Skip to content

Commit 0f8e34d

Browse files
advancedresearcharraycursoragent
advancedresearcharray
and
cursoragent
committed
feat: add repository security advisory create, update, and CVE request tools
Add MCP tools for the repository security advisory lifecycle: create draft advisories, update/publish them, and request CVE IDs. Enforce GHSA ID validation, severity/CVSS mutual exclusivity (exactly one required on create), field validation, and MCP safety annotations. Document the severity XOR cvssVectorString requirement in tool schemas and README. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent d42bb3e commit 0f8e34d

8 files changed

Lines changed: 1893 additions & 4 deletions

‎README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1357,6 +1357,21 @@ The following sets of tools are available:
13571357

13581358
<summary><picture><source media="(prefers-color-scheme: dark)" srcset="pkg/octicons/icons/shield-dark.png"><source media="(prefers-color-scheme: light)" srcset="pkg/octicons/icons/shield-light.png"><img src="pkg/octicons/icons/shield-light.png" width="20" height="20" alt="shield"></picture> Security Advisories</summary>
13591359

1360+
- **create_repository_security_advisory** - Create repository security advisory
1361+
- **Required OAuth Scopes**: `security_events`
1362+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1363+
- `credits`: Users credited for the advisory. (object[], optional)
1364+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1365+
- `cvssVectorString`: The CVSS vector string for the advisory. Exactly one of severity or cvssVectorString is required. (string, optional)
1366+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). (string[], optional)
1367+
- `description`: A detailed description of the security advisory. (string, required)
1368+
- `owner`: The owner of the repository. (string, required)
1369+
- `repo`: The name of the repository. (string, required)
1370+
- `severity`: The severity of the advisory. Exactly one of severity or cvssVectorString is required. (string, optional)
1371+
- `startPrivateFork`: Whether to create a temporary private fork for collaborating on a fix. (boolean, optional)
1372+
- `summary`: A short summary of the security advisory. (string, required)
1373+
- `vulnerabilities`: Affected products and version ranges. (object[], required)
1374+
13601375
- **get_global_security_advisory** - Get a global security advisory
13611376
- **Required OAuth Scopes**: `security_events`
13621377
- **Accepted OAuth Scopes**: `repo`, `security_events`
@@ -1394,6 +1409,29 @@ The following sets of tools are available:
13941409
- `sort`: Sort field. (string, optional)
13951410
- `state`: Filter by advisory state. (string, optional)
13961411

1412+
- **request_cve_for_repository_security_advisory** - Request CVE for repository security advisory
1413+
- **Required OAuth Scopes**: `security_events`
1414+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1415+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1416+
- `owner`: The owner of the repository. (string, required)
1417+
- `repo`: The name of the repository. (string, required)
1418+
1419+
- **update_repository_security_advisory** - Update repository security advisory
1420+
- **Required OAuth Scopes**: `security_events`
1421+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1422+
- `credits`: Users credited for the advisory. (object[], optional)
1423+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1424+
- `cvssVectorString`: The CVSS vector string for the advisory. Cannot be set together with severity. (string, optional)
1425+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). (string[], optional)
1426+
- `description`: A detailed description of the security advisory. (string, optional)
1427+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1428+
- `owner`: The owner of the repository. (string, required)
1429+
- `repo`: The name of the repository. (string, required)
1430+
- `severity`: The severity of the advisory. Cannot be set together with cvssVectorString. (string, optional)
1431+
- `state`: The advisory state. Set to "published" to publish the advisory. (string, optional)
1432+
- `summary`: A short summary of the security advisory. (string, optional)
1433+
- `vulnerabilities`: Affected products and version ranges. (object[], optional)
1434+
13971435
</details>
13981436

