Reports MCP Server

Instructions

Implementation Reference

• server.js:587-652 (handler)

  The handler function that retrieves all vulnerabilities for a specific report ID by making an authenticated GET request to the /vulnerability/report/{reportId} endpoint. Validates reportId format, handles errors, and returns formatted JSON response.

  async function getVulnerabilities(providedToken, reportId) {
    try {
      const bearerToken = getBearerToken(providedToken);
      
      // Validate reportId format (should be MongoDB ObjectId)
      if (!reportId || !reportId.match(/^[0-9a-fA-F]{24}$/)) {
        throw new McpError(
          ErrorCode.InvalidParams,
          'Invalid reportId format. Must be a valid MongoDB ObjectId (24 characters)'
        );
      }
  
      const response = await axios.get(`${VULNERABILITY_ENDPOINT}/report/${reportId}`, {
        headers: {
          'Authorization': `Bearer ${bearerToken}`,
          'Content-Type': 'application/json',
        },
        timeout: 10000,
      });
  
      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify({
              success: true,
              status: response.status,
              data: response.data,
              timestamp: new Date().toISOString(),
              message: `Retrieved vulnerabilities for report ${reportId}`,
            }, null, 2),
          },
        ],
      };
    } catch (error) {
      if (error instanceof McpError) {
        throw error;
      }
      
      if (error.response) {
        return {
          content: [
            {
              type: 'text',
              text: JSON.stringify({
                success: false,
                status: error.response.status,
                error: error.response.data || error.message,
                timestamp: new Date().toISOString(),
              }, null, 2),
            },
          ],
        };
      } else if (error.request) {
        throw new McpError(
          ErrorCode.InternalError,
          `Network error: Unable to reach the API at ${VULNERABILITY_ENDPOINT}/report/${reportId}`
        );
      } else {
        throw new McpError(
          ErrorCode.InternalError,
          `Request setup error: ${error.message}`
        );
      }
    }
  }

• server.js:992-1008 (schema)

  Input schema definition for the get_vulnerabilities tool, specifying parameters bearerToken (optional) and required reportId.

    name: 'get_vulnerabilities',
    description: 'Retrieve all vulnerabilities for a specific report',
    inputSchema: {
      type: 'object',
      properties: {
        bearerToken: {
          type: 'string',
          description: 'Bearer token for authentication (optional if REPORTS_JWT_TOKEN env var is set)',
        },
        reportId: {
          type: 'string',
          description: 'The ID of the report to get vulnerabilities from (24-character MongoDB ObjectId)',
        },
      },
      required: ['reportId'],
    },
  },

• server.js:1145-1152 (registration)

  Tool registration and dispatching in the CallToolRequestHandler switch statement, which validates arguments and calls the getVulnerabilities handler.

  case 'get_vulnerabilities':
    if (!args.reportId) {
      throw new McpError(
        ErrorCode.InvalidParams,
        'Report ID is required'
      );
    }
    return await getVulnerabilities(args.bearerToken, args.reportId);

• server.js:36-52 (helper)

  Helper function used by getVulnerabilities to obtain the bearer token for API authentication, falling back to environment variable if not provided.

  function getBearerToken(providedToken) {
    // If a token is provided in the request, use it
    if (providedToken) {
      return providedToken;
    }
    
    // Otherwise, use the configured JWT token
    if (JWT_TOKEN) {
      return JWT_TOKEN;
    }
    
    // If no token is available, throw an error
    throw new McpError(
      ErrorCode.InvalidParams,
      'No bearer token provided. Either pass bearerToken parameter or set REPORTS_JWT_TOKEN environment variable.'
    );
  }