bob-mcp-vuln-remediation

MCP server for vulnerability remediation workflows. Create branches, apply code changes, run validation, and open pull requests against GitHub Enterprise.

Quick Start

Prerequisites

• Node.js 18+
• Git CLI
• GitHub Enterprise personal access token with repo write permissions

Installation

Option 1: npx (recommended)

npx -y bob-mcp-vuln-remediation

Option 2: Local development

npm install
npm run build
node dist/index.js

VS Code Setup

Add to your global settings.json (Cmd+Shift+P → "Open User Settings (JSON)"):

{
  "mcpServers": {
    "bob-mcp-vuln-remediation": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "bob-mcp-vuln-remediation"],
      "env": {
        "GITHUB_BASE_URL": "https://github.ibm.com/api/v3",
        "GITHUB_TOKEN": "your-github-token"
      }
    }
  }
}

Note: This server performs write actions (branch creation, commits, PRs) only after explicit user approval.

Tools

| Tool | Description | |------|-------------| | check_setup | Validate server configuration, git, and GitHub connectivity | | prepare_worktree | Clone or verify repository and checkout base branch | | create_fix_branch | Create remediation branch with consistent naming | | apply_remediation_plan | Apply code/config changes per approved plan | | run_basic_validation | Run build/test commands | | commit_and_push_branch | Commit and push changes to remote | | open_pull_request | Create PR via GitHub API | | generate_pr_summary | Generate PR title/body from issue data |

Prompts

| Prompt | Description | |--------|-------------| | remediate-vulnerability-issue | Interactive fix workflow with approval gates | | create-vulnerability-pr | Push branch and open PR after approval | | validate-vulnerability-fix | Run build/test validation |

Environment Variables

Required

• GITHUB_BASE_URL - GitHub Enterprise API URL (e.g., https://github.ibm.com/api/v3)
• GITHUB_TOKEN - GitHub personal access token with repo write permissions

Optional

• GIT_CLONE_BASE_DIR - Base directory for cloned repos
• GIT_AUTHOR_NAME - Git author name for commits
• GIT_AUTHOR_EMAIL - Git author email for commits
• DEFAULT_PR_BASE_BRANCH - Fallback base branch
• LOG_LEVEL - Logging level

Example Flows

Flow 1: Local Checkout

// Prepare existing local repo
prepare_worktree({ local_path: "/path/to/repo" })

// Create fix branch
create_fix_branch({ local_path: "/path/to/repo", issue_key: "VDEV-123", branch_suffix: "cve-fix" })

// Apply changes
apply_remediation_plan({ 
  local_path: "/path/to/repo",
  remediation_plan: { files: [...], intent: "...", fix_type: "..." }
})

Flow 2: Cloned Repo

prepare_worktree({ 
  repo_url: "https://github.ibm.com/org/repo.git",
  base_branch: "main"
})

Validation Skipped Behavior

If no build/test commands are provided, validation is skipped and clearly indicated in the PR. Users should run validation manually before merging.

Branch Naming Convention

Branches follow: ai/{issue-key}-{suffix}
Example: ai/VDEV-214001-cve-2023-0433-vim-fix

Security Notes

• Path traversal validation on all file operations
• Branch names sanitized (alphanumeric, hyphens, underscores only)
• Markdown escaping in PR descriptions
• Repo format validation (owner/repo)
• Retry logic (2 retries, exponential backoff) for GitHub API

Related Servers

This server is one of four related bob-mcp-vuln-* servers that work together for end-to-end vulnerability remediation:

• bob-mcp-vuln-intake - Fetch and normalize Jira/GitHub vulnerability issues, then prioritize them for review
• bob-mcp-vuln-analysis - Resolve Jira component → repo/local-path mapping, inspect codebase, classify remediation paths
• bob-mcp-vuln-remediation (this server) - Create branches, apply code/Dockerfile/dependency changes, run tests, open pull requests
• bob-mcp-vuln-workflow - Write structured comments back to Jira/GitHub and transition Jira status

Each server can be used independently or wired together by your MCP client to form a complete vulnerability remediation workflow. If you need one of these servers, you'll likely need the other three as well.

Limitations (IBM Bob)

When using IBM Bob, note:

• Prompts may have limited interactive capabilities
• Some workflows require manual confirmation steps
• Check IBM Bob documentation for latest limitations

License

MIT