github-agent 1.1.1__tar.gz → 1.4.1__tar.gz

{github_agent-1.1.1 → github_agent-1.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 1.1.1
+Version: 1.4.1
 Summary: GitHub Agent for MCP
 Author-email: Audel Rouhi <knucklessg1@gmail.com>
 License: MIT
@@ -48,7 +48,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 1.1.1*
+*Version: 1.4.1*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > CLI interfaces, including the integrated A2A agent server, are maintained in the
@@ -98,8 +98,10 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_collaborators` | `COLLABORATORTOOL` | Manage repository collaborators. |
 | `github_commits` | `COMMITTOOL` | Manage GitHub commits. |
 | `github_contents` | `CONTENTTOOL` | Manage GitHub contents. |
+| `github_dependabot` | `DEPENDABOTTOOL` | Review and manage GitHub Dependabot vulnerability alerts. |
 | `github_discover_graphql_schema` | `GRAPHQLTOOL` | Discover the live GitHub GraphQL schema (types, fields, and attributes) in real-time. |
 | `github_graphql` | `GRAPHQLTOOL` | Execute raw GraphQL queries and mutations natively on GitHub. |
+| `github_ingest_pipelines` | `INGESTTOOL` | Natively ingest GitHub Actions workflow runs into epistemic-graph. |
 | `github_ingest_repos` | `INGESTTOOL` | Natively ingest GitHub repositories into epistemic-graph as typed :Repository nodes. |
 | `github_issues` | `ISSUETOOL` | Manage GitHub issues. |
 | `github_orgs` | `ORGTOOL` | Manage GitHub organizations. |
@@ -111,7 +113,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 #### Verbose 1:1 API-mapped tools (`MCP_TOOL_MODE=verbose` or `both`)
 
 <details>
-<summary>72 per-operation tools — one per public API method (click to expand)</summary>
+<summary>76 per-operation tools — one per public API method (click to expand)</summary>
 
 | MCP Tool | Toggle Env Var | Description |
 |----------|----------------|-------------|
@@ -144,8 +146,11 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_get_commit` | `APITOOL` | Get a single commit in a repository. |
 | `github_get_commits` | `APITOOL` | List commits for a repository. |
 | `github_get_contents` | `APITOOL` | Get contents of a file or directory in a repository. |
+| `github_get_dependabot_alert` | `APITOOL` | Get a single Dependabot alert. |
+| `github_get_dependabot_alerts` | `APITOOL` | List Dependabot alerts for a repository. |
 | `github_get_issue` | `APITOOL` | Get a single issue in a repository. |
 | `github_get_issues` | `APITOOL` | List issues for a repository. |
+| `github_get_org_dependabot_alerts` | `APITOOL` | List Dependabot alerts for an entire organization. |
 | `github_get_org_members` | `APITOOL` | List members for an organization. |
 | `github_get_org_repos` | `APITOOL` | List repositories for an organization. |
 | `github_get_org_teams` | `APITOOL` | List teams for an organization. |
@@ -181,6 +186,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_trigger_workflow_dispatch` | `APITOOL` | Trigger a workflow dispatch event. |
 | `github_update_branch_protection` | `APITOOL` | Update branch protection configuration. |
 | `github_update_content` | `APITOOL` | Update a file in a repository. |
+| `github_update_dependabot_alert` | `APITOOL` | Update the state of a Dependabot alert. |
 | `github_update_issue` | `APITOOL` | Update an issue in a repository. |
 | `github_update_organization` | `APITOOL` | Update an organization's profile and member settings. |
 | `github_update_pages` | `APITOOL` | Update the GitHub Pages configuration for a repository. |
@@ -190,7 +196,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 
 </details>
 
-_14 action-routed tool(s) (default) · 72 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (`condensed` default · `verbose` 1:1 · `both`). Auto-generated — do not edit._
+_16 action-routed tool(s) (default) · 76 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (`condensed` default · `verbose` 1:1 · `both`). Auto-generated — do not edit._
 <!-- MCP-TOOLS-TABLE:END -->
 
