@securityreviewai/security-review-mcp 0.2.9 → 0.2.11

package/README.md

@@ -4,7 +4,7 @@ TypeScript MCP server for [SecurityReview.ai](https://securityreview.ai), publis
 
 - Pure Node runtime (no Python bootstrap)
 - Stdio MCP server compatible with Cursor, Windsurf, Claude Desktop, ChatGPT MCP, and other MCP clients
-- 53 tools for project/document/review/workflow/integration operations
+- 54 tools for project/document/review/workflow/integration operations
 - 8 built-in security-analysis prompts
 - 4 read-only MCP resources
 
@@ -108,7 +108,7 @@ Compatibility flags (no-op, retained for older configs):
 - `--python <path>`
 - `--force-install`
 
-## Tool Catalog (53)
+## Tool Catalog (54)
 
 ### Projects
 
@@ -130,6 +130,7 @@ Compatibility flags (no-op, retained for older configs):
 | `get_project_profile_security_control` | Get one security control by ID |
 | `list_profile_compliance_requirements` | List compliance requirements in project profile |
 | `get_profile_compliance_requirement` | Get one compliance requirement by ID |
+| `update_vibe_project_profile` | Push/update vibe profile data (architecture notes, tech categories, user groups, compliance requirements, language stacks, description) by project ID |
 
 ### Documents
 
@@ -232,7 +233,13 @@ Compatibility flags (no-op, retained for older configs):
 4. `start_workflow`
 5. `get_workflow_status`
 
-### 3) Bring in Jira/Confluence Context
+### 3) Populate a Project Profile from Vibe/AI Context
+
+1. `create_project` (or resolve with `find_project_by_name`)
+2. `update_vibe_project_profile` — supply any combination of `architecture_notes`, `tech_categories`, `user_groups`, `compliance_requirements`, `language_stacks`, and `description`
+3. `get_full_project_profile` — verify the updated profile
+
+### 4) Bring in Jira/Confluence Context
 
 1. `fetch_jira_issue` or `fetch_confluence_page`
 2. `link_external_document` or `fetch_and_link_to_srai`

package/dist/api/client.js

@@ -173,6 +173,11 @@ export class SraiApiClient {
     async getProjectProfileComplianceRequirement(projectId, requirementId) {
         return this.request("GET", `/api/projects/${projectId}/profile/compliance-requirements/${requirementId}`);
     }
+    async updateVibeProjectProfile(projectId, payload) {
+        return this.request("PATCH", `/api/projects/${projectId}/profile`, {
+            jsonBody: payload,
+        });
+    }
     async listDocuments(projectId) {
         return this.request("GET", `/api/projects/${projectId}/documents`);
     }

package/dist/tools/projectTools.js

@@ -101,4 +101,54 @@ export function registerProjectTools(server) {
             requirement_id: z.number().int(),
         },
     }, async ({ project_id, requirement_id }) => runTool(async () => getApiClient().getProjectProfileComplianceRequirement(project_id, requirement_id)));
+    server.registerTool("update_vibe_project_profile", {
+        description: "Push/update a project's vibe profile data by project ID. Accepts architecture notes, technology categories, user groups, compliance requirements, and other profile metadata. All fields are optional — only provided fields are sent to the API. Use this to populate or update a project profile in bulk from vibe/AI-generated context.",
+        inputSchema: {
+            project_id: z.number().int().describe("The ID of the project whose profile should be updated."),
+            architecture_notes: z
+                .array(z.string())
+                .optional()
+                .describe("List of architecture note strings describing the system design."),
+            tech_categories: z
+                .array(z.object({
+                name: z.string().describe("Technology category name (e.g. 'Frontend', 'Database')."),
+                tools: z.array(z.string()).optional().describe("Tools or technologies within this category."),
+                description: z.string().optional().describe("Description of how this category is used."),
+            }))
+                .optional()
+                .describe("Technology categories with optional tools and descriptions."),
+            user_groups: z
+                .array(z.object({
+                name: z.string().describe("Name of the user group."),
+                group_type: z.string().optional().describe("Type of the user group (e.g. 'internal', 'external')."),
+                description: z.string().optional().describe("Description of this user group."),
+            }))
+                .optional()
+                .describe("User groups that interact with the project."),
+            compliance_requirements: z
+                .array(z.string())
+                .optional()
+                .describe("Compliance framework names or requirement identifiers (e.g. 'PCI-DSS', 'HIPAA', 'SOC2')."),
+            description: z.string().optional().describe("High-level description or purpose of the project profile."),
+            language_stacks: z
+                .array(z.string())
+                .optional()
+                .describe("Programming languages and frameworks used (e.g. 'Python/Django', 'TypeScript/React')."),
+        },
+    }, async ({ project_id, architecture_notes, tech_categories, user_groups, compliance_requirements, description, language_stacks }) => {
+        const payload = {};
+        if (architecture_notes !== undefined)
+            payload.architecture_notes = architecture_notes;
+        if (tech_categories !== undefined)
+            payload.tech_categories = tech_categories;
+        if (user_groups !== undefined)
+            payload.user_groups = user_groups;
+        if (compliance_requirements !== undefined)
+            payload.compliance_requirements = compliance_requirements;
+        if (description !== undefined)
+            payload.description = description;
+        if (language_stacks !== undefined)
+            payload.language_stacks = language_stacks;
+        return runTool(async () => getApiClient().updateVibeProjectProfile(project_id, payload));
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/security-review-mcp",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Security Review MCP server (pure Node/TypeScript, npx-ready)",
   "license": "UNLICENSED",
   "private": false,