qualys-mcp 0.2.0 → 0.4.0

package/README.md

@@ -6,15 +6,15 @@ Read-only MCP server for the Qualys VMDR API. Exposes host assets, vulnerability
 
 | Tool | Purpose |
 |---|---|
+| `qualys_vuln_overview` | Estate-wide counts by tag: every client's open vulnerabilities by severity in one call, with optional CVSS threshold |
+| `qualys_vuln_summary` | Aggregated vulnerability counts by severity, per client tag and per machine — the dashboard/reporting tool |
+| `qualys_list_tags` | Asset tags and tag hierarchies (how clients are segmented) |
 | `qualys_asset_inventory` | Full CSAM/Global AssetView inventory: all assets with criticality, tags, last logged-on user, agent check-in, sources (QQL filterable) |
-| `qualys_list_hosts` | Scanned host assets (ID, IP, DNS, OS, last scan dates, optional tags) |
-| `qualys_host_detections` | Vulnerabilities detected per host (QID, severity, status, evidence) |
+| `qualys_host_detections` | Vulnerabilities detected per host (QID, severity, status, optional evidence; tag filterable) — the drill-down tool |
 | `qualys_knowledgebase` | QID details: title, CVEs, threat, impact, solution |
-| `qualys_list_scans` | Scan history and status |
-| `qualys_list_reports` | Generated reports |
-| `qualys_fetch_report` | Download a finished CSV/XML report inline |
-| `qualys_list_asset_groups` | Asset groups (typically clients/sites) and their IP ranges |
-| `qualys_api_call` | Raw GET/POST to any other Qualys endpoint (read-only actions only) |
+| `qualys_api_call` | Raw GET/POST to any other Qualys endpoint — disabled unless `QUALYS_ENABLE_RAW_API=true` |
+
+The tool set is deliberately lean, focused on vulnerability reporting across a tag-segmented client base. The raw API tool covers anything else (scans, reports, asset groups, schedules) but is off by default so shared deployments stay strictly read-only.
 
 ## Quick start (Claude Desktop / Cowork)
 
@@ -50,6 +50,7 @@ Three required environment variables:
 | `QUALYS_PASSWORD` | Qualys API user password |
 | `QUALYS_BASE_URL` | Your platform's API server (see below) |
 | `QUALYS_GATEWAY_URL` | Optional — the gateway host used by `qualys_asset_inventory` (CSAM/GAV API). Derived automatically from `QUALYS_BASE_URL` (e.g. `https://gateway.qg1.apps.qualys.co.uk` for UK1); only set this if your platform's gateway differs. |
+| `QUALYS_ENABLE_RAW_API` | Optional — set to `true` to expose `qualys_api_call` for arbitrary Qualys API endpoints. Leave unset for team deployments. |
 
 The API server depends on which Qualys platform your subscription lives on — check your Qualys login URL:
 
@@ -78,6 +79,18 @@ npm run inspector      # MCP Inspector UI
 npm run build          # compile to dist/
 ```
 
+## Reporting across a client base
+
+Clients segmented by asset tags? The intended flow for "state of vulnerabilities across our clients" is:
+
+1. `qualys_vuln_overview` — one call sweeps the whole estate and returns a client-by-client table: tag, host count, open vulnerabilities by severity. Use `exclude_tags` to drop system tags (e.g. "Cloud Agent") from the grouping.
+2. `qualys_vuln_summary` with `tags: "Client A"` — expand one client into its per-machine breakdown, sorted worst-first. Aggregation happens inside the server, so even thousands of detections come back as a few KB of counts.
+3. `qualys_host_detections` with `tags`/`ids` — drill into the individual findings on a machine, then `qualys_knowledgebase` for the fix.
+
+### CVSS-based thresholds (Cyber Essentials)
+
+Qualys severity (1–5) is not CVSS. If your remediation policy is CVSS-based — e.g. Cyber Essentials' "fix CVSS 7.0+ within 14 days" — pass `cvss_min: 7` to `qualys_vuln_overview` or `qualys_vuln_summary`. The server joins each detection against the KnowledgeBase CVSS v3 base score (v2 where no v3 exists) and counts only vulnerabilities at or above the threshold. QIDs with no CVSS data are excluded and reported in the response's `cvssFilter` block. Scores are cached for the server's lifetime, so repeated dashboard queries are fast.
