check_vulnerabilities
Identify security vulnerabilities in project dependencies to enhance code safety and prevent potential exploits.
Instructions
Check for security vulnerabilities in dependencies
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| projectPath | No | Path to project root |
Implementation Reference
- src/tools/dependency-analysis.ts:136-148 (handler)Handler for the 'check_vulnerabilities' tool. Calls DependencyAnalyzer.analyzeDependencies with vulnerability check enabled and returns summarized vulnerability report.
case 'check_vulnerabilities': { const report = await analyzer.analyzeDependencies(projectPath, { checkUnused: false, checkOutdated: false, checkVulnerabilities: true, }); return { vulnerabilities: report.vulnerabilities, total: report.vulnerabilities.length, critical: report.vulnerabilities.filter((v) => v.severity === 'critical').length, high: report.vulnerabilities.filter((v) => v.severity === 'high').length, }; } - Input schema and metadata definition for the 'check_vulnerabilities' tool.
{ name: 'check_vulnerabilities', description: 'Check for security vulnerabilities in dependencies', inputSchema: { type: 'object', properties: { projectPath: { type: 'string', description: 'Path to project root', }, }, }, }, - src/server.ts:66-67 (registration)MCP server registration and routing logic that matches the tool name against dependencyAnalysisTools (including 'check_vulnerabilities') and dispatches to the handler.
} else if (dependencyAnalysisTools.some((t) => t.name === name)) { result = await handleDependencyAnalysisTool(name, args || {}); - Core helper method findVulnerabilities that performs the vulnerability scan (currently stubbed, comments indicate npm audit usage). Called when checkVulnerabilities option is true.
private async findVulnerabilities(_projectPath: string): Promise<Vulnerability[]> { // This is a simplified version. In production, we'd use npm audit // For now, return empty array - actual implementation would require npm audit API try { // Would use: const { execSync } = require('child_process'); // const auditResult = JSON.parse(execSync('npm audit --json', { cwd: projectPath }).toString()); // return parseAuditResults(auditResult); return []; } catch { return []; } } - src/types/index.ts:60-67 (schema)TypeScript interface defining the structure of Vulnerability objects returned by the tool.
export interface Vulnerability { name: string; severity: 'low' | 'moderate' | 'high' | 'critical'; title: string; url: string; dependencyOf?: string; fixAvailable?: boolean; }