list_image_vulnerabilities
Scan and identify vulnerabilities in container images with optional severity filtering, enabling targeted security assessments within Kubernetes and cloud environments.
Instructions
List vulnerabilities in a container image with optional filtering by severity
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| digest | Yes | Image digest (required for vulnerabilities) | |
| page | No | Page number for pagination | |
| page_size | No | Number of items per page | |
| severities | No | List of severity levels to filter |
Implementation Reference
- src/operations/images.ts:67-101 (handler)Main handler function that fetches the latest scan for the image digest and retrieves its vulnerabilities, filtering by severities if provided, and removes CPEs from results.export async function listImageVulnerabilities( client: RadSecurityClient, digest: string, severities?: string[], page: number = 1, page_size: number = 20 ): Promise<any> { const params: Record<string, any> = { page, page_size, sort: "severity:desc" }; if (severities && severities.length > 0) { params.severities = severities.join(","); } const scans = await listImageScans(client, digest); if (!scans || !scans.entries || scans.entries.length === 0) { throw new Error(`Image with digest: ${digest} hasn't been scanned yet`); } // Get the latest scan const scanId = scans.entries[0].id; const vulns = await client.makeRequest( `/accounts/${client.getAccountId()}/images/${digest}/scans/${scanId}/vulnerabilities`, params ); // Remove CPEs to reduce context window size when used with LLMs vulns.entries.forEach((vuln: any) => { if (vuln.cpes) { delete vuln.cpes; } }); return vulns; }
- src/operations/images.ts:12-17 (schema)Zod schema defining the input parameters for the list_image_vulnerabilities tool.export const ListImageVulnerabilitiesSchema = z.object({ digest: z.string().describe("Image digest (required for vulnerabilities)"), severities: z.array(z.string()).optional().describe("List of severity levels to filter"), page: z.number().optional().default(1).describe("Page number for pagination"), page_size: z.number().optional().default(100).describe("Number of items per page"), });
- src/index.ts:190-194 (registration)Tool registration in the listTools response, specifying name, description, and input schema.{ name: "list_image_vulnerabilities", description: "List vulnerabilities in a container image with optional filtering by severity", inputSchema: zodToJsonSchema(images.ListImageVulnerabilitiesSchema), },
- src/index.ts:531-543 (registration)Dispatch case in the CallToolRequest handler that parses arguments and calls the listImageVulnerabilities function.case "list_image_vulnerabilities": { const args = images.ListImageVulnerabilitiesSchema.parse(request.params.arguments); const response = await images.listImageVulnerabilities( client, args.digest, args.severities, args.page, args.page_size ); return { content: [{ type: "text", text: JSON.stringify(response, null, 2) }], }; }