vulnerability_scan_check

Instructions

Implementation Reference

• server.py:405-513 (handler)

  The @mcp.tool() decorated function that implements the vulnerability_scan_check tool. It evaluates PCI DSS vulnerability scanning compliance (requirements 11.3, 11.3.1, 11.3.2, 11.3.1.3), checking external/internal scan dates, ASV vendor, scan pass status, quarterly schedule, and post-change scanning. Returns JSON with compliance status and any issues found.

  @mcp.tool()
  def vulnerability_scan_check(
      last_external_scan_date: str = "",
      last_internal_scan_date: str = "",
      external_scan_passed: bool = False,
      internal_scan_passed: bool = False,
      asv_vendor: str = "",
      quarterly_scans: bool = False,
      scan_after_changes: bool = False,
      caller: str = "",
      api_key: str = "",
  ) -> str:
      """Evaluate vulnerability scanning compliance per PCI DSS ASV requirements.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          last_external_scan_date (str): The last external scan date to analyze or process.
          last_internal_scan_date (str): The last internal scan date to analyze or process.
          external_scan_passed (bool): The external scan passed to analyze or process.
          internal_scan_passed (bool): The internal scan passed to analyze or process.
          asv_vendor (str): The asv vendor to analyze or process.
          quarterly_scans (bool): The quarterly scans to analyze or process.
          scan_after_changes (bool): The scan after changes to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      if err := _check_auth(api_key):
          return err
      if err := _rl(caller):
          return err
  
      issues = []
      now = datetime.now()
  
      if last_external_scan_date:
          try:
              ext_date = datetime.strptime(last_external_scan_date, "%Y-%m-%d")
              days_since = (now - ext_date).days
              if days_since > 90:
                  issues.append({"issue": f"External scan {days_since} days old (>90 days)",
                                 "requirement": "11.3.2", "severity": "HIGH"})
          except ValueError:
              issues.append({"issue": "Invalid external scan date format", "severity": "LOW"})
      else:
          issues.append({"issue": "No external scan date provided", "requirement": "11.3.2", "severity": "HIGH"})
  
      if last_internal_scan_date:
          try:
              int_date = datetime.strptime(last_internal_scan_date, "%Y-%m-%d")
              days_since = (now - int_date).days
              if days_since > 90:
                  issues.append({"issue": f"Internal scan {days_since} days old (>90 days)",
                                 "requirement": "11.3.1", "severity": "HIGH"})
          except ValueError:
              issues.append({"issue": "Invalid internal scan date format", "severity": "LOW"})
      else:
          issues.append({"issue": "No internal scan date provided", "requirement": "11.3.1", "severity": "HIGH"})
  
      if not asv_vendor:
          issues.append({"issue": "No ASV vendor specified", "requirement": "11.3.2", "severity": "MEDIUM",
                          "note": "External scans must be performed by a PCI SSC Approved Scanning Vendor"})
  
      if not external_scan_passed:
          issues.append({"issue": "Last external scan did not pass", "requirement": "11.3.2", "severity": "HIGH"})
      if not internal_scan_passed:
          issues.append({"issue": "Last internal scan did not pass", "requirement": "11.3.1", "severity": "HIGH"})
      if not quarterly_scans:
          issues.append({"issue": "Quarterly scanning schedule not maintained", "requirement": "11.3", "severity": "HIGH"})
      if not scan_after_changes:
          issues.append({"issue": "Scans not performed after significant changes", "requirement": "11.3.1.3", "severity": "MEDIUM"})
  
      return json.dumps({
          "assessment_date": now.isoformat(),
          "external_scan": {"last_date": last_external_scan_date, "passed": external_scan_passed, "asv": asv_vendor},
          "internal_scan": {"last_date": last_internal_scan_date, "passed": internal_scan_passed},
          "quarterly_compliance": quarterly_scans,
          "change_scan_compliance": scan_after_changes,
          "compliance_status": "COMPLIANT" if not issues else "NON_COMPLIANT",
          "issues": issues,
      }, indent=2)

• server.py:405-416 (registration)

  The @mcp.tool() decorator registers vulnerability_scan_check as an MCP tool. The FastMCP server instance 'mcp' is created at line 99.

  @mcp.tool()
  def vulnerability_scan_check(
      last_external_scan_date: str = "",
      last_internal_scan_date: str = "",
      external_scan_passed: bool = False,
      internal_scan_passed: bool = False,
      asv_vendor: str = "",
      quarterly_scans: bool = False,
      scan_after_changes: bool = False,
      caller: str = "",
      api_key: str = "",
  ) -> str:

• server.py:406-416 (schema)

  Function signature defines the input schema: last_external_scan_date (str), last_internal_scan_date (str), external_scan_passed (bool), internal_scan_passed (bool), asv_vendor (str), quarterly_scans (bool), scan_after_changes (bool), caller (str), api_key (str). Returns a str (JSON).

  def vulnerability_scan_check(
      last_external_scan_date: str = "",
      last_internal_scan_date: str = "",
      external_scan_passed: bool = False,
      internal_scan_passed: bool = False,
      asv_vendor: str = "",
      quarterly_scans: bool = False,
      scan_after_changes: bool = False,
      caller: str = "",
      api_key: str = "",
  ) -> str: