list_findings
Retrieve findings from the last security audit of a Supabase project. Filter by severity to inspect critical, high, medium, low, or info issues.
Instructions
List findings from the last audit of a project, optionally filtered by severity. Use after audit_project to inspect specific issues.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| project_ref | Yes | ||
| severity | No |
Implementation Reference
- src/server.js:65-84 (handler)The handler function for the list_findings tool. It retrieves findings from the in-memory cache (populated by the audit_project tool), optionally filters by severity, and returns a formatted list with index numbers, severity, title, and target.
server.registerTool( "list_findings", { description: "List findings from the last audit of a project, optionally filtered by severity. Use after audit_project to inspect specific issues.", inputSchema: { project_ref: z.string(), severity: z.enum(["critical", "high", "medium", "low", "info"]).optional(), }, }, async ({ project_ref, severity }) => { const c = cache.get(project_ref); if (!c) return { content: [{ type: "text", text: `No cached audit for ${project_ref}. Run audit_project first.` }], isError: true }; const filtered = severity ? c.result.findings.filter((f) => f.severity === severity) : c.result.findings; return { content: [ { type: "text", text: `${filtered.length} finding(s)${severity ? ` at severity=${severity}` : ""}:` }, { type: "text", text: filtered.map((f, i) => `[${i}] ${f.severity.toUpperCase()} — ${f.title} — target: ${f.target}`).join("\n") || "(none)" }, ], }; } - src/server.js:69-72 (schema)Input schema for list_findings. Accepts project_ref (required string) and severity (optional enum: critical/high/medium/low/info) for filtering findings.
inputSchema: { project_ref: z.string(), severity: z.enum(["critical", "high", "medium", "low", "info"]).optional(), }, - src/server.js:65-85 (registration)Registration of the list_findings tool with the MCP server via server.registerTool().
server.registerTool( "list_findings", { description: "List findings from the last audit of a project, optionally filtered by severity. Use after audit_project to inspect specific issues.", inputSchema: { project_ref: z.string(), severity: z.enum(["critical", "high", "medium", "low", "info"]).optional(), }, }, async ({ project_ref, severity }) => { const c = cache.get(project_ref); if (!c) return { content: [{ type: "text", text: `No cached audit for ${project_ref}. Run audit_project first.` }], isError: true }; const filtered = severity ? c.result.findings.filter((f) => f.severity === severity) : c.result.findings; return { content: [ { type: "text", text: `${filtered.length} finding(s)${severity ? ` at severity=${severity}` : ""}:` }, { type: "text", text: filtered.map((f, i) => `[${i}] ${f.severity.toUpperCase()} — ${f.title} — target: ${f.target}`).join("\n") || "(none)" }, ], }; } ); - src/server.js:25-25 (helper)In-memory cache map that stores audit results per project_ref, enabling list_findings to retrieve findings without re-running the audit.
const cache = new Map(); // ref -> { result, ts }