|
| 1 | +package scan |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "errors" |
| 6 | + "fmt" |
| 7 | + "os" |
| 8 | + "strings" |
| 9 | + |
| 10 | + "github.com/aquasecurity/trivy/pkg/log" |
| 11 | + "github.com/aquasecurity/trivy/pkg/types" |
| 12 | + "github.com/mark3labs/mcp-go/mcp" |
| 13 | +) |
| 14 | + |
| 15 | +func (t *ScanTools) processResultsFile(resultsFilePath string, scanArgs *scanArgs, filename string) (*mcp.CallToolResult, error) { |
| 16 | + logger := log.WithPrefix("scan") |
| 17 | + if scanArgs.isSBOM { |
| 18 | + // tell the LLM to present the results verbatim in code block |
| 19 | + result, err := t.processSBOMResult(resultsFilePath, logger, filename) |
| 20 | + if err != nil { |
| 21 | + logger.Error("Failed to format results", log.Err(err)) |
| 22 | + return nil, fmt.Errorf("failed to format results: %w", err) |
| 23 | + } |
| 24 | + return result, nil |
| 25 | + } |
| 26 | + |
| 27 | + file, err := os.Open(resultsFilePath) |
| 28 | + if err != nil { |
| 29 | + logger.Error("Failed to open scan results file", log.Err(err)) |
| 30 | + return nil, errors.New("failed to open scan results file") |
| 31 | + } |
| 32 | + defer func() { |
| 33 | + if err := file.Close(); err != nil { |
| 34 | + logger.Error("Failed to close scan results file", log.Err(err)) |
| 35 | + } |
| 36 | + if err := os.Remove(resultsFilePath); err != nil { |
| 37 | + logger.Error("Failed to remove scan results file", log.Err(err)) |
| 38 | + } |
| 39 | + }() |
| 40 | + |
| 41 | + var rep types.Report |
| 42 | + if err := json.NewDecoder(file).Decode(&rep); err != nil { |
| 43 | + logger.Error("Failed to decode scan results file", log.Err(err)) |
| 44 | + return nil, errors.New("failed to decode scan results file") |
| 45 | + } |
| 46 | + |
| 47 | + // check the size of the file, if its larger than 1MB, we don't want to embed it in the response |
| 48 | + // instead we want to provide a link to the file |
| 49 | + fileInfo, err := file.Stat() |
| 50 | + if err != nil { |
| 51 | + logger.Error("Failed to get scan results file info", log.Err(err)) |
| 52 | + return nil, errors.New("failed to get scan results file info") |
| 53 | + } |
| 54 | + |
| 55 | + var resultString strings.Builder |
| 56 | + |
| 57 | + if fileInfo.Size() > 1024*1024 { |
| 58 | + resultString, err = processResultSummary(rep, logger) |
| 59 | + if err != nil { |
| 60 | + logger.Error("Failed to format results", log.Err(err)) |
| 61 | + return nil, fmt.Errorf("failed to format results: %w", err) |
| 62 | + } |
| 63 | + } else { |
| 64 | + resultString, err = processResult(rep, logger) |
| 65 | + if err != nil { |
| 66 | + logger.Error("Failed to format results", log.Err(err)) |
| 67 | + return nil, fmt.Errorf("failed to format results: %w", err) |
| 68 | + } |
| 69 | + } |
| 70 | + return mcp.NewToolResultText(resultString.String()), nil |
| 71 | +} |
| 72 | + |
| 73 | +func processResultSummary(rep types.Report, logger *log.Logger) (strings.Builder, error) { |
| 74 | + // process the results into a text format |
| 75 | + sb := strings.Builder{} |
| 76 | + |
| 77 | + logger.Debug("Scan results file is larger than 1MB, building a summary of the results") |
| 78 | + countsMap := make(map[string]int) |
| 79 | + |
| 80 | + for _, result := range rep.Results { |
| 81 | + countsMap["Vulnerabilities"] += len(result.Vulnerabilities) |
| 82 | + countsMap["Misconfigurations"] += len(result.Misconfigurations) |
| 83 | + countsMap["Licenses"] += len(result.Licenses) |
| 84 | + countsMap["Secrets"] += len(result.Secrets) |
| 85 | + } |
| 86 | + |
| 87 | + sb.WriteString("## Scan Results Summary\n") |
| 88 | + sb.WriteString(fmt.Sprintf(" - Vulnerabilities: %d\n", countsMap["Vulnerabilities"])) |
| 89 | + sb.WriteString(fmt.Sprintf(" - Misconfigurations: %d\n", countsMap["Misconfigurations"])) |
| 90 | + sb.WriteString(fmt.Sprintf(" - Licenses: %d\n", countsMap["Licenses"])) |
| 91 | + sb.WriteString(fmt.Sprintf(" - Secrets: %d\n", countsMap["Secrets"])) |
| 92 | + sb.WriteString("\n\n") |
| 93 | + |
| 94 | + return sb, nil |
| 95 | + |
| 96 | +} |
| 97 | + |
| 98 | +func processResult(rep types.Report, logger *log.Logger) (strings.Builder, error) { |
| 99 | + |
| 100 | + // process the results into a text format |
