@taiga-ai/mcp-server 0.26.0-rc.510 → 0.26.0-rc.514

package/dist/index.js

@@ -356,6 +356,17 @@ var TaigaClient = class {
 	async getFinding(id) {
 		return this.request("GET", `/maintenance/findings/${seg(id)}`);
 	}
+	/** The package inventory (PRO-2862); 404 where the `licenses` feature is not enabled. */
+	async listPackages(productId, opts) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/packages${query$1({ ...opts })}`);
+	}
+	async getLicenseSummary(productId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/licenses`);
+	}
+	/** A repository's CycloneDX 1.5 SBOM (PRO-2894), the document itself. */
+	async getSbom(productId, repositoryId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/repositories/${seg(repositoryId)}/sbom`);
+	}
 	async updateFinding(id, body) {
 		return this.request("PATCH", `/maintenance/findings/${seg(id)}`, body);
 	}
@@ -3924,6 +3935,10 @@ async function publishDraft(scope) {
 		...published.warnings ? { warnings: published.warnings } : {}
 	});
 }
+/** The section ids that are not control ids at all. GDPR-1.1 is a control id, so it is not among them, though it names no single policy. */
+function notControls(sections) {
+	return sections.filter((id) => !isControlId(id.toUpperCase()));
+}
 /** The policies the section ids name when every one is a control id (SEC-5.1), else none. */
 function policiesNamed(sections) {
 	if (sections.length === 0) return [];
@@ -3949,7 +3964,7 @@ function registerDocumentTools(server, client) {
 			sections: params.sections?.map((id) => id.toUpperCase())
 		} : params;
 		if (args.type === void 0) {
-			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself.");
+			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : notControls(args.sections).length > 0 && notControls(args.sections).length < args.sections.length ? `Not a control id: ${notControls(args.sections).join(", ")}. A control id such as SEC-5.1 names its policy; any other section id needs type.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself, but one of a family that spans policies (GDPR, NIS2) does not.");
 			const result = await client.listTenantDocuments({
 				limit: args.limit,
 				cursor: args.cursor
@@ -4707,7 +4722,7 @@ function waitingOn(rows, station) {
 }
 const STATION_NAMED = 3;
 /** Who holds the station, or null when the key cannot read the backlog or the read failed. */
-async function stationHolders(client, product, head) {
+async function stationHolders(client, product, except) {
 	if (!client.hasCapability("backlog:read")) return null;
 	try {
 		const columns = await Promise.all(["plan", "build"].map((state) => client.listBacklogItems(product, {
@@ -4715,7 +4730,7 @@ async function stationHolders(client, product, head) {
 			order: "newest",
 			limit: 100
 		})));
-		const rows = columns.flatMap((page) => page.data).filter((row) => row.id !== head);
+		const rows = columns.flatMap((page) => page.data).filter((row) => !except.has(row.id));
 		const capped = columns.some((page) => page.nextCursor !== null);
 		return {
 			count: rows.length,
@@ -4791,10 +4806,14 @@ async function queueView(client, product, options = { name: "all" }) {
 	});
 	const note = unnamed === 0 ? null : !canName ? "Entries carry initiativeId only: naming them needs backlog:read, which this key lacks." : entries.length > NAMED_ENTRIES ? `Only the first ${NAMED_ENTRIES} entries are named; the rest carry initiativeId only.` : "An entry whose initiative could not be read carries initiativeId only; taiga_get_initiative reads it.";
 	const line = typeof paused === "string" ? `The line is paused (since ${paused}): nothing is planned or built until a person resumes it.` : null;
+	const idle = rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0;
+	const station = rows.length > 0 || options.name === "all" ? await stationHolders(client, product, new Set(idle ? [rows[0].backlogItemId] : rows.map((row) => row.backlogItemId))) : null;
+	const offLine = !idle && station && station.count > 0 ? { offTheLine: `${station.atLeast ? "At least " : ""}${station.count} initiative${station.count === 1 ? " is" : "s are"} in Plan or Build without a queue entry (${station.titles.map((title) => `"${title}"`).join(", ")}${station.count > station.titles.length ? ", and more" : ""}): moved there by hand or waiting on a pull request review. Each holds the station like the active entry; taiga_list_initiatives with column: 'plan' or 'build' lists them.` } : {};
 	return {
 		linePaused: paused === null ? null : typeof paused === "string",
 		entries: rows.map(({ lifecycle: _lifecycle, runId: _runId, ...row }) => row),
-		waitingOn: line ?? waitingOn(rows, rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0 ? await stationHolders(client, product, rows[0].backlogItemId) : null),
+		waitingOn: line ?? waitingOn(rows, idle ? station : null),
+		...offLine,
 		...note ? { note } : {}
 	};
 }
@@ -5398,6 +5417,19 @@ function registerPlanVerdicts(server, client) {
 * next sweep no longer detects it, so there is no tool for either.