+
 ## Notes
 
 - `qualys_asset_inventory` uses the CSAM/Global AssetView gateway API (JWT auth, JSON) and answers "show me all machines" — including agent-tracked assets, criticality scores and tags. Filter with QQL, e.g. `tags.name:"Client A"`, `operatingSystem.category1:"Windows"`, `criticality.score>=3`. Paginate with `hasMore`/`lastSeenAssetId`.

package/dist/index.js

@@ -6,6 +6,7 @@ import { QualysClient, simplify, stripEmpty } from './qualys-client.js';
 const username = process.env.QUALYS_USERNAME || '';
 const password = process.env.QUALYS_PASSWORD || '';
 const baseUrl = process.env.QUALYS_BASE_URL || '';
+const rawApiEnabled = process.env.QUALYS_ENABLE_RAW_API === 'true';
 if (!username || !password || !baseUrl) {
     console.error('Missing required environment variables: QUALYS_USERNAME, QUALYS_PASSWORD, QUALYS_BASE_URL.');
     console.error('QUALYS_BASE_URL is your platform API server, e.g. https://qualysapi.qg1.apps.qualys.co.uk (UK1),');
@@ -39,27 +40,45 @@ const tools = [
         },
     },
     {
-        name: 'qualys_list_hosts',
-        description: 'List scanned host assets in Qualys VMDR with their ID, IP, DNS name, OS and last scan dates. Use this to find host IDs before pulling their vulnerability detections. Filter by IPs, asset group or scan recency.',
+        name: 'qualys_vuln_overview',
+        description: 'Estate-wide vulnerability overview grouped by asset tag — one call answers "how many open vulnerabilities does each client have?". Sweeps all detection data server-side, groups counts by each host\'s tags, and returns a table of tag → host count and vulnerability counts by severity. Set cvss_min=7 to count only CVSS 7.0+ vulnerabilities (the Cyber Essentials remediation threshold) — scores are joined from the KnowledgeBase (CVSS v3 base, falling back to v2). Hosts with multiple tags are counted under each tag. Use qualys_vuln_summary to expand one client into its per-machine breakdown.',
         inputSchema: {
             type: 'object',
             properties: {
-                ids: { type: 'string', description: 'Comma-separated host IDs or ranges, e.g. "123,150-200"' },
-                ips: { type: 'string', description: 'Comma-separated IPs or ranges, e.g. "10.0.0.1,10.0.1.0-10.0.1.255"' },
-                ag_ids: { type: 'string', description: 'Comma-separated asset group IDs (see qualys_list_asset_groups)' },
-                ag_titles: { type: 'string', description: 'Comma-separated asset group titles' },
-                details: {
-                    type: 'string',
-                    description: 'Level of detail: "Basic" (default), "Basic/AGs", "All", "All/AGs", or "None" (IDs only)',
-                },
-                os_pattern: { type: 'string', description: 'PCRE regex to match against host operating system, e.g. "Windows Server 2012"' },
-                no_vm_scan_since: { type: 'string', description: 'Only hosts NOT scanned since this date (YYYY-MM-DD) — useful to find stale/unscanned assets' },
-                vm_scan_since: { type: 'string', description: 'Only hosts scanned since this date (YYYY-MM-DD)' },
-                show_tags: { type: 'boolean', description: 'Include asset tags for each host. Default false.' },
-                ...truncationProperties,
+                cvss_min: { type: 'number', description: 'Only count vulnerabilities with CVSS base score >= this value, e.g. 7 for Cyber Essentials. Omit to count everything.' },
+                tags: { type: 'string', description: 'Optionally restrict the sweep to hosts with these comma-separated tags. Default: whole estate.' },
+                exclude_tags: { type: 'string', description: 'Comma-separated tag names to omit from the grouping (e.g. system tags like "Cloud Agent")' },
+                severities: { type: 'string', description: 'Only count these Qualys severity levels, e.g. "4,5". Usually unnecessary when cvss_min is set.' },
+                status: { type: 'string', description: 'Detection statuses to count. Default "New,Active,Re-Opened" (open vulnerabilities).' },
+                max_hosts: { type: 'number', description: 'Safety cap on hosts to sweep (default 10000)' },
             },
         },
     },
+    {
+        name: 'qualys_vuln_summary',
