Help us shape the future of Go! Take the 2026 Go Developer Survey

vulnerabilities

package
v3.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 9, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package vulnerabilities implements MCP tools for GitLab vulnerability management through the GraphQL API.

The package lists project vulnerabilities, retrieves individual vulnerability details, computes severity and pipeline security summaries, mutates vulnerability state through dismiss, confirm, resolve, and revert operations, and renders vulnerability outputs as Markdown.

The package wraps the GitLab Vulnerabilities API and GraphQL vulnerability fields:

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ActionSpecs 

func ActionSpecs(client *gitlabclient.Client) []toolutil.ActionSpec

ActionSpecs returns canonical specs for vulnerability list, triage, and summary actions.

func FormatGetMarkdown 

func FormatGetMarkdown(out GetOutput) string

FormatGetMarkdown renders one vulnerability as the card of one object: what it is, where it was found, what has happened to it, its identifiers as a nested collection, and the scanner's own prose as quoted text.

func FormatListMarkdown 

func FormatListMarkdown(out ListOutput) string

FormatListMarkdown renders a page of vulnerabilities as a Markdown table: a collection of objects that share columns. The ID is a column because it is what every other vulnerability action takes, and the list used to be a page a model could read and not act on.

func FormatMutationMarkdown 

func FormatMutationMarkdown(out MutationOutput, action string) string

FormatMutationMarkdown renders the vulnerability a state change answered with, as the card of one object. The action names what GitLab did, and the hints name what its new state still allows.

func FormatPipelineSecuritySummaryMarkdown 

func FormatPipelineSecuritySummaryMarkdown(out PipelineSecuritySummaryOutput) string

FormatPipelineSecuritySummaryMarkdown renders one pipeline's security report summary as a table of the scanners that ran: a collection of objects that share columns.

func FormatSeverityCountMarkdown 

func FormatSeverityCountMarkdown(out SeverityCountOutput) string

FormatSeverityCountMarkdown renders the project's vulnerability counts as the card of one object: one row per severity, each labeled with the badge the security domains share, and the total last. Every count is written, zero included: "no criticals" is the answer a reader came for.

Types

type CVEEnrichmentItem added in v3.1.0 

type CVEEnrichmentItem struct {
	CVE            string  `json:"cve"`
	EPSSScore      float64 `json:"epss_score"`
	IsKnownExploit bool    `json:"is_known_exploit"`
}

CVEEnrichmentItem is what GitLab knows about the CVE beyond the scanner's report: the EPSS probability of exploitation in the next thirty days, and whether CISA lists it as exploited in the wild.

type CVSSItem added in v3.1.0 

type CVSSItem struct {
	Vendor       string  `json:"vendor"`
	Version      float64 `json:"version"`
	Vector       string  `json:"vector"`
	BaseScore    float64 `json:"base_score"`
	OverallScore float64 `json:"overall_score"`
	Severity     string  `json:"severity"`
}

CVSSItem is one CVSS assessment of the vulnerability, as the vendor that scored it published it. A vulnerability can carry several, one per vendor and CVSS version.

type ConfirmInput 

type ConfirmInput struct {
	ID string `json:"id" jsonschema:"Vulnerability GID (e.g. gid://gitlab/Vulnerability/42),required"`
}

ConfirmInput is the input for confirming a vulnerability.

type DismissInput 

type DismissInput struct {
	ID              string `json:"id" jsonschema:"Vulnerability GID (e.g. gid://gitlab/Vulnerability/42),required"`
	Comment         string `json:"comment,omitempty" jsonschema:"Reason for dismissal"`
	DismissalReason string `` /* 147-byte string literal not displayed */
}

DismissInput is the input for dismissing a vulnerability.

type GetInput 

type GetInput struct {
	ID string `json:"id" jsonschema:"Vulnerability GID (e.g. gid://gitlab/Vulnerability/42),required"`
}

GetInput is the input for getting a single vulnerability.

type GetOutput 

type GetOutput struct {
	toolutil.HintableOutput
	Vulnerability Item `json:"vulnerability"`
}

GetOutput is the output for getting a single vulnerability.