 */
 /** A finding as a list row: enough to decide whether to open, fix or ignore it. */
+const PACKAGE_ROW_FIELDS = [
+	"id",
+	"ecosystem",
+	"packageName",
+	"version",
+	"purl",
+	"licenses",
+	"scope",
+	"relation",
+	"sourcePath",
+	"productRepositoryId",
+	"detectedAt"
+];
 const FINDING_ROW_FIELDS = [
 	"id",
 	"kind",
@@ -5619,6 +5651,35 @@ function registerMaintenanceTools(server, client) {
 			...params.status === void 0 && params.severity === void 0 && params.kind === void 0 && typeof result.totalCount === "number" && sweep && sweep !== "unread" && typeof sweep["openFindings"] === "number" && sweep["openFindings"] !== result.totalCount ? { totalNote: "totalCount includes findings with a fix under way (remediating) and ignored findings whose ignore has expired; sweep.openFindings counts open ones only." } : {}
 		});
 	}));
+	server.registerTool("taiga_list_packages", {
+		title: "List the package inventory",
+		description: "Every package a product's repositories resolve, vulnerable or not, as the latest sweep read it: name, version, ecosystem, SPDX licenses, scope (dev / runtime / unknown), relation (direct / transitive / unknown) and the lockfile. The first page opens with licenses: each license string across the inventory, how many packages carry it and its standing against the allowlist (allowed, not_allowed, unknown), plus the allowlist and when each repository was last inventoried. Filter by one license string (UNKNOWN for the ones the data source could not name), a name substring or a repository. A license outside the allowlist is also a license_violation finding in taiga_list_findings. Where the licenses feature is not enabled the product answers NOT_FOUND. taiga_get_sbom downloads one repository as CycloneDX.",
+		inputSchema: z.object({
+			productId,
+			license: z.string().min(1).max(4096).optional().describe("Only packages carrying exactly this SPDX string"),
+			search: z.string().min(1).max(255).optional().describe("Case-insensitive substring of the package name"),
+			productRepositoryId: idInput("repository", "taiga_list_product_repositories gives it", "only this repository").optional(),
+			...pagination
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => {
+		const { productId: id, ...filters } = params;
+		const [result, summary] = await Promise.all([client.listPackages(id, filters), params.cursor === void 0 ? client.getLicenseSummary(id) : Promise.resolve(null)]);
+		return toolResult({
+			...summary ? { licenses: summary.data } : {},
+			...page(pickFields(result.data, PACKAGE_ROW_FIELDS), result.nextCursor),
+			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {}
+		});
+	}));
+	server.registerTool("taiga_get_sbom", {
+		title: "Download a repository SBOM",
+		description: "One repository's software bill of materials as a CycloneDX 1.5 JSON document, rendered from the stored package inventory: metadata (timestamp, tools, the repository), every package with its purl, license and scope, and the packages the repository declares directly. The whole document is returned, so for a large repository the answer is large; read taiga_list_packages when a summary is enough. NOT_FOUND where the licenses feature is not enabled, and for a repository no sweep has inventoried yet.",
+		inputSchema: z.object({
+			productId,
+			repositoryId: idInput("repository", "taiga_list_product_repositories gives it")
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => toolResult(await client.getSbom(params.productId, params.repositoryId))));
 	server.registerTool("taiga_get_finding", {
 		title: "Get a maintenance finding",
 		description: "Read one maintenance finding: exploit likelihood (EPSS, known-exploited list), the advisory summarized (full: true for its whole record: every affected range and reference) and fixed version, code location, breached policy controls, why it ranks where it does, history (reintroduced, previously resolved) and the remediation under way. fixable: false with fixNote says taiga_fix_finding would refuse it. A secret's value is never stored, only the rule and location.",
@@ -6558,10 +6619,15 @@ async function standingPart(client, productId) {
 	const standing = (await client.getPolicyStanding(productId)).data;
 	const summary = standingSummary(standing);
 	const state = standing.assessment?.state;
+	const controls = Array.isArray(standing.controls) ? standing.controls : [];
+	const withAny = (key) => controls.filter((control) => Number(control[key] ?? 0) > 0).length;
 	return {
 		openViolations: summary.violations,
 		bySeverity: summary.bySeverity,
-		controlsViolated: summary.controls,
+		controlsBreached: withAny("findingCount"),
+		controlsDiverged: withAny("divergenceCount"),
+		controlsMet: summary.controlsMet,
+		controlsNotApplicable: summary.controlsNotApplicable,
 		...state === "never" || state === "failed" ? { note: `The assessment ${state === "never" ? "has never run" : "failed"}: no violations here is not an all-clear.` } : {}
 	};
 }
@@ -6919,7 +6985,7 @@ const ENVIRONMENT_FIELDS = [
 */
 function deploymentLines(rows) {
 	return rows.map((row) => {
-		const repository = row.metadata?.["repositoryFullName"];
+		const repository = row.metadata?.repositoryFullName;
 		return {
 			...pickFields([row], DEPLOYMENT_FIELDS)[0],
 			repository: typeof repository === "string" ? repository : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-rc.510",
+  "version": "0.26.0-rc.514",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",