deepsource_compliance_report
Generate security compliance reports for DeepSource projects, covering standards like OWASP Top 10, SANS Top 25, and MISRA-C. Analyze issue statistics, compliance status, trends, and receive actionable recommendations to enhance code security.
Instructions
Get security compliance reports from a DeepSource project.
This tool provides access to industry-standard security compliance reports including:
OWASP Top 10: Common web application security vulnerabilities
SANS Top 25: Most dangerous software errors
MISRA-C: Guidelines for safety-critical software in C
The response includes:
Comprehensive statistics about security issues by category and severity
Compliance status (passing/failing)
Recommendations for improving security posture
Trend data showing changes over time
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| projectKey | Yes | The unique identifier for the DeepSource project | |
| reportType | Yes | The type of compliance report to fetch (OWASP_TOP_10, SANS_TOP_25, or MISRA_C) |
Implementation Reference
- Main handler function that orchestrates the execution of the deepsource compliance report tool by creating domain dependencies (repository, logger) and invoking the repository-based handler logic.export async function handleDeepsourceComplianceReport(params: DeepsourceComplianceReportParams) { const baseDeps = createDefaultHandlerDeps({ logger }); const apiKey = baseDeps.getApiKey(); const repositoryFactory = new RepositoryFactory({ apiKey }); const complianceReportRepository = repositoryFactory.createComplianceReportRepository(); const deps: ComplianceReportHandlerDeps = { complianceReportRepository, logger, }; const handler = createComplianceReportHandlerWithRepo(deps); const result = await handler(params); // If the domain handler returned an error response, throw an error for backward compatibility if (result.isError) { const firstContent = result.content[0]; if (firstContent) { const errorData = JSON.parse(firstContent.text); throw new Error(errorData.error); } else { throw new Error('Unknown compliance report error'); } } return result; }
- Zod schema definition for the 'compliance_report' tool, including input parameters (projectKey, reportType) and detailed output schema for the compliance report data.export const complianceReportToolSchema = { name: 'compliance_report', description: 'Get security compliance reports from a DeepSource project', inputSchema: { projectKey: z.string().describe('DeepSource project key to identify the project'), reportType: z.nativeEnum(ReportType).describe('Type of compliance report to fetch'), }, outputSchema: { key: z.string(), title: z.string(), currentValue: z.number().nullable(), status: z.string(), securityIssueStats: z.array( z.object({ key: z.string(), title: z.string(), occurrence: z.object({ critical: z.number(), major: z.number(), minor: z.number(), total: z.number(), }), }) ), trends: z.record(z.string(), z.unknown()).optional(), analysis: z.object({ summary: z.string(), status_explanation: z.string(), critical_issues: z.number(), major_issues: z.number(), minor_issues: z.number(), total_issues: z.number(), }), recommendations: z.object({ actions: z.array(z.string()), resources: z.array(z.string()), }), }, };
- src/server/tool-registration.ts:102-107 (registration)Registration of the compliance_report tool handler in the TOOL_HANDLERS object, which maps tool calls to the handleDeepsourceComplianceReport function.compliance_report: async (params: unknown) => { const typedParams = params as Record<string, unknown>; return handleDeepsourceComplianceReport({ projectKey: typedParams.projectKey as string, reportType: typedParams.reportType as ReportType, });
- TypeScript interface defining the input parameters expected by the handler functions.export interface DeepsourceComplianceReportParams { /** DeepSource project key to identify the project */ projectKey: string; /** Type of compliance report to fetch */ reportType: ReportType; }
- Adapter function that converts raw MCP tool parameters to the typed DeepsourceComplianceReportParams for the handler.export function adaptComplianceReportParams(params: unknown): DeepsourceComplianceReportParams { const typedParams = params as Record<string, unknown>; return { projectKey: typedParams.projectKey as string, // Handler still expects string reportType: typedParams.reportType as ReportType, }; }