func Get 

func Get(ctx context.Context, client *gitlabclient.Client, input GetInput) (GetOutput, error)

Get retrieves a single vulnerability by GID via the GitLab GraphQL API.

type IdentifierItem 

type IdentifierItem struct {
	Name         string `json:"name"`
	ExternalType string `json:"external_type,omitempty"`
	ExternalID   string `json:"external_id,omitempty"`
	URL          string `json:"url,omitempty"`
}

IdentifierItem represents a vulnerability identifier (CVE, CWE, etc.).

type IssueLinkItem added in v3.1.0 

type IssueLinkItem struct {
	LinkType string         `json:"link_type"`
	Issue    *ReferenceItem `json:"issue,omitempty"`
}

IssueLinkItem is one issue linked to the vulnerability, and whether the issue was created from it (CREATED) or linked to it afterwards (RELATED).

type Item 

type Item struct {
	ID                      string                                   `json:"id"`
	UUID                    string                                   `json:"uuid,omitempty"`
	Title                   string                                   `json:"title"`
	Severity                string                                   `json:"severity"`
	State                   string                                   `json:"state"`
	StateComment            string                                   `json:"state_comment,omitempty"`
	Description             string                                   `json:"description,omitempty"`
	ReportType              string                                   `json:"report_type,omitempty"`
	Scanner                 *ScannerItem                             `json:"scanner,omitempty"`
	Location                *LocationItem                            `json:"location,omitempty"`
	Identifiers             []IdentifierItem                         `json:"identifiers,omitempty"`
	CVSS                    []CVSSItem                               `json:"cvss,omitempty"`
	CVEEnrichment           *CVEEnrichmentItem                       `json:"cve_enrichment,omitempty"`
	Links                   []toolutil.VulnerabilityLinkOutput       `json:"links,omitempty"`
	TokenStatus             *toolutil.VulnerabilityTokenStatusOutput `json:"token_status,omitempty"`
	DetectedAt              string                                   `json:"detected_at,omitempty"`
	UpdatedAt               string                                   `json:"updated_at,omitempty"`
	DismissedAt             string                                   `json:"dismissed_at,omitempty"`
	DismissedBy             *toolutil.UserCoreRefOutput              `json:"dismissed_by,omitempty"`
	ResolvedAt              string                                   `json:"resolved_at,omitempty"`
	ResolvedBy              *toolutil.UserCoreRefOutput              `json:"resolved_by,omitempty"`
	ConfirmedAt             string                                   `json:"confirmed_at,omitempty"`
	ConfirmedBy             *toolutil.UserCoreRefOutput              `json:"confirmed_by,omitempty"`
	Project                 *ProjectItem                             `json:"project,omitempty"`
	WebURL                  string                                   `json:"web_url,omitempty"`
	PrimaryID               *IdentifierItem                          `json:"primary_identifier,omitempty"`
	Solution                string                                   `json:"solution,omitempty"`
	HasRemediations         bool                                     `json:"has_remediations,omitempty"`
	FalsePositive           *bool                                    `json:"false_positive,omitempty"`
	PresentOnDefaultBranch  bool                                     `json:"present_on_default_branch"`
	ResolvedOnDefaultBranch bool                                     `json:"resolved_on_default_branch,omitempty"`
	RemovedFromCode         bool                                     `json:"removed_from_code,omitempty"`
	UserNotesCount          int                                      `json:"user_notes_count,omitempty"`
	HasIssues               bool                                     `json:"has_issues,omitempty"`
	IssueLinks              []IssueLinkItem                          `json:"issue_links,omitempty"`
	HasMR                   bool                                     `json:"has_merge_request,omitempty"`
	MergeRequest            *ReferenceItem                           `json:"merge_request,omitempty"`
	DismissalReason         string                                   `json:"dismissal_reason,omitempty"`
}

Item is a summary of a vulnerability.

