Skip to content

Commit 709eff1

Browse files
rootcursoragent
root
and
cursoragent
committed
Add MCP tools for repository security advisory lifecycle
Expose create, update, and CVE request operations in the security_advisories toolset so security teams can manage advisories without leaving MCP workflows. Closes #2506 Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 457f599 commit 709eff1

8 files changed

Lines changed: 1397 additions & 5 deletions

‎README.md‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1122,7 +1122,7 @@ The following sets of tools are available:
11221122
2. get_diff - Get the diff of a pull request.
11231123
3. get_status - Get combined commit status of a head commit in a pull request.
11241124
4. get_files - Get the list of files changed in a pull request. Use with pagination parameters to control the number of results returned.
1125-
5. get_review_comments - Get review threads on a pull request. Each thread contains logically grouped review comments made on the same code location during pull request reviews. Returns threads with metadata (isResolved, isOutdated, isCollapsed) and their associated comments. Use cursor-based pagination (perPage, after) to control results.
1125+
5. get_review_comments - Get review threads on a pull request. Each thread contains logically grouped review comments made on the same code location during pull request reviews. Returns threads with metadata (isResolved, isOutdated, isCollapsed) and their associated comments. Review comments include structured code suggestions when available, including Copilot-generated "Suggest" changesets (via thread partial) and human-authored suggestion code blocks in the comment body. Use cursor-based pagination (perPage, after) to control results.
11261126
6. get_reviews - Get the reviews on a pull request. When asked for review comments, use get_review_comments method. Use with pagination parameters to control the number of results returned.
11271127
7. get_comments - Get comments on a pull request. Use this if user doesn't specifically want review comments. Use with pagination parameters to control the number of results returned.
11281128
8. get_check_runs - Get check runs for the head commit of a pull request. Check runs are the individual CI/CD jobs and checks that run on the PR.
@@ -1357,6 +1357,21 @@ The following sets of tools are available:
13571357

13581358
<summary><picture><source media="(prefers-color-scheme: dark)" srcset="pkg/octicons/icons/shield-dark.png"><source media="(prefers-color-scheme: light)" srcset="pkg/octicons/icons/shield-light.png"><img src="pkg/octicons/icons/shield-light.png" width="20" height="20" alt="shield"></picture> Security Advisories</summary>
13591359

1360+
- **create_repository_security_advisory** - Create repository security advisory
1361+
- **Required OAuth Scopes**: `security_events`
1362+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1363+
- `credits`: Users credited for the advisory. (object[], optional)
1364+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1365+
- `cvssVectorString`: The CVSS vector string for the advisory. (string, optional)
1366+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). (string[], optional)
1367+
- `description`: A detailed description of the security advisory. (string, required)
1368+
- `owner`: The owner of the repository. (string, required)
1369+
- `repo`: The name of the repository. (string, required)
1370+
- `severity`: The severity of the advisory. (string, optional)
1371+
- `startPrivateFork`: Whether to create a temporary private fork for collaborating on a fix. (boolean, optional)
1372+
- `summary`: A short summary of the security advisory. (string, required)
1373+
- `vulnerabilities`: Affected products and version ranges. (object[], required)
1374+
13601375
- **get_global_security_advisory** - Get a global security advisory
13611376
- **Required OAuth Scopes**: `security_events`
13621377
- **Accepted OAuth Scopes**: `repo`, `security_events`
@@ -1394,6 +1409,29 @@ The following sets of tools are available:
13941409
- `sort`: Sort field. (string, optional)
13951410
- `state`: Filter by advisory state. (string, optional)
13961411

1412+
- **request_cve_for_repository_security_advisory** - Request CVE for repository security advisory
1413+
- **Required OAuth Scopes**: `security_events`
1414+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1415+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1416+
- `owner`: The owner of the repository. (string, required)
1417+
- `repo`: The name of the repository. (string, required)
1418+
1419+
- **update_repository_security_advisory** - Update repository security advisory
1420+
- **Required OAuth Scopes**: `security_events`
1421+
- **Accepted OAuth Scopes**: `repo`, `security_events`
1422+
- `credits`: Users credited for the advisory. (object[], optional)
1423+
- `cveId`: The CVE ID to assign to the advisory. (string, optional)
1424+
- `cvssVectorString`: The CVSS vector string for the advisory. (string, optional)
1425+
- `cweIds`: Common Weakness Enumeration IDs (for example, ["CWE-79"]). (string[], optional)
1426+
- `description`: A detailed description of the security advisory. (string, optional)
1427+
- `ghsaId`: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
1428+
- `owner`: The owner of the repository. (string, required)
1429+
- `repo`: The name of the repository. (string, required)
1430+
- `severity`: The severity of the advisory. (string, optional)
1431+
- `state`: The advisory state. Set to "published" to publish the advisory. (string, optional)
1432+
- `summary`: A short summary of the security advisory. (string, optional)
1433+
- `vulnerabilities`: Affected products and version ranges. (object[], optional)
1434+
13971435
</details>
13981436