 Detailed tool schemas, parameter shapes, and validation constraints are preserved in [docs/mcp.md](docs/mcp.md).
@@ -245,6 +251,7 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COLLABORATORTOOL": "True",
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
+        "DEPENDABOTTOOL": "True",
         "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
@@ -291,6 +298,7 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COLLABORATORTOOL": "True",
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
+        "DEPENDABOTTOOL": "True",
         "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
@@ -338,6 +346,7 @@ docker run -d \
   -e COLLABORATORTOOL=True \
   -e COMMITTOOL=True \
   -e CONTENTTOOL=True \
+  -e DEPENDABOTTOOL=True \
   -e GITHUB_ALLOW_DESTRUCTIVE=False \
   -e GITHUB_HTTP_CONNECT_TIMEOUT=10 \
   -e GITHUB_HTTP_READ_TIMEOUT=30 \
@@ -408,6 +417,7 @@ consumed from a **remote deployment**. The
 | `COLLABORATORTOOL` | `True` |  |
 | `COMMITTOOL` | `True` |  |
 | `CONTENTTOOL` | `True` |  |
+| `DEPENDABOTTOOL` | `True` |  |
 | `GRAPHQLTOOL` | `True` |  |
 | `INGESTTOOL` | `True` |  |
 | `ISSUETOOL` | `True` |  |
@@ -434,7 +444,7 @@ consumed from a **remote deployment**. The
 | `MODEL_ID` | `gpt-4o` | Model id for the agent |
 | `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |
 
-_33 package + 12 inherited variable(s). Auto-generated from `.env.example` + the shared agent-utilities set — do not edit._
+_34 package + 12 inherited variable(s). Auto-generated from `.env.example` + the shared agent-utilities set — do not edit._
 <!-- ENV-VARS-TABLE:END -->
 
 

{github_agent-1.1.1 → github_agent-1.4.1}/README.md

@@ -20,7 +20,7 @@
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 1.1.1*
+*Version: 1.4.1*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > CLI interfaces, including the integrated A2A agent server, are maintained in the
@@ -70,8 +70,10 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_collaborators` | `COLLABORATORTOOL` | Manage repository collaborators. |
 | `github_commits` | `COMMITTOOL` | Manage GitHub commits. |
 | `github_contents` | `CONTENTTOOL` | Manage GitHub contents. |
+| `github_dependabot` | `DEPENDABOTTOOL` | Review and manage GitHub Dependabot vulnerability alerts. |
 | `github_discover_graphql_schema` | `GRAPHQLTOOL` | Discover the live GitHub GraphQL schema (types, fields, and attributes) in real-time. |
 | `github_graphql` | `GRAPHQLTOOL` | Execute raw GraphQL queries and mutations natively on GitHub. |
+| `github_ingest_pipelines` | `INGESTTOOL` | Natively ingest GitHub Actions workflow runs into epistemic-graph. |
 | `github_ingest_repos` | `INGESTTOOL` | Natively ingest GitHub repositories into epistemic-graph as typed :Repository nodes. |
 | `github_issues` | `ISSUETOOL` | Manage GitHub issues. |
 | `github_orgs` | `ORGTOOL` | Manage GitHub organizations. |
@@ -83,7 +85,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 #### Verbose 1:1 API-mapped tools (`MCP_TOOL_MODE=verbose` or `both`)
 
 <details>
-<summary>72 per-operation tools — one per public API method (click to expand)</summary>
+<summary>76 per-operation tools — one per public API method (click to expand)</summary>
 