The three people GitLab records against a state change are published beside the time of it, and the triage signals it computes (present on the default branch, resolved there, removed from the code) beside the state. present_on_default_branch is written at false as well as true, since GitLab always sends it and false is the answer that matters: the vulnerability was found only on another branch.

type ListInput 

type ListInput struct {
	ProjectPath   string   `json:"project_path" jsonschema:"Full path of the project (e.g. my-group/my-project),required"`
	Severity      []string `json:"severity,omitempty" jsonschema:"Filter by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, UNKNOWN"`
	State         []string `json:"state,omitempty" jsonschema:"Filter by state: DETECTED, CONFIRMED, DISMISSED, RESOLVED"`
	Scanner       []string `json:"scanner,omitempty" jsonschema:"Filter by scanner external IDs"`
	ReportType    []string `` /* 238-byte string literal not displayed */
	HasIssues     *bool    `json:"has_issues,omitempty" jsonschema:"Filter by whether a linked issue exists"`
	HasResolution *bool    `json:"has_resolution,omitempty" jsonschema:"Filter by whether a resolution exists"`
	Sort          string   `json:"sort,omitempty" jsonschema:"Sort order: severity_desc, severity_asc, detected_desc, detected_asc"`
	toolutil.GraphQLCursorPaginationInput
}

ListInput is the input for listing project vulnerabilities.

type ListOutput 

type ListOutput struct {
	toolutil.HintableOutput
	Vulnerabilities []Item                           `json:"vulnerabilities"`
	Pagination      toolutil.GraphQLPaginationOutput `json:"pagination"`
}

ListOutput is the output for listing project vulnerabilities.

func List 

func List(ctx context.Context, client *gitlabclient.Client, input ListInput) (ListOutput, error)

List retrieves project vulnerabilities via the GitLab GraphQL API.

type LocationItem 

type LocationItem = toolutil.VulnerabilityLocationOutput

LocationItem is where the scanner found the vulnerability. It is the shape the security findings share, so a finding and the vulnerability it becomes name their location in the same words.

type MutationOutput 

type MutationOutput struct {
	toolutil.HintableOutput
	Vulnerability Item `json:"vulnerability"`
}

MutationOutput is the output for vulnerability state mutations.

func Confirm 

func Confirm(ctx context.Context, client *gitlabclient.Client, input ConfirmInput) (MutationOutput, error)

Confirm confirms a vulnerability via the GitLab GraphQL API.

func Dismiss 

func Dismiss(ctx context.Context, client *gitlabclient.Client, input DismissInput) (MutationOutput, error)

Dismiss dismisses a vulnerability via the GitLab GraphQL API.

func Resolve 

func Resolve(ctx context.Context, client *gitlabclient.Client, input ResolveInput) (MutationOutput, error)

Resolve resolves a vulnerability via the GitLab GraphQL API.

func Revert 

func Revert(ctx context.Context, client *gitlabclient.Client, input RevertInput) (MutationOutput, error)

Revert reverts a vulnerability to detected state via the GitLab GraphQL API.

type PipelineSecuritySummaryInput 

type PipelineSecuritySummaryInput struct {
	ProjectPath string `json:"project_path" jsonschema:"Full path of the project (e.g. my-group/my-project),required"`
	PipelineIID string `json:"pipeline_iid" jsonschema:"Pipeline IID (internal ID within the project),required"`
}

PipelineSecuritySummaryInput is the input for retrieving a pipeline's security report summary.

type PipelineSecuritySummaryOutput 

type PipelineSecuritySummaryOutput struct {
	toolutil.HintableOutput
	Sast                 *ScannerSummaryItem `json:"sast,omitempty"`
	Dast                 *ScannerSummaryItem `json:"dast,omitempty"`
	DependencyScanning   *ScannerSummaryItem `json:"dependency_scanning,omitempty"`
	ContainerScanning    *ScannerSummaryItem `json:"container_scanning,omitempty"`
	SecretDetection      *ScannerSummaryItem `json:"secret_detection,omitempty"`
	CoverageFuzzing      *ScannerSummaryItem `json:"coverage_fuzzing,omitempty"`
	APIFuzzing           *ScannerSummaryItem `json:"api_fuzzing,omitempty"`
	ClusterImageScanning *ScannerSummaryItem `json:"cluster_image_scanning,omitempty"`
	TotalVulnerabilities int                 `json:"total_vulnerabilities"`
}

