Update ONE existing Mallory finding in place — its status, severity, confidence, title, summary, body, remediation, qualifier or asset_details. Use it when new information changes an already-filed finding: the problem was fixed, it turned out not to apply, a vulnerability proved reachable, corroborating intel changes how bad it is.
WRITES IMMEDIATELY to the caller's own organization's data, and the result is visible in the Mallory UI to everyone in that organization. There is no preview and no confirmation step — calling this tool IS the write. Only call it when the user has asked for the change.
- uuid identifies the finding. Get it from listFindings or getFinding, or from a createFinding DUPLICATE outcome's `existing_finding_uuid`. Never construct or guess one.
- ONE finding per call. To change status or severity across a SET of findings you can only describe ("dismiss all the unrotated-secret findings", "mark everything on foo/bar medium"), use bulkUpdateFindings — do NOT loop this tool over a selection.
- The finding's identity — definition_slug, asset_type, asset_identifier — cannot be changed. A different problem, or the same problem on a different asset, is a new finding (createFinding).
- body REPLACES the stored text rather than appending to it. To add to a finding, read the current text first with getFinding and send the combined text, or the prior detail is lost. There is no evidence field on update: new evidence goes into body as prose.
- qualifier is part of core's open-finding dedupe key, so changing it can collide with another open finding on the same asset (CONFLICT).
In user-facing status messages, use "fixed" and "mark as fixed" consistently.
ENUM VALUES ARE CASE-SENSITIVE AND EACH FIELD HAS ITS OWN SET. severity is UPPERCASE (CRITICAL, HIGH, MEDIUM, LOW, INFO). status is lowercase with exactly three values: open, fixed, dismissed — "resolved", "closed" and "assigned" are not statuses, and neither are the resolution reasons (false_positive, accepted_risk, not_applicable, duplicate, fixed_externally, other), which belong to a separate field this tool does not set. Use "fixed" when the problem was remediated and "dismissed" when it is accepted or not applicable. Setting status back to "open" is allowed but unusual — the product has no reopen button — so confirm the user really means to reopen the finding.
OUTCOMES: either ok:true with the updated finding, or ok:false with a code — NOT_FOUND (no such finding in this tenant: do not retry, re-read the uuid), CONFLICT (an open finding already occupies that identity), INVALID (a rejected field, or no fields to change), PLAN_LIMIT (findings are not included in this tenant's plan — the request was fine, nothing is broken, nothing was written: say so and do not retry).