 | MCP Tool | Toggle Env Var | Description |
 |----------|----------------|-------------|
@@ -116,8 +118,11 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_get_commit` | `APITOOL` | Get a single commit in a repository. |
 | `github_get_commits` | `APITOOL` | List commits for a repository. |
 | `github_get_contents` | `APITOOL` | Get contents of a file or directory in a repository. |
+| `github_get_dependabot_alert` | `APITOOL` | Get a single Dependabot alert. |
+| `github_get_dependabot_alerts` | `APITOOL` | List Dependabot alerts for a repository. |
 | `github_get_issue` | `APITOOL` | Get a single issue in a repository. |
 | `github_get_issues` | `APITOOL` | List issues for a repository. |
+| `github_get_org_dependabot_alerts` | `APITOOL` | List Dependabot alerts for an entire organization. |
 | `github_get_org_members` | `APITOOL` | List members for an organization. |
 | `github_get_org_repos` | `APITOOL` | List repositories for an organization. |
 | `github_get_org_teams` | `APITOOL` | List teams for an organization. |
@@ -153,6 +158,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 | `github_trigger_workflow_dispatch` | `APITOOL` | Trigger a workflow dispatch event. |
 | `github_update_branch_protection` | `APITOOL` | Update branch protection configuration. |
 | `github_update_content` | `APITOOL` | Update a file in a repository. |
+| `github_update_dependabot_alert` | `APITOOL` | Update the state of a Dependabot alert. |
 | `github_update_issue` | `APITOOL` | Update an issue in a repository. |
 | `github_update_organization` | `APITOOL` | Update an organization's profile and member settings. |
 | `github_update_pages` | `APITOOL` | Update the GitHub Pages configuration for a repository. |
@@ -162,7 +168,7 @@ _Auto-generated from the live MCP server — do not edit by hand._
 
 </details>
 
-_14 action-routed tool(s) (default) · 72 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (`condensed` default · `verbose` 1:1 · `both`). Auto-generated — do not edit._
+_16 action-routed tool(s) (default) · 76 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (`condensed` default · `verbose` 1:1 · `both`). Auto-generated — do not edit._
 <!-- MCP-TOOLS-TABLE:END -->
 
 Detailed tool schemas, parameter shapes, and validation constraints are preserved in [docs/mcp.md](docs/mcp.md).
@@ -217,6 +223,7 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COLLABORATORTOOL": "True",
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
+        "DEPENDABOTTOOL": "True",
         "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
@@ -263,6 +270,7 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COLLABORATORTOOL": "True",
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
+        "DEPENDABOTTOOL": "True",
         "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
@@ -310,6 +318,7 @@ docker run -d \
   -e COLLABORATORTOOL=True \
   -e COMMITTOOL=True \
   -e CONTENTTOOL=True \
+  -e DEPENDABOTTOOL=True \
   -e GITHUB_ALLOW_DESTRUCTIVE=False \
   -e GITHUB_HTTP_CONNECT_TIMEOUT=10 \
   -e GITHUB_HTTP_READ_TIMEOUT=30 \
@@ -380,6 +389,7 @@ consumed from a **remote deployment**. The
 | `COLLABORATORTOOL` | `True` |  |
 | `COMMITTOOL` | `True` |  |
 | `CONTENTTOOL` | `True` |  |
+| `DEPENDABOTTOOL` | `True` |  |
 | `GRAPHQLTOOL` | `True` |  |
 | `INGESTTOOL` | `True` |  |
 | `ISSUETOOL` | `True` |  |
@@ -406,7 +416,7 @@ consumed from a **remote deployment**. The
 | `MODEL_ID` | `gpt-4o` | Model id for the agent |
 | `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |
 
-_33 package + 12 inherited variable(s). Auto-generated from `.env.example` + the shared agent-utilities set — do not edit._
+_34 package + 12 inherited variable(s). Auto-generated from `.env.example` + the shared agent-utilities set — do not edit._
 <!-- ENV-VARS-TABLE:END -->
 
 

{github_agent-1.1.1 → github_agent-1.4.1}/github_agent/agent_server.py

@@ -4,7 +4,7 @@ import os
 import sys
 import warnings
 
-__version__ = "1.1.1"
+__version__ = "1.4.1"
 
