolkitFilters)
                 ? [
@@ -223,6 +142,21 @@ async function newServer() {
                         description: "Get the SBOM of a container image",
                         inputSchema: zodToJsonSchema(images.GetImageSBOMSchema),
                     },
+                    {
+                        name: "ignore_cve",
+                        description: "Ignore a CVE for this account so it no longer appears in vulnerability reporting. Use for confirmed false positives, accepted risks, or won't-fix decisions. Do NOT use for remediated CVEs — those drop off automatically on the next scan.",
+                        inputSchema: zodToJsonSchema(cveDispositions.ignoreCveSchema),
+                    },
+                    {
+                        name: "unignore_cve",
+                        description: "Remove an account-wide CVE disposition, restoring the CVE to vulnerability reporting.",
+                        inputSchema: zodToJsonSchema(cveDispositions.unignoreCveSchema),
+                    },
+                    {
+                        name: "list_cve_dispositions",
+                        description: "List active CVE dispositions (ignored / false positive) for this account, with reason and author.",
+                        inputSchema: zodToJsonSchema(cveDispositions.listCveDispositionsSchema),
+                    },
                 ]
                 : []),
             // Kubernetes Object tools
@@ -240,26 +174,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Manifest Misconfigurations tools
-            ...(isToolkitEnabled("misconfigs", toolkitFilters)
-                ? [
-                    {
-                        name: "list_k8s_resource_misconfigs",
-                        description: "Get manifest misconfigurations for a Kubernetes resource",
-                        inputSchema: zodToJsonSchema(misconfigs.ListKubernetesResourceMisconfigurationsSchema),
-                    },
-                    {
-                        name: "get_k8s_resource_misconfig",
-                        description: "Get detailed information about a specific Kubernetes resource misconfiguration",
-                        inputSchema: zodToJsonSchema(misconfigs.GetKubernetesResourceMisconfigurationDetailsSchema),
-                    },
-                    {
-                        name: "list_k8s_resource_misconfig_policies",
-                        description: "List available misconfiguration policies used by RAD Security to detect Kubernetes resource misconfigurations",
-                        inputSchema: zodToJsonSchema(misconfigs.ListKubernetesResourceMisconfigurationPoliciesSchema),
-                    },
-                ]
-                : []),
             // Runtime tools
             ...(isToolkitEnabled("runtime", toolkitFilters)
                 ? [
@@ -280,36 +194,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // Runtime Network tools
-            ...(isToolkitEnabled("runtime_network", toolkitFilters)
-                ? [
-                    {
-                        name: "list_http_requests",
-                        description: "List HTTP requests insights with optional filtering by method, path, source and destination workloads, and PII detection",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listHttpRequestsSchema),
-                    },
-                    {
-                        name: "list_network_connections",
-                        description: "List network connections with optional filtering",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listNetworkConnectionsSchema),
-                    },
-                    {
-                        name: "list_network_connection_srcs",
-                        description: "List network connection sources with optional filtering by source and destination workloads",
-                        inputSchema: zodToJsonSchema(runtimeNetwork.listNetworkConnectionSourcesSchema),
-                    },
-                ]
-                : []),
-            // Threat Vectors tools
-            ...(isToolkitEnabled("threats", toolkitFilters)
-                ? [
-                    {
-                        name: "list_threat_vectors",
-                        description: "List threat vectors",
-                        inputSchema: zodToJsonSchema(threats.listThreatVectorsSchema),
-                    },
-                ]
-                : []),
             // Findings tools
             ...(isToolkitEnabled("findings", toolkitFilters)
                 ? [
@@ -325,40 +209,6 @@ async function newServer() {
                     },
                 ]
                 : []),
-            // CVE tools
-            ...(isToolkitEnabled("cves", toolkitFilters)
-                ? [
-                    {
-                        name: "list_cve_vendors",
-                        description: "Get a list of all vendors in the CVE database. Source: cve-search.org",
-                        inputSchema: zodToJsonSchema(z.object({})),
-                    },
-                    {
-                        name: "list_cve_products",
-                        description: "Get a list of all products associated with a vendor in the CVE database. Source: cve-search.org",
-                        inputSchema: zodToJsonSchema(z.object({
-                            vendor: z
-                                .string()
-                                .describe("Vendor name to list products for"),
-                        })),
-                    },
-                    {
-                        name: "search_cves",
-                        description: "Search CVEs by vendor and optionally product. Source: cve-search.org",
-                        inputSchema: zodToJsonSchema(cves.searchCvesSchema),
-                    },
-                    {
-                        name: "get_cve",
-                        description: "Get details for a specific CVE ID. Source: cve-search.org",
-                        inputSchema: zodToJsonSchema(cves.getCveSchema),
-                    },
-                    {
-                        name: "get_latest_30_cves",
-                        description: "Get the latest/newest 30 CVEs including CAPEC, CWE and CPE expansions. Source: cve-search.org",
