create_rule

Instructions

Implementation Reference

• src/index.ts:512-547 (handler)

  The handleCreateRule method is the handler for the 'create_rule' tool. It validates required arguments (output_path, pattern, language, message), validates the path and rule fields, constructs a YAML rule string using escapeYamlScalar to prevent YAML injection, and writes the rule file to disk.

  private async handleCreateRule(args: any) {
    if (!args.output_path || !args.pattern || !args.language || !args.message) {
      throw new McpError(
        ErrorCode.InvalidParams,
        'output_path, pattern, language and message are required'
      );
    }
  
    const outputPath = validateAbsolutePath(args.output_path, 'output_path');
    const id = validateRuleField(args.id ?? 'custom_rule', 'id', ALLOWED_RULE_ID);
    const language = validateRuleField(args.language, 'language', ALLOWED_LANGUAGE);
    const severity = validateRuleSeverity(args.severity ?? 'WARNING');
  
    // escapeYamlScalar uses JSON.stringify to escape user values, preventing YAML injection
    const ruleYaml = [
      'rules:',
      `  - id: ${id}`,
      `    pattern: ${escapeYamlScalar(args.pattern)}`,
      `    message: ${escapeYamlScalar(args.message)}`,
      `    languages: [${language}]`,
      `    severity: ${severity}`,
      ''
    ].join('\n');
  
    try {
      await writeFile(outputPath, ruleYaml, 'utf-8');
      return {
        content: [{ type: 'text', text: `Rule successfully created at ${outputPath}` }]
      };
    } catch (error: any) {
      return {
        content: [{ type: 'text', text: `Error creating rule: ${error.message}` }],
        isError: true
      };
    }
  }

• src/index.ts:299-322 (registration)

  The tool 'create_rule' is registered in the ListToolsRequestSchema handler with its name, description, and inputSchema defining required (output_path, pattern, language, message) and optional (severity, id) parameters.

  {
    name: 'create_rule',
    description: 'Creates a new Semgrep rule',
    inputSchema: {
      type: 'object',
      properties: {
        output_path: { type: 'string', description: 'Absolute path for output rule file' },
        pattern: { type: 'string', description: 'Search pattern for the rule' },
        language: { type: 'string', description: 'Target language for the rule' },
        message: { type: 'string', description: 'Message to display when rule matches' },
        severity: {
          type: 'string',
          description: 'Rule severity (ERROR, WARNING, INFO)',
          default: 'WARNING'
        },
        id: {
          type: 'string',
          description: 'Rule identifier',
          default: 'custom_rule'
        }
      },
      required: ['output_path', 'pattern', 'language', 'message']
    }
  },

• src/index.ts:381-383 (registration)

  The tool dispatch in CallToolRequestSchema routes 'create_rule' to the handleCreateRule method.

  case 'create_rule':
    return await this.handleCreateRule(request.params.arguments);
  case 'filter_results':

• src/index.ts:186-191 (helper)

  escapeYamlScalar helper function used by handleCreateRule to safely escape YAML string values using JSON.stringify, preventing YAML injection attacks.

  function escapeYamlScalar(value: string): string {
    if (typeof value !== 'string') {
      throw new McpError(ErrorCode.InvalidParams, 'YAML scalar value must be a string');
    }
    return JSON.stringify(value);
  }

• src/index.ts:161-173 (helper)

  validateRuleField helper function used by handleCreateRule to validate the rule id and language fields against regex patterns (ALLOWED_RULE_ID and ALLOWED_LANGUAGE).

  export function validateRuleField(
    value: string,
    paramName: string,
    pattern: RegExp
  ): string {
    if (typeof value !== 'string' || !pattern.test(value)) {
      throw new McpError(
        ErrorCode.InvalidParams,
        `${paramName} contains invalid characters or exceeds allowed format`
      );
    }
    return value;
  }