 logging.basicConfig(
     level=logging.INFO,

github_agent-1.4.1/github_agent/api/api_client_dependabot.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python
+from typing import Any
+
+from agent_utilities.decorators import require_auth
+
+from github_agent.api.api_client_base import BaseApiClient
+from github_agent.github_response_models import Response
+
+
+class Api(BaseApiClient):
+    @require_auth
+    def get_dependabot_alerts(self, owner: str, repo: str, **filters) -> Response:
+        """List Dependabot alerts for a repository.
+
+        GET /repos/{owner}/{repo}/dependabot/alerts. Optional filters passed
+        straight through as query parameters (state, severity, ecosystem,
+        package, scope, sort, direction, per_page, page). Returns the raw JSON
+        list of alerts in ``Response.data``.
+        """
+        params = {k: v for k, v in filters.items() if v is not None}
+        response = self._session.get(
+            url=f"{self.url}/repos/{owner}/{repo}/dependabot/alerts",
+            params=params or None,
+            headers=self.headers,
+            verify=self.verify,
+            proxies=self.proxies,
+        )
+        response.raise_for_status()
+        return Response(response=response, data=response.json())
+
+    @require_auth
+    def get_dependabot_alert(
+        self, owner: str, repo: str, alert_number: int
+    ) -> Response:
+        """Get a single Dependabot alert.
+
+        GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}.
+        """
+        response = self._session.get(
+            url=(f"{self.url}/repos/{owner}/{repo}/dependabot/alerts/{alert_number}"),
+            headers=self.headers,
+            verify=self.verify,
+            proxies=self.proxies,
+        )
+        response.raise_for_status()
+        return Response(response=response, data=response.json())
+
+    @require_auth
+    def get_org_dependabot_alerts(self, org: str, **filters) -> Response:
+        """List Dependabot alerts for an entire organization.
+
+        GET /orgs/{org}/dependabot/alerts. Optional filters passed straight
+        through as query parameters (state, severity, ecosystem, package,
+        scope, sort, direction, per_page, page). Returns the raw JSON list of
+        alerts in ``Response.data``.
+        """
+        params = {k: v for k, v in filters.items() if v is not None}
+        response = self._session.get(
+            url=f"{self.url}/orgs/{org}/dependabot/alerts",
+            params=params or None,
+            headers=self.headers,
+            verify=self.verify,
+            proxies=self.proxies,
+        )
+        response.raise_for_status()
+        return Response(response=response, data=response.json())
+
+    @require_auth
+    def update_dependabot_alert(
+        self,
+        owner: str,
+        repo: str,
+        alert_number: int,
+        state: str,
+        dismissed_reason: str | None = None,
+        dismissed_comment: str | None = None,
+    ) -> Response:
+        """Update the state of a Dependabot alert.
+
+        PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}. ``state``
+        is ``dismissed`` or ``open``. ``dismissed_reason`` is required when
+        dismissing (one of ``fix_started``, ``inaccurate``, ``no_bandwidth``,
+        ``not_used``, ``tolerable_risk``); ``dismissed_comment`` is optional.
+        """
+        payload: dict[str, Any] = {"state": state}
+        if dismissed_reason is not None:
+            payload["dismissed_reason"] = dismissed_reason
+        if dismissed_comment is not None:
+            payload["dismissed_comment"] = dismissed_comment
+        response = self._session.patch(
+            url=(f"{self.url}/repos/{owner}/{repo}/dependabot/alerts/{alert_number}"),
+            json=payload,
+            headers=self.headers,
+            verify=self.verify,
+            proxies=self.proxies,
+        )
+        response.raise_for_status()
+        return Response(response=response, data=response.json())

{github_agent-1.1.1 → github_agent-1.4.1}/github_agent/api_client.py

@@ -3,6 +3,7 @@ from github_agent.api.api_client_base import logger  # noqa: F401
 from github_agent.api.api_client_branches import Api as BranchesApi
 from github_agent.api.api_client_commits import Api as CommitsApi
 from github_agent.api.api_client_contents import Api as ContentsApi
+from github_agent.api.api_client_dependabot import Api as DependabotApi
 from github_agent.api.api_client_issues import Api as IssuesApi
 from github_agent.api.api_client_orgs import Api as OrgsApi
 from github_agent.api.api_client_pages import Api as PagesApi
@@ -39,6 +40,7 @@ class Api(
     BranchesApi,
     CommitsApi,
     ContentsApi,
+    DependabotApi,
     IssuesApi,
     OrgsApi,
     PagesApi,

{github_agent-1.1.1 → github_agent-1.4.1}/github_agent/kg_ingest.py

@@ -3,7 +3,8 @@
 CONCEPT:AU-KG.ingest.enterprise-source-extractor. The github-agent connector natively
 pushes its data into the ONE epistemic-graph knowledge graph as **typed OWL nodes**
 (``:Repository``, ``:PullRequest``, ``:Issue``, ``:Release``, ``:Organization``,
-``:Person``) plus links, and release notes as **:Document** nodes for semantic search —
+``:Person``, ``:PipelineRun``, ``:CheckRun``) plus links, and release notes as
+**:Document** nodes for semantic search —
 using the lightweight engine client (``GraphComputeEngine()._client`` + ``txn``), the
 same fast client the blob ``MediaStore`` uses, NOT the heavy in-process ingestion engine.
 
