generate_remediation
Provides actionable remediation guidance for security findings to address vulnerabilities and ensure compliance with industry standards.
Instructions
Generate actionable remediation advice for findings
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| findingIds | No | IDs of findings to generate remediation for |
Implementation Reference
- src/core/server.ts:157-171 (registration)Tool registration including name, description, and input schema in the ListTools response.{ name: 'generate_remediation', description: 'Generate actionable remediation advice for findings', inputSchema: { type: 'object', properties: { findingIds: { type: 'array', items: { type: 'string' }, description: 'IDs of findings to generate remediation for' }, }, required: [], }, },
- src/core/server.ts:528-552 (handler)The main handler function for the 'generate_remediation' tool, which delegates to RemediationAdvisor.private async handleGenerateRemediation(_args: any): Promise<any> { // Get recent scan results or specific findings // For demo, we'll generate advice for sample findings const sampleFindings = [ { id: 'sample_001', type: 'dependency', severity: 'high' as const, title: 'Vulnerable dependency: lodash@4.17.19', description: 'Known security vulnerability CVE-2021-23337', location: { file: 'package.json' }, cve: 'CVE-2021-23337', }, ]; const plan = await this.remediationAdvisor.generateRemediationPlan(sampleFindings); const markdown = this.remediationAdvisor.generateMarkdownReport(plan); return { status: 'success', remediations: plan.remediations.length, summary: plan.summary, report: markdown, }; }
- Core implementation of remediation plan generation, called by the tool handler.async generateRemediationPlan(findings: Finding[]): Promise<RemediationPlan> { const remediations: RemediationAdvice[] = []; for (const finding of findings) { const advice = await this.generateRemediationAdvice(finding); remediations.push(advice); } // Categorize by priority const prioritizedActions = { immediate: remediations.filter(r => r.priority === 'immediate'), high: remediations.filter(r => r.priority === 'high'), medium: remediations.filter(r => r.priority === 'medium'), low: remediations.filter(r => r.priority === 'low'), }; // Calculate summary const autoFixable = remediations.filter(r => r.effort === 'trivial').length; const immediateActions = prioritizedActions.immediate.length; const totalEffort = this.calculateTotalEffort(remediations); return { findings, remediations, summary: { totalFindings: findings.length, autoFixable, immediateActions, estimatedEffort: totalEffort, }, prioritizedActions, }; }
- Type definition for the RemediationPlan output structure.export interface RemediationPlan { findings: Finding[]; remediations: RemediationAdvice[]; summary: { totalFindings: number; autoFixable: number; immediateActions: number; estimatedEffort: string; }; prioritizedActions: { immediate: RemediationAdvice[]; high: RemediationAdvice[]; medium: RemediationAdvice[]; low: RemediationAdvice[]; }; }
- Helper function that generates detailed remediation advice for individual findings.private async generateRemediationAdvice(finding: Finding): Promise<RemediationAdvice> { // Determine remediation type based on finding const remediationType = this.determineRemediationType(finding); const baseRemediation = this.remediationDatabase.get(remediationType); // Determine priority based on severity const priority = this.determinePriority(finding); // Build customized advice const advice: RemediationAdvice = { findingId: finding.id, priority, effort: baseRemediation?.effort || this.estimateEffort(finding), automaticFix: baseRemediation?.automaticFix, manualSteps: baseRemediation?.manualSteps, codeExample: baseRemediation?.codeExample, references: baseRemediation?.references || this.getDefaultReferences(finding.type), estimatedTime: baseRemediation?.estimatedTime || this.estimateTime(finding), tools: baseRemediation?.tools, preventionTips: this.generatePreventionTips(finding), }; // Customize advice based on specific finding details if (finding.type === 'dependency' && finding.cve) { advice.automaticFix = `Update to version that patches ${finding.cve}`; advice.references = [ `https://nvd.nist.gov/vuln/detail/${finding.cve}`, ...advice.references || [], ]; } if (finding.type === 'secret') { advice.priority = 'immediate'; // Secrets are always immediate priority advice.manualSteps = [ `Immediately rotate the exposed ${this.identifySecretType(finding.title)}`, ...advice.manualSteps || [], ]; } return advice; }