+        description: 'Aggregated vulnerability counts by severity — the dashboard tool. Give it one or more client tags (or IPs/asset group IDs) and it pulls ALL matching detection data server-side and returns compact counts: totals by severity (1-5, confirmed vs potential) plus a per-machine breakdown sorted worst-first. Use this to report on the state of vulnerabilities per client; use qualys_host_detections to drill into the individual findings on a specific machine afterwards. Call qualys_list_tags first to see available client tags.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tags: { type: 'string', description: 'Comma-separated asset tag names to scope to, e.g. "Client A" — tags are how clients are segmented' },
+                tag_include_selector: { type: 'string', description: '"any" (default) or "all" — whether hosts must have any or all of the tags' },
+                ips: { type: 'string', description: 'Alternatively scope by comma-separated IPs or ranges' },
+                ag_ids: { type: 'string', description: 'Alternatively scope by comma-separated asset group IDs' },
+                cvss_min: { type: 'number', description: 'Only count vulnerabilities with CVSS base score >= this value, e.g. 7 for Cyber Essentials (CVSS v3 base, v2 fallback, joined from the KnowledgeBase)' },
+                severities: { type: 'string', description: 'Only count these Qualys severity levels, e.g. "4,5". Default: all.' },
+                status: { type: 'string', description: 'Detection statuses to count. Default "New,Active,Re-Opened" (open vulnerabilities). Add "Fixed" to include remediated ones.' },
+                max_hosts: { type: 'number', description: 'Safety cap on hosts to aggregate (default 5000)' },
+            },
+        },
+    },
+    {
+        name: 'qualys_list_tags',
+        description: 'List asset tags defined in Qualys, including tag hierarchies (parent tags with their children). Tags are how clients are segmented — use this to discover the client list, then feed tag names into qualys_vuln_summary or qualys_asset_inventory. Returns the first 100 tags.',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+    },
     {
         name: 'qualys_host_detections',
         description: 'List vulnerability detections per host — the core VMDR data. Returns each host with its detected vulnerabilities (QID, severity, status, first/last found, results evidence). Filter by host, QID, severity or detection status. Look up QID titles and fixes with qualys_knowledgebase. Output can be large: keep truncation_limit modest and filter where possible.',
@@ -78,6 +97,9 @@ const tools = [
                 },
                 show_igs: { type: 'boolean', description: 'Include information-gathered (IG) detections as well as vulnerabilities. Default false.' },
                 detection_updated_since: { type: 'string', description: 'Only detections updated since this date (YYYY-MM-DD)' },
+                tags: { type: 'string', description: 'Comma-separated asset tag names to scope to (clients are segmented by tags)' },
+                tag_include_selector: { type: 'string', description: '"any" (default) or "all" — whether hosts must have any or all of the tags' },
+                include_results: { type: 'boolean', description: 'Include the detection RESULTS evidence text (verbose). Default false.' },
                 ...truncationProperties,
             },
         },
@@ -96,57 +118,6 @@ const tools = [
             },
         },
     },
-    {
-        name: 'qualys_list_scans',
-        description: 'List vulnerability scans in Qualys VMDR with their reference, title, launch date, status and target. Useful for checking scan history and whether scheduled scans are completing.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                scan_ref: { type: 'string', description: 'Specific scan reference, e.g. "scan/1234567890.12345"' },
-                state: { type: 'string', description: 'Comma-separated states: "Running", "Paused", "Canceled", "Finished", "Error", "Queued", "Loading"' },
-                type: { type: 'string', description: 'Scan type: "On-Demand", "Scheduled" or "API"' },
-                target: { type: 'string', description: 'Filter by scan target IPs' },
-                launched_after_datetime: { type: 'string', description: 'Only scans launched after this datetime (YYYY-MM-DD or ISO 8601)' },