13991437
<details>

‎pkg/github/__toolsnaps__/create_repository_security_advisory.snap‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
{
2+
"annotations": {
3+
"destructiveHint": true,
4+
"openWorldHint": true,
5+
"title": "Create repository security advisory"
6+
},
7+
"description": "Create a draft repository security advisory. Exactly one of severity or cvssVectorString must be provided. When startPrivateFork is true, a temporary private fork is created for collaborating on a fix.",
8+
"inputSchema": {
9+
"properties": {
10+
"credits": {
11+
"description": "Users credited for the advisory.",
12+
"items": {
13+
"properties": {
14+
"login": {
15+
"description": "The GitHub username of the credited user.",
16+
"type": "string"
17+
},
18+
"type": {
19+
"description": "The credit type.",
20+
"enum": [
21+
"analyst",
22+
"finder",
23+
"reporter",
24+
"coordinator",
25+
"remediation_developer",
26+
"remediation_reviewer",
27+
"remediation_verifier",
28+
"tool",
29+
"sponsor",
30+
"other"
31+
],
32+
"type": "string"
33+
}
34+
},
35+
"required": [
36+
"login",
37+
"type"
38+
],
39+
"type": "object"
40+
},
41+
"type": "array"
42+
},
43+
"cveId": {
44+
"description": "The CVE ID to assign to the advisory.",
45+
"type": "string"
46+
},
47+
"cvssVectorString": {
48+
"description": "The CVSS vector string for the advisory. Exactly one of severity or cvssVectorString is required.",
49+
"type": "string"
50+
},
51+
"cweIds": {
52+
"description": "Common Weakness Enumeration IDs (for example, [\"CWE-79\"]).",
53+
"items": {
54+
"type": "string"
55+
},
56+
"type": "array"
57+
},
58+
"description": {
59+
"description": "A detailed description of the security advisory.",
60+
"type": "string"
61+
},
62+
"owner": {
63+
"description": "The owner of the repository.",
64+
"type": "string"
65+
},
66+
"repo": {
67+
"description": "The name of the repository.",
68+
"type": "string"
69+
},
70+
"severity": {
71+
"description": "The severity of the advisory. Exactly one of severity or cvssVectorString is required.",
72+
"enum": [
73+
"low",
74+
"medium",
75+
"high",
76+
"critical"
77+
],
78+
"type": "string"
79+
},
80+
"startPrivateFork": {
81+
"description": "Whether to create a temporary private fork for collaborating on a fix.",
82+
"type": "boolean"
83+
},
84+
"summary": {
85+
"description": "A short summary of the security advisory.",
86+
"type": "string"
87+
},
88+
"vulnerabilities": {
89+
"description": "Affected products and version ranges.",
90+
"items": {
91+
"properties": {
92+
"package": {
93+
"properties": {
94+
"ecosystem": {
95+
"description": "The package ecosystem.",
96+
"enum": [
97+
"actions",
98+
"composer",
99+
"erlang",
100+
"go",
101+
"maven",
102+
"npm",
103+
"nuget",
104+
"other",
105+
"pip",
106+
"pub",
107+
"rubygems",
108+
"rust",
109+
"swift"
110+
],
111+
"type": "string"
112+
},
113+
"name": {
114+
"description": "The package name.",
115+
"type": "string"
116+
}
117+
},
118+
"required": [
119+
"ecosystem",
120+
"name"
121+
],
122+
"type": "object"
123+
},
124+
"patched_versions": {
125+
"description": "The version that patches the vulnerability.",
126+
"type": "string"
127+
},
128+
"vulnerable_functions": {
129+
"description": "Functions in the package that are affected.",
130+
"items": {
131+
"type": "string"
132+
},
133+
"type": "array"
134+
},
135+
"vulnerable_version_range": {
136+
"description": "The range of affected versions (for example, \"\u003c 2.0.0\").",
137+
"type": "string"
138+
}
139+
},
140+
"required": [
141+
"package"
142+
],
143+
"type": "object"
144+
},
145+
"type": "array"
146+
}
147+
},
148+
"required": [
149+
"owner",
150+
"repo",
151+
"summary",
152+
"description",
153+
"vulnerabilities"
154+
],
155+
"type": "object"
156+
},
157+
"name": "create_repository_security_advisory"
158+
}

‎pkg/github/__toolsnaps__/request_cve_for_repository_security_advisory.snap‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"annotations": {
3+
"openWorldHint": true,
4+
"title": "Request CVE for repository security advisory"
5+
},
6+
"description": "Request a CVE ID from GitHub for a draft repository security advisory.",
7+
"inputSchema": {
8+
"properties": {
9+
"ghsaId": {
10+
"description": "GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx).",
11+
"type": "string"
12+
},
13+
"owner": {
14+
"description": "The owner of the repository.",
15+
"type": "string"
16+
},
17+
"repo": {
18+
"description": "The name of the repository.",
19+
"type": "string"
20+
}
21+
},
22+
"required": [
23+
"owner",
24+
"repo",
25+
"ghsaId"
26+
],
27+
"type": "object"
28+
},
29+
"name": "request_cve_for_repository_security_advisory"
30+
}

0 commit comments

Comments
 (0)