-                        inputSchema: zodToJsonSchema(z.object({})),
-                    },
-                ]
-                : []),
             // Inbox tools
             ...(isToolkitEnabled("inbox", toolkitFilters)
                 ? [
@@ -464,7 +314,7 @@ async function newServer() {
                 ? [
                     {
                         name: "radql_list_data_types",
-                        description: "List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'vulnerabilities', etc. with descriptions.",
+                        description: "List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'cloud_resources', 'cloud_benchmarks', 'cloud_benchmark_summaries', etc. with descriptions.",
                         inputSchema: zodToJsonSchema(radql.RadQLListDataTypesSchema),
                     },
                     {
@@ -488,7 +338,7 @@ containers: name, image_name, image_repo, owner_kind, cluster_id, created_at
   Example: image_name:*nginx* AND owner_kind:Pod
 
 finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp
-  Types: k8s_misconfiguration, k8s_audit_logs_anomaly, threat_vector
+  Types: k8s_misconfiguration, k8s_audit_logs_anomaly
   Example: type:k8s_misconfiguration AND severity:critical
 
 inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at
@@ -497,6 +347,16 @@ inbox_items: severity (High|Medium|Low), type, title, archived, false_positive,
 kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at
   Example: kind:Deployment AND namespace:production
 
+CLOUD RESOURCES & COMPLIANCE (use these RadQL data types instead of dedicated cloud tools):
+cloud_resources: cloud_provider, cloud_account_id, resource_type, resource_name, resource_id, resource_json, last_seen_at
+  Example: cloud_provider:aws AND resource_type:aws_iam_policy
+
+cloud_benchmark_summaries: cloud_provider, cloud_account_id, benchmark_id, title, description, fail_count, pass_count, total_count, last_seen_at
+  Example: cloud_provider:aws AND fail_count>0
+
+cloud_benchmarks: cloud_provider, cloud_account_id, benchmark_id, control_id, control_title, severity, status, reason, resource_id, last_seen_at
+  Example: status:fail AND benchmark_id:*cis*
+
 CRITICAL QUOTING RULES:
 MUST quote when value contains:
   - Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01)
@@ -624,25 +484,6 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Identity tools
-                case "list_identities": {
-                    const args = identities.ListIdentitiesSchema.parse(request.params.arguments);
-                    const response = await identities.listIdentities(client, args.identity_types, args.cluster_ids, args.page, args.page_size, args.q);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_identity_details": {
-                    const args = identities.GetIdentityDetailsSchema.parse(request.params.arguments);
-                    const response = await identities.getIdentityDetails(client, args.identity_id);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
                 // Audit tools
                 case "who_shelled_into_pod": {
                     const args = audit.WhoShelledIntoPodSchema.parse(request.params.arguments);
@@ -653,98 +494,6 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Cloud Inventory tools
-                case "list_cloud_resources": {
-                    const args = cloudInventory.ListCloudResourcesSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.listCloudResources(client, args.provider, args.filters, args.offset, args.limit, args.q);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_details": {
-                    const args = cloudInventory.GetCloudResourceDetailsSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceDetails(client, args.provider, args.resource_type, args.resource_id);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_facets": {
-                    const args = cloudInventory.GetCloudResourceFacetsSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceFacets(client, args.provider);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cloud_resource_facet_value": {
-                    const args = cloudInventory.GetCloudResourceFacetValuesSchema.parse(request.params.arguments);
-                    const response = await cloudInventory.getCloudResourceFacetValues(client, args.provider, args.facet_id);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                // Cloud Compliance tools
-                case "list_compliance_frameworks": {
-                    const args = cloudCompliance.ListComplianceFrameworksSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listComplianceFrameworks(client, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_framework_requirements": {
-                    const args = cloudCompliance.ListFrameworkRequirementsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listFrameworkRequirements(client, args.framework_name, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_requirement_controls": {
-                    const args = cloudCompliance.ListRequirementControlsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listRequirementControls(client, args.framework_name, args.requirement_id, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_compliance_controls": {
-                    const args = cloudCompliance.ListComplianceControlsSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listComplianceControls(client, args.status, args.providers, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_compliance_control": {
-                    const args = cloudCompliance.GetComplianceControlSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.getComplianceControl(client, args.control_name, args.datasource_ids);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_control_resources": {
-                    const args = cloudCompliance.ListControlResourcesSchema.parse(request.params.arguments);
-                    const response = await cloudCompliance.listControlResources(client, args.control_name, args.datasource_ids, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
                 // Image tools
                 case "list_images": {
                     const args = images.ListImagesSchema.parse(request.params.arguments);
@@ -781,46 +530,46 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Kubernetes Objects tools