-                launched_before_datetime: { type: 'string', description: 'Only scans launched before this datetime' },
-            },
-        },
-    },
-    {
-        name: 'qualys_list_reports',
-        description: 'List generated reports in Qualys with their ID, title, type, output format, status and expiry. Use qualys_fetch_report to download a finished report.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                id: { type: 'number', description: 'Specific report ID' },
-                state: { type: 'string', description: 'Report state, e.g. "Finished", "Running", "Errors"' },
-                user_login: { type: 'string', description: 'Filter by the user who launched the report' },
-            },
-        },
-    },
-    {
-        name: 'qualys_fetch_report',
-        description: 'Download a finished Qualys report by ID. Only sensible for text-based formats (CSV, XML) — the content is returned inline, truncated to max_chars. Check qualys_list_reports first for the report status and format.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                id: { type: 'number', description: 'Report ID (must be in Finished state)' },
-                max_chars: { type: 'number', description: 'Maximum characters of report content to return (default 100000)' },
-            },
-            required: ['id'],
-        },
-    },
-    {
-        name: 'qualys_list_asset_groups',
-        description: 'List asset groups in Qualys with their ID, title and IP ranges. Asset groups typically map to clients or sites — use their IDs to scope qualys_list_hosts and qualys_host_detections.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                ids: { type: 'string', description: 'Comma-separated asset group IDs' },
-                show_attributes: { type: 'string', description: 'Comma-separated attributes to show, e.g. "ALL" or "ID,TITLE,IP_SET". Default "ID,TITLE".' },
-                ...truncationProperties,
-            },
-        },
-    },
     {
         name: 'qualys_api_call',
         description: 'Make a raw call to any Qualys API endpoint not covered by the other tools, e.g. /api/2.0/fo/report/template/scan/?action=list, /api/2.0/fo/schedule/scan/?action=list, or Asset Management endpoints under /qps/rest/2.0/. Only use list/read actions — do not launch scans or modify data. Params are sent as query string (GET) or form body (POST; some endpoints require POST).',
@@ -165,7 +136,9 @@ const tools = [
         },
     },
 ];
-server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: rawApiEnabled ? tools : tools.filter((t) => t.name !== 'qualys_api_call'),
+}));
 function toIso(ms) {
     return typeof ms === 'number' ? new Date(ms).toISOString() : undefined;
 }
@@ -195,8 +168,213 @@ function compactAsset(a) {
     });
 }
 const INVENTORY_FIELDS = 'assetId,assetName,address,dnsName,operatingSystem,criticality,riskScore,lastLoggedOnUser,tag,agent,sensor,inventory,assetType,lastModifiedDate';
+function tagParams(args) {
+    if (!args.tags)
+        return {};
+    return {
+        use_tags: 1,
+        tag_set_by: 'name',
+        tag_include_selector: args.tag_include_selector ?? 'any',
+        tag_set_include: args.tags,
+    };
+}
+async function sweepDetections(args, showTags, maxHosts) {
+    const hosts = [];
+    let idMin;
+    let truncated = false;
+    while (true) {
+        const result = await client.request('/api/2.0/fo/asset/host/vm/detection/', {
+            action: 'list',
+            echo_request: 0,
+            ...tagParams(args),
+            ips: args.ips,
+            ag_ids: args.ag_ids,
+            severities: args.severities,
+            status: args.status ?? 'New,Active,Re-Opened',
+            show_results: 0,
+            show_igs: 0,
+            show_tags: showTags ? 1 : undefined,
+            truncation_limit: Math.min(1000, maxHosts),
+            id_min: idMin,
+        });
+        const resp = simplify(result.parsed);
+        const pageHosts = resp?.HOST_LIST?.HOST ?? [];
+        for (const h of pageHosts) {
+            const detections = h?.DETECTION_LIST?.DETECTION ?? [];
+            hosts.push({
+                id: String(h.ID),
+                ip: h.IP,
+                dns: h.DNS,
+                os: h.OS,
+                lastScan: h.LAST_SCAN_DATETIME,