@@ -355,3 +356,123 @@ def ingest_release_notes(
             }
         )
     return ingest_documents(docs, client=client, graph=graph)
+
+
+def _duration_seconds(start: Any, end: Any) -> int | None:
+    """Whole-second wall-clock duration between two ISO-8601 timestamps, or ``None``."""
+    if not start or not end:
+        return None
+    try:
+        import datetime as _dt
+
+        started = _dt.datetime.fromisoformat(str(start).replace("Z", "+00:00"))
+        ended = _dt.datetime.fromisoformat(str(end).replace("Z", "+00:00"))
+        return max(0, int((ended - started).total_seconds()))
+    except (ValueError, TypeError):
+        return None
+
+
+def ingest_pipeline_runs(
+    runs: list[dict[str, Any]],
+    *,
+    repo_full_name: str | None = None,
+    repo_node_id: str | None = None,
+    jobs_by_run: dict[int, list[dict[str, Any]]] | None = None,
+    client: Any | None = None,
+    graph: str | None = None,
+) -> dict[str, int] | None:
+    """Map GitHub Actions workflow runs (+ jobs/check-runs) → ``:PipelineRun``/``:CheckRun``.
+
+    ``runs``: raw ``WorkflowRun`` records (``client.get_workflow_runs`` /
+    ``.get_workflow_run`` ``model_dump()``). ``jobs_by_run``: optional ``{run_id:
+    [job_or_check_run, ...]}`` from ``client.get_workflow_run_jobs`` (or the Checks
+    API) — each becomes a child ``:CheckRun`` linked via ``hasJob``.
+
+    Uses the SAME ``:PipelineRun``/``:CheckRun`` classes and ``ranFor``/``hasJob``
+    edge names as gitlab-api's ingestion so GitHub Actions and GitLab CI/CD unify
+    under one CI node shape in the knowledge graph. ``ranFor`` is emitted once per
+    known target — the repo, the head commit, and (if the run lists it) the PR.
+    Stable ids: ``github:pipelinerun:<repo>:<id>`` / ``github:checkrun:<repo>:<id>``.
+    """
+    entities: list[dict[str, Any]] = []
+    relationships: list[dict[str, Any]] = []
+    jobs_by_run = jobs_by_run or {}
+    for run in runs or []:
+        run_id = run.get("id")
+        if run_id is None:
+            continue
+        repo = repo_full_name or (run.get("repository") or {}).get("full_name")
+        node_id = f"github:pipelinerun:{repo}:{run_id}"
+        run_started = run.get("run_started_at")
+        run_updated = run.get("updated_at")
+        entities.append(
+            {
+                "id": node_id,
+                "type": "PipelineRun",
+                "status": run.get("status"),
+                "conclusion": run.get("conclusion"),
+                "headSha": run.get("head_sha"),
+                "headBranch": run.get("head_branch"),
+                "event": run.get("event"),
+                "htmlUrl": _str(run.get("html_url")),
+                "runStartedAt": run_started,
+                "runUpdatedAt": run_updated,
+                "durationSeconds": _duration_seconds(run_started, run_updated),
+                "externalToolId": str(run_id),
+            }
+        )
+
+        if repo_node_id:
+            relationships.append(
+                {"source": node_id, "target": repo_node_id, "type": "ranFor"}
+            )
+
+        head_sha = run.get("head_sha")
+        if repo and head_sha:
+            commit_id = f"github:commit:{repo}:{head_sha}"
+            entities.append(
+                {
+                    "id": commit_id,
+                    "type": "Commit",
+                    "sha": head_sha,
+                    "externalToolId": head_sha,
+                }
+            )
+            relationships.append(
+                {"source": node_id, "target": commit_id, "type": "ranFor"}
+            )
+
+        for pr in run.get("pull_requests") or []:
+            pr_id = pr.get("id")
+            if pr_id is None:
+                continue
+            relationships.append(
+                {
+                    "source": node_id,
+                    "target": f"github:pullrequest:{pr_id}",
+                    "type": "ranFor",
+                }
+            )
+
+        for job in jobs_by_run.get(run_id) or []:
+            job_id = job.get("id")
+            if job_id is None:
+                continue
+            job_node_id = f"github:checkrun:{repo}:{job_id}"
+            entities.append(
+                {
+                    "id": job_node_id,
+                    "type": "CheckRun",
+                    "name": job.get("name"),
+                    "status": job.get("status"),
+                    "conclusion": job.get("conclusion"),
+                    "startedAt": job.get("started_at"),
+                    "completedAt": job.get("completed_at"),
+                    "htmlUrl": _str(job.get("html_url")),
+                    "externalToolId": str(job_id),
+                }
+            )
+            relationships.append(
+                {"source": node_id, "target": job_node_id, "type": "hasJob"}
+            )
+    return ingest_entities(entities, relationships, client=client, graph=graph)

