Skip to content

Commit b5ecdb6

Browse files
jurrejurre
committed
Add support for listing repo security advisories at the org level
1 parent 13a6ebb commit b5ecdb6

File tree

4 files changed

+226
-0
lines changed

4 files changed

+226
-0
lines changed

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -937,6 +937,12 @@ The following sets of tools are available (all are on by default):
937937
- `type`: Advisory type. (string, optional)
938938
- `updated`: Filter by update date or date range (ISO 8601 date or range). (string, optional)
939939

940+
- **list_org_repository_security_advisories** - List org repository security advisories
941+
- `direction`: Sort direction. (string, optional)
942+
- `org`: The organization login. (string, required)
943+
- `sort`: Sort field. (string, optional)
944+
- `state`: Filter by advisory state. (string, optional)
945+
940946
- **list_repository_security_advisories** - List repository security advisories
941947
- `direction`: Sort direction. (string, optional)
942948
- `owner`: The owner of the repository. (string, required)

‎pkg/github/security_advisories.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,3 +315,83 @@ func GetGlobalSecurityAdvisory(getClient GetClientFn, t translations.Translation
315315
return mcp.NewToolResultText(string(r)), nil
316316
}
317317
}
318+
319+
func ListOrgRepositorySecurityAdvisories(getClient GetClientFn, t translations.TranslationHelperFunc) (tool mcp.Tool, handler server.ToolHandlerFunc) {
320+
return mcp.NewTool("list_org_repository_security_advisories",
321+
mcp.WithDescription(t("TOOL_LIST_ORG_REPOSITORY_SECURITY_ADVISORIES_DESCRIPTION", "List repository security advisories for a GitHub organization.")),
322+
mcp.WithToolAnnotation(mcp.ToolAnnotation{
323+
Title: t("TOOL_LIST_ORG_REPOSITORY_SECURITY_ADVISORIES_USER_TITLE", "List org repository security advisories"),
324+
ReadOnlyHint: ToBoolPtr(true),
325+
}),
326+
mcp.WithString("org",
327+
mcp.Required(),
328+
mcp.Description("The organization login."),
329+
),
330+
mcp.WithString("direction",
331+
mcp.Description("Sort direction."),
332+
mcp.Enum("asc", "desc"),
333+
),
334+
mcp.WithString("sort",
335+
mcp.Description("Sort field."),
336+
mcp.Enum("created", "updated", "published"),
337+
),
338+
mcp.WithString("state",
339+
mcp.Description("Filter by advisory state."),
340+
mcp.Enum("triage", "draft", "published", "closed"),
341+
),
342+
), func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
343+
org, err := RequiredParam[string](request, "org")
344+
if err != nil {
345+
return mcp.NewToolResultError(err.Error()), nil
346+
}
347+
direction, err := OptionalParam[string](request, "direction")
348+
if err != nil {
349+
return mcp.NewToolResultError(err.Error()), nil
350+
}
351+
sortField, err := OptionalParam[string](request, "sort")
352+
if err != nil {
353+
return mcp.NewToolResultError(err.Error()), nil
354+
}
355+
state, err := OptionalParam[string](request, "state")
356+
if err != nil {
357+
return mcp.NewToolResultError(err.Error()), nil
358+
}
359+
360+
client, err := getClient(ctx)
361+
if err != nil {
362+
return nil, fmt.Errorf("failed to get GitHub client: %w", err)
363+
}
364+
365+
opts := &github.ListRepositorySecurityAdvisoriesOptions{}
366+
if direction != "" {
367+
opts.Direction = direction
368+
}
369+
if sortField != "" {
370+
opts.Sort = sortField
371+
}
372+
if state != "" {
373+
opts.State = state
374+
}
375+
376+
advisories, resp, err := client.SecurityAdvisories.ListRepositorySecurityAdvisoriesForOrg(ctx, org, opts)
377+
if err != nil {
378+
return nil, fmt.Errorf("failed to list organization repository security advisories: %w", err)
379+
}
380+
defer func() { _ = resp.Body.Close() }()
381+
382+
if resp.StatusCode != http.StatusOK {
383+
body, err := io.ReadAll(resp.Body)
384+
if err != nil {
385+
return nil, fmt.Errorf("failed to read response body: %w", err)
386+
}
387+
return mcp.NewToolResultError(fmt.Sprintf("failed to list organization repository advisories: %s", string(body))), nil
388+
}
389+
390+
r, err := json.Marshal(advisories)
391+
if err != nil {
392+
return nil, fmt.Errorf("failed to marshal advisories: %w", err)
393+
}
394+
395+
return mcp.NewToolResultText(string(r)), nil
396+
}
397+
}

