ironbank_lookup

Instructions

Implementation Reference

• src/tools/platform-one/ironbank-lookup.ts:31-69 (handler)

  The handler function `handleIronbankLookup` that executes the ironbank_lookup tool logic. It validates args with Zod schema, then calls Anthropic Claude with the PLATFORM_ONE_SYSTEM prompt to look up Iron Bank hardened container image details (registry path, version, cosign commands, CVE status, pull secrets, etc.) via an LLM prompt.

  export async function handleIronbankLookup(args: unknown): Promise<string> {
    return runTool('ironbank_lookup', args, Schema, async ({ imageName, version }) => {
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('ironbank_lookup'),
        system: PLATFORM_ONE_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Look up the Iron Bank hardened container image for: **${imageName}**${version ? ` version ${version}` : ' (latest approved version)'}
  
  Provide:
  1. **Iron Bank Registry Path** — full registry1.dso.mil path (e.g., registry1.dso.mil/ironbank/opensource/nginx/nginx:1.25.3)
  2. **Latest Approved Version** — version number and approval date
  3. **Image Digest** — SHA256 digest for pinning (e.g., sha256:abc123...)
  4. **Cosign Verification Commands**:
     \`\`\`bash
     cosign verify --key https://ironbank.dso.mil/cosign.pub registry1.dso.mil/ironbank/...
     \`\`\`
  5. **CVE Status** — known CVE count (Critical/High/Medium/Low), last scan date
  6. **Iron Bank Approval Status** — Approved / Conditionally Approved / In Progress
  7. **Pull Secret Configuration**:
     - How to create the imagePullSecret for registry1.dso.mil
     - Kubernetes secret YAML
     - Docker config.json format
  8. **Kubernetes Image Reference** — exact string to use in pod spec with digest pin
  9. **Alternative Images** — if multiple IB variants exist (e.g., UBI-based vs Alpine)
  10. **Chainguard Alternative** — if a Chainguard equivalent exists (cgr.dev path)
  11. **Known Limitations or Caveats** — configuration differences from upstream image, required init containers, etc.
  12. **Big Bang Values Reference** — where this image appears in Big Bang values.yaml (if applicable)
  
  Use accurate Iron Bank registry paths under registry1.dso.mil/ironbank/. Common namespaces: ironbank/opensource/, ironbank/redhat/, ironbank/google/, ironbank/elastic/, ironbank/hashicorp/`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/platform-one/ironbank-lookup.ts:26-29 (schema)

  Zod validation schema (`Schema`) for ironbank_lookup: requires `imageName` (string 1-500 chars) and optional `version` (string max 500 chars).

  const Schema = z.object({
    imageName: z.string().min(1).max(500),
    version: z.string().max(500).optional(),
  });

• src/tools/platform-one/ironbank-lookup.ts:6-24 (registration)

  The tool definition object `ironbankLookupTool` with name 'ironbank_lookup', description, and JSON Schema input schema (imageName required, version optional).

  export const ironbankLookupTool = {
    name: 'ironbank_lookup',
    description:
      'Look up Iron Bank hardened container images for any application. Returns the correct registry1.dso.mil registry path, latest approved version, Cosign verification commands, and pull secret configuration.',
    inputSchema: {
      type: 'object' as const,
      properties: {
        imageName: {
          type: 'string',
          description: 'Application or image name e.g. "nginx", "postgres", "redis", "grafana"',
        },
        version: {
          type: 'string',
          description: 'Specific version to look up (optional — returns latest approved if omitted)',
        },
      },
      required: ['imageName'],
    },
  };

• src/tools/index.ts:17-87 (registration)

  Import and re-export: `ironbankLookupTool` is added to the `allTools` array (line 47) and `handleIronbankLookup` is dispatched in the `handleToolCall` switch/case (line 76) when tool name is 'ironbank_lookup'.