+                tags: (h.TAGS?.TAG ?? []).map((t) => String(t.NAME)),
+                detections: detections.map((d) => ({ qid: String(d.QID), sev: String(d.SEVERITY), type: String(d.TYPE) })),
+            });
+        }
+        const warningUrl = resp?.WARNING?.[0]?.URL;
+        const nextIdMin = warningUrl?.match(/id_min=(\d+)/)?.[1];
+        if (!nextIdMin)
+            break;
+        if (hosts.length >= maxHosts) {
+            truncated = true;
+            break;
+        }
+        idMin = Number(nextIdMin);
+    }
+    return { hosts, truncated };
+}
+const cvssCache = new Map();
+async function fetchCvssScores(qids) {
+    const missing = [...new Set(qids)].filter((q) => !cvssCache.has(q));
+    const num = (x) => {
+        const n = parseFloat(String(x ?? ''));
+        return Number.isFinite(n) ? n : undefined;
+    };
+    for (let i = 0; i < missing.length; i += 400) {
+        const chunk = missing.slice(i, i + 400);
+        const result = await client.request('/api/2.0/fo/knowledge_base/vuln/', { action: 'list', echo_request: 0, ids: chunk.join(','), details: 'Basic' }, 'POST');
+        const resp = simplify(result.parsed);
+        const vulns = resp?.VULN_LIST?.VULN ?? [];
+        for (const v of vulns) {
+            cvssCache.set(String(v.QID), { v2: num(v.CVSS?.BASE), v3: num(v.CVSS_V3?.BASE) });
+        }
+        for (const q of chunk)
+            if (!cvssCache.has(q))
+                cvssCache.set(q, {});
+    }
+}
+async function applyCvssFilter(hosts, cvssMin) {
+    await fetchCvssScores(hosts.flatMap((h) => h.detections.map((d) => d.qid)));
+    const unknown = new Set();
+    let excludedUnknown = 0;
+    for (const h of hosts) {
+        h.detections = h.detections.filter((d) => {
+            const score = cvssCache.get(d.qid);
+            const base = score?.v3 ?? score?.v2;
+            if (base === undefined) {
+                unknown.add(d.qid);
+                excludedUnknown += 1;
+                return false;
+            }
+            return base >= cvssMin;
+        });
+    }
+    return {
+        basis: `CVSS v3 base score >= ${cvssMin} (v2 base used where no v3 score exists)`,
+        unknownCvssQids: unknown.size,
+        detectionsExcludedUnknownCvss: excludedUnknown,
+    };
+}
+function countBySeverity(detections, totals) {
+    const counts = { confirmed: {}, potential: {} };
+    for (const d of detections) {
+        const bucket = d.type === 'Potential' ? 'potential' : 'confirmed';
+        counts[bucket][d.sev] = (counts[bucket][d.sev] ?? 0) + 1;
+        if (totals)
+            totals[bucket][d.sev] = (totals[bucket][d.sev] ?? 0) + 1;
+    }
+    return counts;
+}
+const hostWeight = (c, total) => (c.confirmed['5'] ?? 0) * 1e6 + (c.confirmed['4'] ?? 0) * 1e3 + total;
 async function handleTool(name, args) {
     switch (name) {
+        case 'qualys_vuln_summary': {
+            const maxHosts = args.max_hosts ?? 5000;
+            const { hosts, truncated } = await sweepDetections(args, false, maxHosts);
+            const cvssInfo = args.cvss_min !== undefined ? await applyCvssFilter(hosts, args.cvss_min) : undefined;
+            const totals = { confirmed: {}, potential: {} };
+            const rows = hosts.map((h) => {
+                const counts = countBySeverity(h.detections, totals);
+                return {
+                    id: h.id,
+                    ip: h.ip,
+                    dns: h.dns,
+                    os: h.os,
+                    lastScan: h.lastScan,
+                    confirmed: counts.confirmed,
+                    potential: counts.potential,
+                    total: h.detections.length,
+                };
+            });
+            rows.sort((a, b) => hostWeight(b, b.total) - hostWeight(a, a.total));
+            return JSON.stringify(stripEmpty({
+                scope: {
+                    tags: args.tags,
+                    ips: args.ips,
+                    ag_ids: args.ag_ids,
+                    severities: args.severities,
+                    status: args.status ?? 'New,Active,Re-Opened',
+                },
+                cvssFilter: cvssInfo,
+                hostCount: rows.length,
+                totalsBySeverity: totals,
+                truncated: truncated
+                    ? `Stopped at max_hosts=${maxHosts} — counts are incomplete; narrow the scope or raise max_hosts`