PipelineSecuritySummaryOutput contains scanner-level breakdown of a pipeline's security report.

func PipelineSecuritySummary 

func PipelineSecuritySummary(ctx context.Context, client *gitlabclient.Client, input PipelineSecuritySummaryInput) (PipelineSecuritySummaryOutput, error)

PipelineSecuritySummary retrieves a pipeline's security report summary via GraphQL.

type ProjectItem 

type ProjectItem struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	FullPath string `json:"full_path"`
}

ProjectItem represents a minimal project reference on a vulnerability.

type ReferenceItem added in v3.1.0 

type ReferenceItem struct {
	IID    int64  `json:"iid"`
	Title  string `json:"title,omitempty"`
	State  string `json:"state,omitempty"`
	WebURL string `json:"web_url,omitempty"`
}

ReferenceItem names an issue or a merge request GitLab links to a vulnerability: enough to recognize it and to open it. Its own fields are the issue and merge request actions' to publish.

type ResolveInput 

type ResolveInput struct {
	ID string `json:"id" jsonschema:"Vulnerability GID (e.g. gid://gitlab/Vulnerability/42),required"`
}

ResolveInput is the input for resolving a vulnerability.

type RevertInput 

type RevertInput struct {
	ID string `json:"id" jsonschema:"Vulnerability GID (e.g. gid://gitlab/Vulnerability/42),required"`
}

RevertInput is the input for reverting a vulnerability to detected state.

type ScanItem added in v3.1.0 

type ScanItem struct {
	Name     string   `json:"name"`
	Status   string   `json:"status"`
	Errors   []string `json:"errors,omitempty"`
	Warnings []string `json:"warnings,omitempty"`
}

ScanItem is one security scan the pipeline ran for a scan type.

type ScannedResourceItem added in v3.1.0 

type ScannedResourceItem struct {
	RequestMethod string `json:"request_method,omitempty"`
	URL           string `json:"url"`
}

ScannedResourceItem is one resource a DAST or API fuzzing scan requested.

type ScannerItem 

type ScannerItem struct {
	Name      string `json:"name"`
	Vendor    string `json:"vendor,omitempty"`
	ScannerID string `json:"scanner_id,omitempty"`
}

ScannerItem represents the scanner that detected the vulnerability. ScannerID is the id the report gives the scanner ("semgrep", "zap"), which is GitLab's externalId and what the list action's scanner filter takes.

type ScannerSummaryItem 

type ScannerSummaryItem struct {
	VulnerabilitiesCount    int                   `json:"vulnerabilities_count"`
	ScannedResourcesCount   int                   `json:"scanned_resources_count"`
	ScannedResourcesCsvPath string                `json:"scanned_resources_csv_path,omitempty"`
	Scans                   []ScanItem            `json:"scans,omitempty"`
	ScannedResources        []ScannedResourceItem `json:"scanned_resources,omitempty"`
}

ScannerSummaryItem represents the security scan results from a single scanner type.

Scans are what ran for the type and how each ended, with the errors and warnings the analyzer wrote into its report: a scan type that found nothing because its scan failed reads here as a failure rather than as a clean result. ScannedResources are the first twenty resources a DAST or API fuzzing scan requested, which is as many as GitLab sends; the CSV path downloads them all.

type SeverityCountInput 

type SeverityCountInput struct {
	ProjectPath string `json:"project_path" jsonschema:"Full path of the project (e.g. my-group/my-project),required"`
}

SeverityCountInput is the input for retrieving vulnerability severity counts.

type SeverityCountOutput 

type SeverityCountOutput struct {
	toolutil.HintableOutput
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
	Info     int `json:"info"`
	Unknown  int `json:"unknown"`
	Total    int `json:"total"`
}

SeverityCountOutput contains vulnerability counts grouped by severity level.

func SeverityCount 

func SeverityCount(ctx context.Context, client *gitlabclient.Client, input SeverityCountInput) (SeverityCountOutput, error)

SeverityCount retrieves vulnerability severity counts for a project via GraphQL.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.