  import { ironbankLookupTool, handleIronbankLookup } from './platform-one/ironbank-lookup.js';
  import { addonConfiguratorTool, handleAddonConfigurator } from './platform-one/addon-configurator.js';
  
  import { pipelineAuditTool, handlePipelineAudit } from './pipeline/pipeline-audit.js';
  import { signingConfigTool, handleSigningConfig } from './pipeline/signing-config.js';
  import { devsecopsScoreCardTool, handleDevsecopsScorecard } from './pipeline/devsecops-scorecard.js';
  
  import { sspSectionTool, handleSspSection } from './documents/ssp-section.js';
  import { contingencyPlanTool, handleContingencyPlan } from './documents/contingency-plan.js';
  
  import { govcloudQuickstartTool, handleGovcloudQuickstart } from './govcloud-quickstart.js';
  
  export const allTools = [
    // Compliance
    bicepAnalyzeTool,
    bicepRemediateTool,
    controlLookupTool,
    controlNarrativeTool,
    poamGenerateTool,
    atoReadinessTool,
    oscalFragmentTool,
    // Architecture
    landingZoneTool,
    landingZoneReferenceTool,
    serviceSelectTool,
    gccHighTool,
    privateEndpointTool,
    // Platform One
    bigbangValidateTool,
    bigbangHardenTool,
    ironbankLookupTool,
    addonConfiguratorTool,
    // Pipeline
    pipelineAuditTool,
    signingConfigTool,
    devsecopsScoreCardTool,
    // Documents
    sspSectionTool,
    contingencyPlanTool,
    // Meta
    govcloudQuickstartTool,
  ];
  
  export async function handleToolCall(name: string, args: unknown): Promise<string> {
    switch (name) {
      case 'bicep_analyze':         return handleBicepAnalyze(args);
      case 'bicep_remediate':       return handleBicepRemediate(args);
      case 'control_lookup':        return handleControlLookup(args);
      case 'control_narrative':     return handleControlNarrative(args);
      case 'poam_generate':         return handlePoamGenerate(args);
      case 'ato_readiness':         return handleAtoReadiness(args);
      case 'oscal_fragment':        return handleOscalFragment(args);
      case 'landing_zone_design':   return handleLandingZone(args);
      case 'landing_zone_reference': return handleLandingZoneReference(args);
      case 'azure_service_selector': return handleServiceSelect(args);
      case 'gcc_high_guidance':     return handleGccHigh(args);
      case 'private_endpoint_map':  return handlePrivateEndpoint(args);
      case 'bigbang_validate':      return handleBigbangValidate(args);
      case 'bigbang_harden':        return handleBigbangHarden(args);
      case 'ironbank_lookup':       return handleIronbankLookup(args);
      case 'addon_configurator':    return handleAddonConfigurator(args);
      case 'pipeline_audit':        return handlePipelineAudit(args);
      case 'signing_config':        return handleSigningConfig(args);
      case 'devsecops_scorecard':   return handleDevsecopsScorecard(args);
      case 'ssp_section':           return handleSspSection(args);
      case 'contingency_plan':      return handleContingencyPlan(args);
      case 'govcloud_quickstart':   return handleGovcloudQuickstart(args);
      default:
        throw new Error(`Unknown tool: ${name}`);
    }
  }

• src/utils/tool-runner.ts:28-31 (helper)

  Configuration helpers for ironbank_lookup: token budget of 1024 (line 28) and timeout of 15000ms (line 35).

    ironbank_lookup: 1024,
    govcloud_quickstart: 1024,
    bicep_analyze: 4096,
  };

• src/utils/response-validator.ts:23-31 (helper)

  Response validation: ironbank_lookup has a minimum length requirement of 200 characters.

    ironbank_lookup: 200,
    addon_configurator: 300,
    gcc_high_guidance: 300,
    private_endpoint_map: 300,
    azure_service_selector: 200,
    signing_config: 300,
    devsecops_scorecard: 300,
    govcloud_quickstart: 200,
  };