-                case "get_k8s_resource_details": {
-                    const args = kubeobject.GetKubernetesResourceDetailsSchema.parse(request.params.arguments);
-                    const response = await kubeobject.getKubernetesResourceDetails(client, args.cluster_id, args.resource_uid);
+                case "ignore_cve": {
+                    const args = cveDispositions.ignoreCveSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.ignoreCve(client, args.cve_name, args.disposition, args.reason);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "list_k8s_resources": {
-                    const args = kubeobject.ListKubernetesResourcesSchema.parse(request.params.arguments);
-                    const response = await kubeobject.listKubernetesResources(client, args.kinds, args.namespace, args.cluster_id, args.page, args.page_size);
+                case "unignore_cve": {
+                    const args = cveDispositions.unignoreCveSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.unignoreCve(client, args.cve_name);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                // Kubernetes Resource Misconfigurations tools
-                case "list_k8s_resource_misconfigs": {
-                    const args = misconfigs.ListKubernetesResourceMisconfigurationsSchema.parse(request.params.arguments);
-                    const response = await misconfigs.listKubernetesResourceMisconfigurations(client, args.resource_uid);
+                case "list_cve_dispositions": {
+                    cveDispositions.listCveDispositionsSchema.parse(request.params.arguments);
+                    const response = await cveDispositions.listCveDispositions(client);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "get_k8s_resource_misconfig": {
-                    const args = misconfigs.GetKubernetesResourceMisconfigurationDetailsSchema.parse(request.params.arguments);
-                    const response = await misconfigs.getKubernetesResourceMisconfigurationDetails(client, args.cluster_id, args.misconfig_id);
+                // Kubernetes Objects tools
+                case "get_k8s_resource_details": {
+                    const args = kubeobject.GetKubernetesResourceDetailsSchema.parse(request.params.arguments);
+                    const response = await kubeobject.getKubernetesResourceDetails(client, args.cluster_id, args.resource_uid);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
                         ],
                     };
                 }
-                case "list_k8s_resource_misconfig_policies": {
-                    const response = await misconfigs.listKubernetesResourceMisconfigurationPolicies();
+                case "list_k8s_resources": {
+                    const args = kubeobject.ListKubernetesResourcesSchema.parse(request.params.arguments);
+                    const response = await kubeobject.listKubernetesResources(client, args.kinds, args.namespace, args.cluster_id, args.page, args.page_size);
                     return {
                         content: [
                             { type: "text", text: JSON.stringify(response, null, 2) },
@@ -855,44 +604,6 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // Runtime Network tools
-                case "list_http_requests": {
-                    const args = runtimeNetwork.listHttpRequestsSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listHttpRequests(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_network_connections": {
-                    const args = runtimeNetwork.listNetworkConnectionsSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listNetworkConnections(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_network_connection_srcs": {
-                    const args = runtimeNetwork.listNetworkConnectionSourcesSchema.parse(request.params.arguments);
-                    const response = await runtimeNetwork.listNetworkConnectionSources(client, args);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                // Threat Vectors tools
-                case "list_threat_vectors": {
-                    const args = threats.listThreatVectorsSchema.parse(request.params.arguments);
-                    const response = await threats.listThreatVectors(client, args.clustersIds, args.namespaces, args.resource_uid, args.page, args.page_size);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
                 // Findings tools
                 case "list_security_findings": {
                     const args = findings.listFindingsSchema.parse(request.params.arguments);
@@ -918,54 +629,6 @@ For complete schema: call radql_get_type_metadata with target data_type`,
                         ],
                     };
                 }
-                // CVE tools
-                case "list_cve_vendors": {
-                    const response = await cves.listCveVendors();
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "list_cve_products": {
-                    const args = z
-                        .object({
-                        vendor: z.string(),
-                    })
-                        .parse(request.params.arguments);
-                    const response = await cves.listCveProducts(args.vendor);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "search_cves": {
-                    const args = cves.searchCvesSchema.parse(request.params.arguments);
-                    const response = await cves.searchCves(args.vendor, args.product);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_cve": {
-                    const args = cves.getCveSchema.parse(request.params.arguments);
-                    const response = await cves.getCve(args.cveId);
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
-                case "get_latest_30_cves": {
-                    const response = await cves.getLatest30Cves();
-                    return {
-                        content: [
-                            { type: "text", text: JSON.stringify(response, null, 2) },
-                        ],
-                    };
-                }
                 // Inbox tools
                 case "mark_inbox_item_as_false_positive": {
                     const args = inbox.MarkInboxItemAsFalsePositiveSchema.parse(request.params.arguments);