‎pkg/github/security_advisories_test.go‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,3 +385,142 @@ func Test_ListRepositorySecurityAdvisories(t *testing.T) {
385385
})
386386
}
387387
}
388+
389+
func Test_ListOrgRepositorySecurityAdvisories(t *testing.T) {
390+
// Verify tool definition once
391+
mockClient := github.NewClient(nil)
392+
tool, _ := ListOrgRepositorySecurityAdvisories(stubGetClientFn(mockClient), translations.NullTranslationHelper)
393+
394+
assert.Equal(t, "list_org_repository_security_advisories", tool.Name)
395+
assert.NotEmpty(t, tool.Description)
396+
assert.Contains(t, tool.InputSchema.Properties, "org")
397+
assert.Contains(t, tool.InputSchema.Properties, "direction")
398+
assert.Contains(t, tool.InputSchema.Properties, "sort")
399+
assert.Contains(t, tool.InputSchema.Properties, "state")
400+
assert.ElementsMatch(t, tool.InputSchema.Required, []string{"org"})
401+
402+
// Endpoint pattern for org repository security advisories
403+
var GetOrgsSecurityAdvisoriesByOrg = mock.EndpointPattern{
404+
Pattern: "/orgs/{org}/security-advisories",
405+
Method: "GET",
406+
}
407+
408+
adv1 := &github.SecurityAdvisory{
409+
GHSAID: github.Ptr("GHSA-aaaa-bbbb-cccc"),
410+
Summary: github.Ptr("Org repo advisory 1"),
411+
Description: github.Ptr("First advisory"),
412+
Severity: github.Ptr("low"),
413+
}
414+
adv2 := &github.SecurityAdvisory{
415+
GHSAID: github.Ptr("GHSA-dddd-eeee-ffff"),
416+
Summary: github.Ptr("Org repo advisory 2"),
417+
Description: github.Ptr("Second advisory"),
418+
Severity: github.Ptr("critical"),
419+
}
420+
421+
tests := []struct {
422+
name string
423+
mockedClient *http.Client
424+
requestArgs map[string]interface{}
425+
expectError bool
426+
expectedAdvisories []*github.SecurityAdvisory
427+
expectedErrMsg string
428+
}{
429+
{
430+
name: "successful listing (no filters)",
431+
mockedClient: mock.NewMockedHTTPClient(
432+
mock.WithRequestMatchHandler(
433+
GetOrgsSecurityAdvisoriesByOrg,
434+
expect(t, expectations{
435+
path: "/orgs/octo/security-advisories",
436+
queryParams: map[string]string{},
437+
}).andThen(
438+
mockResponse(t, http.StatusOK, []*github.SecurityAdvisory{adv1, adv2}),
439+
),
440+
),
441+
),
442+
requestArgs: map[string]interface{}{
443+
"org": "octo",
444+
},
445+
expectError: false,
446+
expectedAdvisories: []*github.SecurityAdvisory{adv1, adv2},
447+
},
448+
{
449+
name: "successful listing with filters",
450+
mockedClient: mock.NewMockedHTTPClient(
451+
mock.WithRequestMatchHandler(
452+
GetOrgsSecurityAdvisoriesByOrg,
453+
expect(t, expectations{
454+
path: "/orgs/octo/security-advisories",
455+
queryParams: map[string]string{
456+
"direction": "asc",
457+
"sort": "created",
458+
"state": "triage",
459+
},
460+
}).andThen(
461+
mockResponse(t, http.StatusOK, []*github.SecurityAdvisory{adv1}),
462+
),
463+
),
464+
),
465+
requestArgs: map[string]interface{}{
466+
"org": "octo",
467+
"direction": "asc",
468+
"sort": "created",
469+
"state": "triage",
470+
},
471+
expectError: false,
472+
expectedAdvisories: []*github.SecurityAdvisory{adv1},
473+
},
474+
{
475+
name: "listing fails",
476+
mockedClient: mock.NewMockedHTTPClient(
477+
mock.WithRequestMatchHandler(
478+
GetOrgsSecurityAdvisoriesByOrg,
479+
expect(t, expectations{
480+
path: "/orgs/octo/security-advisories",
481+
queryParams: map[string]string{},
482+
}).andThen(
483+
mockResponse(t, http.StatusForbidden, map[string]string{"message": "Forbidden"}),
484+
),
485+
),
486+
),
487+
requestArgs: map[string]interface{}{
488+
"org": "octo",
489+
},
490+
expectError: true,
491+
expectedErrMsg: "failed to list organization repository security advisories",
492+
},
493+
}
494+
495+
for _, tc := range tests {
496+
t.Run(tc.name, func(t *testing.T) {
497+
client := github.NewClient(tc.mockedClient)
498+
_, handler := ListOrgRepositorySecurityAdvisories(stubGetClientFn(client), translations.NullTranslationHelper)
499+
500+
request := createMCPRequest(tc.requestArgs)
501+
502+
result, err := handler(context.Background(), request)
503+
504+
if tc.expectError {
505+
require.Error(t, err)
506+
assert.Contains(t, err.Error(), tc.expectedErrMsg)
507+
return
508+
}
509+
510+
require.NoError(t, err)
511+
512+
textContent := getTextResult(t, result)
513+
514+
var returnedAdvisories []*github.SecurityAdvisory
515+
err = json.Unmarshal([]byte(textContent.Text), &returnedAdvisories)
516+
assert.NoError(t, err)
517+
assert.Len(t, returnedAdvisories, len(tc.expectedAdvisories))
518+
for i, advisory := range returnedAdvisories {
519+
assert.Equal(t, *tc.expectedAdvisories[i].GHSAID, *advisory.GHSAID)
520+
assert.Equal(t, *tc.expectedAdvisories[i].Summary, *advisory.Summary)
521+
assert.Equal(t, *tc.expectedAdvisories[i].Description, *advisory.Description)
522+
assert.Equal(t, *tc.expectedAdvisories[i].Severity, *advisory.Severity)
523+
}
524+
})
525+
}
526+
}

‎pkg/github/tools.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ func DefaultToolsetGroup(readOnly bool, getClient GetClientFn, getGQLClient GetG
164164
toolsets.NewServerTool(ListGlobalSecurityAdvisories(getClient, t)),
165165
toolsets.NewServerTool(GetGlobalSecurityAdvisory(getClient, t)),
166166
toolsets.NewServerTool(ListRepositorySecurityAdvisories(getClient, t)),
167+
toolsets.NewServerTool(ListOrgRepositorySecurityAdvisories(getClient, t)),
167168
)
168169

169170
// Keep experiments alive so the system doesn't error out when it's always enabled

0 commit comments

Comments
 (0)