adv_unmark_false_positive

Remove false positive markings from security findings to maintain accurate vulnerability tracking in the Adversary MCP Server.

Instructions

Remove false positive marking from a finding

Input Schema

TableJSON Schema

Name	Required	Description	Default
`finding_uuid`	Yes	UUID of the finding to unmark
`adversary_file_path`	No	Path to .adversary.json file	.adversary.json

Implementation Reference

src/adversary_mcp_server/application/mcp_server.py:551-590 (handler)

Primary MCP tool handler for 'adv_unmark_false_positive'. Validates input parameters (finding_uuid, adversary_file_path), instantiates FalsePositiveJsonRepository and FalsePositiveService, calls service.unmark_false_positive(), formats JSON response with success status.

async def _handle_unmark_false_positive(
    self, name: str, arguments: dict
) -> list[types.TextContent]:
    """Handle unmark false positive requests."""
    try:
        # Comprehensive input validation
        validated_args = self._input_validator.validate_mcp_arguments(
            arguments, tool_name="adv_unmark_false_positive"
        )

        finding_uuid = validated_args.get("finding_uuid", "")
        adversary_file_path = validated_args.get(
            "adversary_file_path", ".adversary.json"
        )

        if not finding_uuid:
            raise CleanAdversaryToolError("finding_uuid parameter is required")

        # Initialize false positive repository and service
        fp_repository = FalsePositiveJsonRepository(adversary_file_path)
        fp_service = FalsePositiveService(fp_repository)

        # Unmark false positive
        success = await fp_service.unmark_false_positive(finding_uuid)

        result = {
            "success": success,
            "finding_uuid": finding_uuid,
            "message": (
                f"Finding {finding_uuid} unmarked as false positive"
                if success
                else f"Failed to unmark finding {finding_uuid} as false positive"
            ),
        }

        return [types.TextContent(type="text", text=json.dumps(result, indent=2))]

    except Exception as e:
        logger.error(f"Unmark false positive failed: {e}")
        raise CleanAdversaryToolError(f"Unmark false positive failed: {str(e)}")

src/adversary_mcp_server/application/mcp_server.py:1582-1599 (registration)

MCP tool registration in get_tools() method, defining the tool name, description, and input schema for adv_unmark_false_positive.

    name="adv_unmark_false_positive",
    description="Remove false positive marking from a finding",
    inputSchema={
        "type": "object",
        "properties": {
            "finding_uuid": {
                "type": "string",
                "description": "UUID of the finding to unmark",
            },
            "adversary_file_path": {
                "type": "string",
                "description": "Path to .adversary.json file",
                "default": ".adversary.json",
            },
        },
        "required": ["finding_uuid"],
    },
),

src/adversary_mcp_server/application/services/false_positive_service.py:79-112 (helper)

Application service layer method implementing business logic for unmarking false positives: input validation, existence check, delegates to repository.remove_false_positive_info.

async def unmark_false_positive(self, uuid: str) -> bool:
    """
    Remove false positive marking from a finding.

    Args:
        uuid: UUID of the finding to unmark

    Returns:
        True if unmarked successfully, False otherwise
    """
    try:
        # Validate input
        if not uuid.strip():
            raise ValueError("UUID cannot be empty")

        # Check if it exists and is marked as false positive
        existing_info = await self.repository.get_false_positive_info(uuid)
        if not existing_info or not existing_info.is_false_positive:
            self.logger.warning(f"Finding {uuid} is not marked as false positive")
            return False

        # Remove false positive marking
        success = await self.repository.remove_false_positive_info(uuid)

        if success:
            self.logger.info(f"Unmarked finding {uuid} as false positive")
        else:
            self.logger.error(f"Failed to unmark finding {uuid} as false positive")

        return success

    except Exception as e:
        self.logger.error(f"Error unmarking finding {uuid} as false positive: {e}")
        return False

src/adversary_mcp_server/infrastructure/false_positive_json_repository.py:187-197 (helper)

Infrastructure repository method that removes false positive marking by overwriting the threat entry in .adversary.json with legitimate finding data using create_legitimate and save_false_positive_info.

async def remove_false_positive_info(self, uuid: str) -> bool:
    """Remove false positive information for a finding."""
    try:
        # Create legitimate finding info to overwrite false positive data
        legitimate_info = FalsePositiveInfo.create_legitimate(uuid)
        return await self.save_false_positive_info(legitimate_info)

    except Exception as e:
        self.logger.error(f"Error removing false positive info for {uuid}: {e}")
        return False

Adversary MCP Server