+                    : undefined,
+                hosts: rows,
+            }), null, 2);
+        }
+        case 'qualys_vuln_overview': {
+            const maxHosts = args.max_hosts ?? 10000;
+            const { hosts, truncated } = await sweepDetections(args, true, maxHosts);
+            const cvssInfo = args.cvss_min !== undefined ? await applyCvssFilter(hosts, args.cvss_min) : undefined;
+            const excluded = new Set((args.exclude_tags ?? '')
+                .split(',')
+                .map((t) => t.trim())
+                .filter(Boolean));
+            const overall = { confirmed: {}, potential: {} };
+            const byTag = new Map();
+            for (const h of hosts) {
+                countBySeverity(h.detections, overall);
+                const tags = h.tags.filter((t) => !excluded.has(t));
+                for (const tag of tags.length > 0 ? tags : ['(untagged)']) {
+                    let row = byTag.get(tag);
+                    if (!row) {
+                        row = { hosts: 0, counts: { confirmed: {}, potential: {} }, total: 0 };
+                        byTag.set(tag, row);
+                    }
+                    row.hosts += 1;
+                    countBySeverity(h.detections, row.counts);
+                    row.total += h.detections.length;
+                }
+            }
+            const tagRows = [...byTag.entries()]
+                .map(([tag, r]) => ({ tag, hosts: r.hosts, confirmed: r.counts.confirmed, potential: r.counts.potential, total: r.total }))
+                .sort((a, b) => hostWeight(b, b.total) - hostWeight(a, a.total));
+            return JSON.stringify(stripEmpty({
+                scope: {
+                    tags: args.tags,
+                    severities: args.severities,
+                    status: args.status ?? 'New,Active,Re-Opened',
+                    exclude_tags: args.exclude_tags,
+                },
+                cvssFilter: cvssInfo,
+                hostCount: hosts.length,
+                note: 'Hosts carrying multiple tags are counted under each tag, so tag rows can overlap.',
+                truncated: truncated
+                    ? `Stopped at max_hosts=${maxHosts} — counts are incomplete; narrow the scope or raise max_hosts`
+                    : undefined,
+                overallBySeverity: overall,
+                byTag: tagRows,
+            }), null, 2);
+        }
+        case 'qualys_list_tags': {
+            const result = await client.request('/qps/rest/2.0/search/am/tag', {}, 'POST');
+            const resp = simplify(result.parsed);
+            const rawTags = resp?.data?.Tag ?? [];
+            const tags = (Array.isArray(rawTags) ? rawTags : [rawTags]).map((t) => stripEmpty({
+                id: t.id,
+                name: t.name,
+                created: t.created,
+                children: (() => {
+                    const kids = t.children?.list?.TagSimple;
+                    if (!kids)
+                        return undefined;
+                    return (Array.isArray(kids) ? kids : [kids]).map((k) => ({ id: k.id, name: k.name }));
+                })(),
+            }));
+            return JSON.stringify({ count: resp?.count, hasMoreRecords: resp?.hasMoreRecords, tags }, null, 2);
+        }
         case 'qualys_asset_inventory': {
             const fullDetails = args.full_details === true;
             const result = (await client.gatewayRequest('/rest/2.0/search/am/asset', {
@@ -213,24 +391,6 @@ async function handleTool(name, args) {
                 assets: fullDetails ? assets.map((a) => stripEmpty(a)) : assets.map(compactAsset),
             }, null, 2);
         }
-        case 'qualys_list_hosts': {
-            const result = await client.request('/api/2.0/fo/asset/host/', {
-                action: 'list',
-                echo_request: 0,
-                ids: args.ids,
-                ips: args.ips,
-                ag_ids: args.ag_ids,
-                ag_titles: args.ag_titles,
-                details: args.details ?? 'Basic',
-                os_pattern: args.os_pattern,
-                no_vm_scan_since: args.no_vm_scan_since,
-                vm_scan_since: args.vm_scan_since,
-                show_tags: args.show_tags ? 1 : undefined,