{github_agent-1.1.1 → github_agent-1.4.1}/github_agent/mcp/__init__.py

@@ -9,6 +9,7 @@ from github_agent.mcp.mcp_branch import register_branch_tools
 from github_agent.mcp.mcp_collaborator import register_collaborator_tools
 from github_agent.mcp.mcp_commit import register_commit_tools
 from github_agent.mcp.mcp_content import register_content_tools
+from github_agent.mcp.mcp_dependabot import register_dependabot_tools
 from github_agent.mcp.mcp_issue import register_issue_tools
 from github_agent.mcp.mcp_org import register_org_tools
 from github_agent.mcp.mcp_pull import register_pull_tools
@@ -22,6 +23,7 @@ __all__ = [
     "register_collaborator_tools",
     "register_commit_tools",
     "register_content_tools",
+    "register_dependabot_tools",
     "register_issue_tools",
     "register_org_tools",
     "register_pull_tools",

github_agent-1.4.1/github_agent/mcp/mcp_dependabot.py

@@ -0,0 +1,172 @@
+"""MCP tools for Dependabot alert operations.
+
+Auto-generated from mcp_server.py during ecosystem standardization.
+"""
+
+from agent_utilities.mcp_utilities import resolve_action, run_blocking
+from fastmcp import Context, FastMCP
+from fastmcp.dependencies import Depends
+from pydantic import Field
+
+from github_agent.auth import allow_destructive_default, get_client
+
+#: Dependabot actions gated behind allow_destructive / GITHUB_ALLOW_DESTRUCTIVE.
+DESTRUCTIVE_DEPENDABOT_ACTIONS = {"update"}
+
+#: Valid Dependabot actions for the shared ``resolve_action`` discovery helper.
+DEPENDABOT_ACTIONS = ("list", "get", "list_org", "update")
+
+
+def register_dependabot_tools(mcp: FastMCP):
+    @mcp.tool(tags={"dependabot"})
+    async def github_dependabot(
+        action: str = Field(
+            description="Action to perform. Must be one of: 'list', 'get', 'list_org', 'update'"
+        ),
+        params_json: str = Field(
+            default="{}", description="JSON string of parameters to pass to the action."
+        ),
+        allow_destructive: bool = Field(
+            default=False,
+            description="Confirm a guarded write ('update' — dismiss/reopen an alert). Also honoured via GITHUB_ALLOW_DESTRUCTIVE.",
+        ),
+        client=Depends(get_client),
+        ctx: Context | None = Field(
+            default=None, description="MCP context for progress reporting"
+        ),
+    ) -> dict:
+        """Review and manage GitHub Dependabot vulnerability alerts.
+
+        Actions (parameters via params_json):
+        - 'list': {"owner", "repo", plus optional filters: state
+          (open/dismissed/fixed/auto_dismissed), severity
+          (low/medium/high/critical), ecosystem, package, scope
+          (development/runtime), sort, direction, per_page} — list a repo's
+          Dependabot alerts (GET /repos/{owner}/{repo}/dependabot/alerts).
+        - 'get': {"owner", "repo", "alert_number"} — a single alert.
+        - 'list_org': {"org", plus the same optional filters} — every
+          Dependabot alert across an organization
+          (GET /orgs/{org}/dependabot/alerts).
+        - 'update': {"owner", "repo", "alert_number", "state":
+          "dismissed"|"open", plus "dismissed_reason" (required to dismiss:
+          fix_started/inaccurate/no_bandwidth/not_used/tolerable_risk) and
+          optional "dismissed_comment"} — dismiss or reopen an alert. Guarded
+          by allow_destructive / GITHUB_ALLOW_DESTRUCTIVE.
+        """
+        if ctx:
+            await ctx.info("Executing github_dependabot action...")
+        import json
+
+        try:
+            kwargs = json.loads(params_json)
+        except Exception as e:
+            return {"status": 400, "error": f"Invalid params_json: {e}", "data": None}
+
+        kwargs = {k: v for k, v in kwargs.items() if v is not None}
+
+        resolved = resolve_action(action, DEPENDABOT_ACTIONS, service="github-agent")
+        if isinstance(resolved, dict):
+            return resolved
+        action = resolved
+
+        if action in DESTRUCTIVE_DEPENDABOT_ACTIONS and not (
+            allow_destructive is True or allow_destructive_default()
+        ):