| 101 | + sb := strings.Builder{} |
| 102 | + sb.WriteString("The scan results are below, it is important that you present the results with the severity and the ID/Name of the vulnerability/misconfiguration/license/secret. \n") |
| 103 | + |
| 104 | + for _, result := range rep.Results { |
| 105 | + if len(result.Vulnerabilities) > 0 || len(result.Misconfigurations) > 0 || len(result.Licenses) > 0 || len(result.Secrets) > 0 { |
| 106 | + sb.WriteString(fmt.Sprintf("## %s\n", result.Target)) |
| 107 | + for _, vuln := range result.Vulnerabilities { |
| 108 | + sb.WriteString(fmt.Sprintf("### %s\n", vuln.VulnerabilityID)) |
| 109 | + sb.WriteString(fmt.Sprintf(" - Severity: %s\n", vuln.Severity)) |
| 110 | + sb.WriteString(fmt.Sprintf(" - Package: %s\n", vuln.PkgName)) |
| 111 | + sb.WriteString(fmt.Sprintf(" - Installed Version: %s\n", vuln.InstalledVersion)) |
| 112 | + sb.WriteString(fmt.Sprintf(" - Fixed Version: %s\n", vuln.FixedVersion)) |
| 113 | + sb.WriteString(fmt.Sprintf(" - Primary URL: %s\n", vuln.PrimaryURL)) |
| 114 | + sb.WriteString(fmt.Sprintf(" - Data Source: %s\n", vuln.DataSource)) |
| 115 | + } |
| 116 | + for _, misconf := range result.Misconfigurations { |
| 117 | + sb.WriteString(fmt.Sprintf("### %s\n", misconf.ID)) |
| 118 | + sb.WriteString(fmt.Sprintf(" - Severity: %s\n", misconf.Severity)) |
| 119 | + sb.WriteString(fmt.Sprintf(" - Title: %s\n", misconf.Title)) |
| 120 | + sb.WriteString(fmt.Sprintf(" - Description: %s\n", misconf.Description)) |
| 121 | + sb.WriteString(fmt.Sprintf(" - Resolution: %s\n", misconf.Resolution)) |
| 122 | + sb.WriteString(fmt.Sprintf(" - Primary URL: %s\n", misconf.PrimaryURL)) |
| 123 | + sb.WriteString(fmt.Sprintf(" - Message: %s\n", misconf.Message)) |
| 124 | + |
| 125 | + } |
| 126 | + for _, license := range result.Licenses { |
| 127 | + sb.WriteString(fmt.Sprintf("### %s\n", license.Name)) |
| 128 | + sb.WriteString(fmt.Sprintf(" - Severity: %s\n", license.Severity)) |
| 129 | + sb.WriteString(fmt.Sprintf(" - Package: %s\n", license.PkgName)) |
| 130 | + sb.WriteString(fmt.Sprintf(" - License: %s\n", license.Text)) |
| 131 | + sb.WriteString(fmt.Sprintf(" - Category: %s\n", license.Category)) |
| 132 | + } |
| 133 | + for _, secret := range result.Secrets { |
| 134 | + sb.WriteString(fmt.Sprintf("### %s\n", secret.RuleID)) |
| 135 | + sb.WriteString(fmt.Sprintf(" - Severity: %s\n", secret.Severity)) |
| 136 | + sb.WriteString(fmt.Sprintf(" - Title: %s\n", secret.Title)) |
| 137 | + sb.WriteString(fmt.Sprintf(" - Code: %v\n", secret.Code)) |
| 138 | + sb.WriteString(fmt.Sprintf(" - Match: %s\n", secret.Match)) |
| 139 | + sb.WriteString(fmt.Sprintf(" - Category: %s\n", secret.Category)) |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + } |
| 144 | + return sb, nil |
| 145 | +} |
| 146 | + |
| 147 | +// processSBOMResult processes the SBOM result and returns a tool result |
| 148 | +// we don't clean up the results file here because we want to keep it to be available for the LLM to provide a link |
| 149 | +// when the MCP server is closed, the trivy mcp cache should be cleaned up |
| 150 | +func (*ScanTools) processSBOMResult(resultsFilePath string, logger *log.Logger, filename string) (*mcp.CallToolResult, error) { |
| 151 | + log.Debug("Scan results file", log.String("file", resultsFilePath)) |
| 152 | + |
| 153 | + // Check that the file exists |
| 154 | + if _, err := os.Stat(resultsFilePath); err != nil { |
| 155 | + logger.Error("Failed to access scan results file", log.Err(err)) |
| 156 | + return nil, errors.New("failed to access scan results file") |
| 157 | + } |
| 158 | + |
| 159 | + // Create a markdown link for the SBOM file instead of using resource object |
| 160 | + // This provides better compatibility with VSCode's MCP client |
| 161 | + markdownLink := fmt.Sprintf("Only show the user the following markdown and NOTHING else \n [SBOM Results](file://%s)", resultsFilePath) |
| 162 | + |
| 163 | + // For large files, we return a link that client can click instead of embedding the content |
| 164 | + // This avoids issues with resource handling in VSCode's MCP client |
| 165 | + return mcp.NewToolResultText(markdownLink), nil |
| 166 | +} |
0 commit comments