-                truncation_limit: args.truncation_limit ?? 100,
-                id_min: args.id_min,
-            });
-            return JSON.stringify(simplify(result.parsed), null, 2);
-        }
         case 'qualys_host_detections': {
             const result = await client.request('/api/2.0/fo/asset/host/vm/detection/', {
                 action: 'list',
@@ -243,7 +403,9 @@ async function handleTool(name, args) {
                 severities: args.severities,
                 status: args.status,
                 show_igs: args.show_igs ? 1 : undefined,
+                show_results: args.include_results ? undefined : 0,
                 detection_updated_since: args.detection_updated_since,
+                ...tagParams(args),
                 truncation_limit: args.truncation_limit ?? 20,
                 id_min: args.id_min,
             });
@@ -261,53 +423,10 @@ async function handleTool(name, args) {
             });
             return JSON.stringify(simplify(result.parsed), null, 2);
         }
-        case 'qualys_list_scans': {
-            const result = await client.request('/api/2.0/fo/scan/', {
-                action: 'list',
-                echo_request: 0,
-                scan_ref: args.scan_ref,
-                state: args.state,
-                type: args.type,
-                target: args.target,
-                launched_after_datetime: args.launched_after_datetime,
-                launched_before_datetime: args.launched_before_datetime,
-            });
-            return JSON.stringify(simplify(result.parsed), null, 2);
-        }
-        case 'qualys_list_reports': {
-            const result = await client.request('/api/2.0/fo/report/', {
-                action: 'list',
-                echo_request: 0,
-                id: args.id,
-                state: args.state,
-                user_login: args.user_login,
-            });
-            return JSON.stringify(simplify(result.parsed), null, 2);
-        }
-        case 'qualys_fetch_report': {
-            const result = await client.request('/api/2.0/fo/report/', {
-                action: 'fetch',
-                id: args.id,
-            });
-            const maxChars = args.max_chars ?? 100_000;
-            const content = result.text ?? JSON.stringify(simplify(result.parsed), null, 2);
-            if (content.length > maxChars) {
-                return content.slice(0, maxChars) + `\n\n[Truncated: ${content.length} total characters, showing first ${maxChars}]`;
-            }
-            return content;
-        }
-        case 'qualys_list_asset_groups': {
-            const result = await client.request('/api/2.0/fo/asset/group/', {
-                action: 'list',
-                echo_request: 0,
-                ids: args.ids,
-                show_attributes: args.show_attributes ?? 'ID,TITLE',
-                truncation_limit: args.truncation_limit ?? 200,
-                id_min: args.id_min,
-            });
-            return JSON.stringify(simplify(result.parsed), null, 2);
-        }
         case 'qualys_api_call': {
+            if (!rawApiEnabled) {
+                throw new Error('The raw API tool is disabled. Set QUALYS_ENABLE_RAW_API=true to enable it.');
+            }
             const path = args.path;
             if (!path.startsWith('/'))
                 throw new Error('path must start with /');
@@ -345,7 +464,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error(`Qualys MCP server running (${baseUrl})`);
+    console.error(`Qualys MCP server running (${baseUrl}, raw API ${rawApiEnabled ? 'enabled' : 'disabled'})`);
 }
 main().catch((error) => {
     console.error('Fatal error:', error);

package/dist/qualys-client.js

@@ -61,7 +61,7 @@ export class QualysClient {
             'X-Requested-With': 'qualys-mcp',
         };
         let body;
-        if (method === 'POST') {
+        if (method === 'POST' && [...search.keys()].length > 0) {
             headers['Content-Type'] = 'application/x-www-form-urlencoded';
             body = search.toString();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualys-mcp",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "MCP server for the Qualys VMDR API (read-only) — hosts, vulnerability detections, KnowledgeBase, scans, reports and asset groups",
   "main": "dist/index.js",
   "type": "module",