feat: add server for automated container vulnerability patching #2
Conversation
duffney
changed the title
.github/copilot-instructions.md
Outdated
| Copacetic MCP is a Go application that provides a Model Context Protocol (MCP) server for automated container image patching using Copacetic and Trivy. It exposes container patching capabilities through the MCP protocol, allowing AI agents and tools to patch container image vulnerabilities programmatically. | ||
|
|
||
| **Main commands**: MCP tools `version` and `patch` | ||
| **Module**: `github.com/duffney/copacetic-mcp` |
There was a problem hiding this comment.
Should this be changed to github.com/project-copacetic/mcp-server?
.goreleaser.yml
Outdated
| 2. Extract the archive | ||
| 3. Run the MCP server: `./copacetic-mcp-server` | ||
|
|
||
| For more information, see the [README](https://github.com/duffney/copacetic-mcp/blob/main/README.md). |
There was a problem hiding this comment.
should this be github.com/project-copacetic/mcp-server?
.github/workflows/release.yml
Outdated
| version: "~> v2" | ||
| args: release --clean | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.TOKEN }} |
There was a problem hiding this comment.
I might be misunderstanding here but I think the main token for auth in workflows is called secrets.GITHUB_TOKEN https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
There was a problem hiding this comment.
You are correct. :) I normally generate my own token so I don't have to mess with org permissions or publishing to the org vs the repo for packages. But I've switched it to use the github_token so we don't have go worry about generating one for this project. Thank you for calling that out.
internal/copa/cli.go
Outdated
|
|
||
| if c.reportPath != "" { | ||
| c.cmd.Args = append(c.cmd.Args, "--report", c.reportPath) | ||
| c.vexPath = filepath.Join(os.TempDir(), defaultVexFile) |
There was a problem hiding this comment.
I think TempDir() points to a single static folder, could this result in multiple mcp-server containers reading/writing to the same vex document? If so, perhaps we can create a new dir for it with os.MkdirTemp()?
There was a problem hiding this comment.
Good call, I'll make that change. :) Thanks for the suggestion!
Signed-off-by: Joshua Duffney <[email protected]>
Signed-off-by: Joshua Duffney <[email protected]>
Signed-off-by: Joshua Duffney <[email protected]>
2 participants
Overview
This PR introduces a Model Context Protocol (MCP) server that exposes Copacetic's container patching capabilities to AI agents and automation tools. Built with the official Go SDK, this server enables programmatic access to Copa's vulnerability patching workflows through a standardized protocol.
Features
The MCP server provides six comprehensive tools for container security automation:
version: Get the version of the Copa CLI toolworkflow-guide: Get guidance on which Copacetic tools to use for different container patching scenariosscan-container: Scan container images for vulnerabilities using Trivy - creates vulnerability reports required for report-based patchingpatch-report-based: Patch container image vulnerabilities using a pre-generated vulnerability report from 'scan-container' tool (RECOMMENDED approach for vulnerability-based patching)patch-platform-selective: Patch specific container image platforms with Copa - patches only the specified platforms WITHOUT vulnerability scanningpatch-comprehensive: Comprehensively patch all container image platforms with Copa - patches all available platforms WITHOUT vulnerability scanningUsage
The server supports multiple deployment options:
Detailed installation and usage instructions are available in the README.
Benefits
Next Steps
Upon merge, this MCP server will be submitted to the Docker MCP catalog, making it available through the Docker MCP Gateway for broader ecosystem integration. A few other things worth mentioning as follow up feature would be: logging, improved error handling, and better output from the tools to include output from the copa cli (new patch tag etc..) I'm happy to continue working on these items but want to get a PR submitted for review first. :)