13991437
<details>

‎pkg/github/__toolsnaps__/create_repository_security_advisory.snap‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
{
2+
"annotations": {
3+
"title": "Create repository security advisory"
4+
},
5+
"description": "Create a draft repository security advisory.",
6+
"inputSchema": {
7+
"properties": {
8+
"credits": {
9+
"description": "Users credited for the advisory.",
10+
"items": {
11+
"properties": {
12+
"login": {
13+
"description": "The GitHub username of the credited user.",
14+
"type": "string"
15+
},
16+
"type": {
17+
"description": "The credit type.",
18+
"enum": [
19+
"analyst",
20+
"finder",
21+
"reporter",
22+
"coordinator",
23+
"remediation_developer",
24+
"remediation_reviewer",
25+
"remediation_verifier",
26+
"tool",
27+
"sponsor",
28+
"other"
29+
],
30+
"type": "string"
31+
}
32+
},
33+
"required": [
34+
"login",
35+
"type"
36+
],
37+
"type": "object"
38+
},
39+
"type": "array"
40+
},
41+
"cveId": {
42+
"description": "The CVE ID to assign to the advisory.",
43+
"type": "string"
44+
},
45+
"cvssVectorString": {
46+
"description": "The CVSS vector string for the advisory.",
47+
"type": "string"
48+
},
49+
"cweIds": {
50+
"description": "Common Weakness Enumeration IDs (for example, [\"CWE-79\"]).",
51+
"items": {
52+
"type": "string"
53+
},
54+
"type": "array"
55+
},
56+
"description": {
57+
"description": "A detailed description of the security advisory.",
58+
"type": "string"
59+
},
60+
"owner": {
61+
"description": "The owner of the repository.",
62+
"type": "string"
63+
},
64+
"repo": {
65+
"description": "The name of the repository.",
66+
"type": "string"
67+
},
68+
"severity": {
69+
"description": "The severity of the advisory.",
70+
"enum": [
71+
"low",
72+
"medium",
73+
"high",
74+
"critical"
75+
],
76+
"type": "string"
77+
},
78+
"startPrivateFork": {
79+
"description": "Whether to create a temporary private fork for collaborating on a fix.",
80+
"type": "boolean"
81+
},
82+
"summary": {
83+
"description": "A short summary of the security advisory.",
84+
"type": "string"
85+
},
86+
"vulnerabilities": {
87+
"description": "Affected products and version ranges.",
88+
"items": {
89+
"properties": {
90+
"package": {
91+
"properties": {
92+
"ecosystem": {
93+
"description": "The package ecosystem.",
94+
"enum": [
95+
"actions",
96+
"composer",
97+
"erlang",
98+
"go",
99+
"maven",
100+
"npm",
101+
"nuget",
102+
"other",
103+
"pip",
104+
"pub",
105+
"rubygems",
106+
"rust",
107+
"swift"
108+
],
109+
"type": "string"
110+
},
111+
"name": {
112+
"description": "The package name.",
113+
"type": "string"
114+
}
115+
},
116+
"required": [
117+
"ecosystem"
118+
],
119+
"type": "object"
120+
},
121+
"patched_versions": {
122+
"description": "The version that patches the vulnerability.",
123+
"type": "string"
124+
},
125+
"vulnerable_functions": {
126+
"description": "Functions in the package that are affected.",
127+
"items": {
128+
"type": "string"
129+
},
130+
"type": "array"
131+
},
132+
"vulnerable_version_range": {
133+
"description": "The range of affected versions (for example, \"\u003c 2.0.0\").",
134+
"type": "string"
135+
}
136+
},
137+
"required": [
138+
"package"
139+
],
140+
"type": "object"
141+
},
142+
"type": "array"
143+
}
144+
},
145+
"required": [
146+
"owner",
147+
"repo",
148+
"summary",
149+
"description",
150+
"vulnerabilities"
151+
],
152+
"type": "object"
153+
},
154+
"name": "create_repository_security_advisory"
155+
}

‎pkg/github/__toolsnaps__/request_cve_for_repository_security_advisory.snap‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"annotations": {
3+
"title": "Request CVE for repository security advisory"
4+
},
5+
"description": "Request a CVE ID from GitHub for a draft repository security advisory.",
6+
"inputSchema": {
7+
"properties": {
8+
"ghsaId": {
9+
"description": "GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx).",
10+
"type": "string"
11+
},
12+
"owner": {
13+
"description": "The owner of the repository.",
14+
"type": "string"
15+
},
16+
"repo": {
17+
"description": "The name of the repository.",
18+
"type": "string"
19+
}
20+
},
21+
"required": [
22+
"owner",
23+
"repo",
24+
"ghsaId"
25+
],
26+
"type": "object"
27+
},
28+
"name": "request_cve_for_repository_security_advisory"
29+
}

0 commit comments

Comments
 (0)