konsulto_update_finding

Instructions

Implementation Reference

• src/server.ts:479-519 (registration)

  Registration of the 'konsulto_update_finding' tool via server.tool() with name, description, Zod schema, and handler callback.

  server.tool(
    'konsulto_update_finding',
    'Update scalar fields on an existing finding. Use this for changing ' +
      'title, severity, status, taxonomy, or assets — NOT for editing the ' +
      'prose body (use konsulto_append_to_section / konsulto_replace_section ' +
      'for that). NOT for evidence (use konsulto_add_evidence_to_finding).',
    {
      findingId: z.string(),
      patch: z
        .object({
          title: z.string().optional(),
          severity: z
            .enum(['critical', 'high', 'medium', 'low', 'informative'])
            .optional(),
          status: z
            .enum(['open', 'accepted', 'mitigated', 'closed', 'rejected'])
            .optional(),
          taxonomy: z.any().optional(),
          assets: z.array(z.any()).optional(),
        })
        .passthrough(),
    },
    async ({ findingId, patch }) => {
      try {
        const updated = (await client.put<any>(`/findings/${findingId}`, patch)) as any;
        return ok({
          finding: {
            id: String(updated._id ?? updated.id),
            title: updated.title,
            severity: updated.severity,
            status: updated.status,
          },
          webUrl: client.webUrl(
            `/audits/${updated.auditId}/findings/${updated._id ?? updated.id}`,
          ),
        });
      } catch (err) {
        return errResult(err);
      }
    },
  );

• src/server.ts:485-500 (schema)

  Input validation schema: findingId (string) and patch object with optional title, severity enum, status enum, taxonomy, and assets fields.

  {
    findingId: z.string(),
    patch: z
      .object({
        title: z.string().optional(),
        severity: z
          .enum(['critical', 'high', 'medium', 'low', 'informative'])
          .optional(),
        status: z
          .enum(['open', 'accepted', 'mitigated', 'closed', 'rejected'])
          .optional(),
        taxonomy: z.any().optional(),
        assets: z.array(z.any()).optional(),
      })
      .passthrough(),
  },

• src/server.ts:501-518 (handler)

  Handler function that calls client.put('/findings/{findingId}', patch) to update the finding, then returns the updated finding ID/title/severity/status and a webUrl.

  async ({ findingId, patch }) => {
    try {
      const updated = (await client.put<any>(`/findings/${findingId}`, patch)) as any;
      return ok({
        finding: {
          id: String(updated._id ?? updated.id),
          title: updated.title,
          severity: updated.severity,
          status: updated.status,
        },
        webUrl: client.webUrl(
          `/audits/${updated.auditId}/findings/${updated._id ?? updated.id}`,
        ),
      });
    } catch (err) {
      return errResult(err);
    }
  },

• src/auth/api-client.ts:54-60 (helper)

  ApiClient.put() helper method used by the handler to make the HTTP PUT request to the backend.

  async put<T = unknown>(
    path: string,
    body?: unknown,
    config?: AxiosRequestConfig,
  ): Promise<T> {
    return this.request<T>({ ...config, method: 'PUT', url: path, data: body });
  }

• src/server.ts:1008-1012 (helper)

  ok() helper that wraps the result payload into an MCP content response.

  function ok(payload: unknown) {
    return {
      content: [{ type: 'text' as const, text: JSON.stringify(payload, null, 2) }],
    };
  }