+            return {
+                "status": 403,
+                "error": (
+                    f"Action '{action}' is a guarded write and blocked by default. "
+                    "Re-run with allow_destructive=true (or set "
+                    "GITHUB_ALLOW_DESTRUCTIVE=True) to confirm."
+                ),
+                "data": None,
+            }
+
+        try:
+            if action == "list":
+                owner = kwargs.pop("owner", None)
+                repo = kwargs.pop("repo", None)
+                if not owner or not repo:
+                    return {
+                        "status": 400,
+                        "error": "Missing 'owner' or 'repo' parameter",
+                        "data": None,
+                    }
+                response = await run_blocking(
+                    client.get_dependabot_alerts, owner=owner, repo=repo, **kwargs
+                )
+                return {
+                    "status": 200,
+                    "message": "Dependabot alerts retrieved successfully",
+                    "data": response.data,
+                }
+            elif action == "get":
+                owner = kwargs.get("owner")
+                repo = kwargs.get("repo")
+                alert_number = kwargs.get("alert_number")
+                if not owner or not repo or not alert_number:
+                    return {
+                        "status": 400,
+                        "error": "Missing 'owner', 'repo', or 'alert_number' parameter",
+                        "data": None,
+                    }
+                response = await run_blocking(
+                    client.get_dependabot_alert,
+                    owner=owner,
+                    repo=repo,
+                    alert_number=int(alert_number),
+                )
+                return {
+                    "status": 200,
+                    "message": "Dependabot alert retrieved successfully",
+                    "data": response.data,
+                }
+            elif action == "list_org":
+                org = kwargs.pop("org", None)
+                if not org:
+                    return {
+                        "status": 400,
+                        "error": "Missing required 'org' parameter",
+                        "data": None,
+                    }
+                response = await run_blocking(
+                    client.get_org_dependabot_alerts, org=org, **kwargs
+                )
+                return {
+                    "status": 200,
+                    "message": "Organization Dependabot alerts retrieved successfully",
+                    "data": response.data,
+                }
+            elif action == "update":
+                owner = kwargs.get("owner")
+                repo = kwargs.get("repo")
+                alert_number = kwargs.get("alert_number")
+                state = kwargs.get("state")
+                if not owner or not repo or not alert_number or not state:
+                    return {
+                        "status": 400,
+                        "error": "Missing 'owner', 'repo', 'alert_number', or 'state' parameter",
+                        "data": None,
+                    }
+                response = await run_blocking(
+                    client.update_dependabot_alert,
+                    owner=owner,
+                    repo=repo,
+                    alert_number=int(alert_number),
+                    state=state,
+                    dismissed_reason=kwargs.get("dismissed_reason"),
+                    dismissed_comment=kwargs.get("dismissed_comment"),
+                )
+                return {
+                    "status": 200,
+                    "message": "Dependabot alert updated successfully",
+                    "data": response.data,
+                }
+            else:
+                return {
+                    "status": 400,
+                    "error": f"Unknown action: {action}",
+                    "data": None,
+                }
+        except Exception as e:
+            return {"status": 500, "error": str(e), "data": None}