list_image_vulnerabilities
Identify security vulnerabilities in container images by analyzing image digests and filtering results by severity levels.
Instructions
List vulnerabilities in a container image with optional filtering by severity
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| digest | Yes | Image digest (required for vulnerabilities) | |
| severities | No | List of severity levels to filter | |
| page | No | Page number for pagination | |
| page_size | No | Number of items per page |
Implementation Reference
- src/operations/images.ts:67-101 (handler)The core handler function that implements the tool logic for listing vulnerabilities in a specified container image. It retrieves the latest scan for the image, queries its vulnerabilities with optional severity filtering and pagination, removes CPEs to optimize for LLM context, and returns the results.
export async function listImageVulnerabilities( client: RadSecurityClient, digest: string, severities?: string[], page: number = 1, page_size: number = 20 ): Promise<any> { const params: Record<string, any> = { page, page_size, sort: "severity:desc" }; if (severities && severities.length > 0) { params.severities = severities.join(","); } const scans = await listImageScans(client, digest); if (!scans || !scans.entries || scans.entries.length === 0) { throw new Error(`Image with digest: ${digest} hasn't been scanned yet`); } // Get the latest scan const scanId = scans.entries[0].id; const vulns = await client.makeRequest( `/accounts/${client.getAccountId()}/images/${digest}/scans/${scanId}/vulnerabilities`, params ); // Remove CPEs to reduce context window size when used with LLMs vulns.entries.forEach((vuln: any) => { if (vuln.cpes) { delete vuln.cpes; } }); return vulns; } - src/operations/images.ts:12-17 (schema)Zod schema defining the input parameters for the list_image_vulnerabilities tool, including required image digest and optional severities, page, and page_size.
export const ListImageVulnerabilitiesSchema = z.object({ digest: z.string().describe("Image digest (required for vulnerabilities)"), severities: z.array(z.string()).optional().describe("List of severity levels to filter"), page: z.number().optional().default(1).describe("Page number for pagination"), page_size: z.number().optional().default(100).describe("Number of items per page"), }); - src/index.ts:289-296 (registration)Registration of the tool in the ListToolsRequest handler, specifying the tool name, description, and input schema converted to JSON schema.
{ name: "list_image_vulnerabilities", description: "List vulnerabilities in a container image with optional filtering by severity", inputSchema: zodToJsonSchema( images.ListImageVulnerabilitiesSchema ), }, - src/index.ts:1021-1037 (registration)Dispatch handler registration in the CallToolRequest handler that validates input arguments using the schema, invokes the listImageVulnerabilities function with the client and parsed args, and formats the response as MCP content.
case "list_image_vulnerabilities": { const args = images.ListImageVulnerabilitiesSchema.parse( request.params.arguments ); const response = await images.listImageVulnerabilities( client, args.digest, args.severities, args.page, args.page_size ); return { content: [ { type: "text", text: JSON.stringify(response, null, 2) }, ], }; }