Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
Open
Conversation
added 2 commits
August 29, 2026 16:58
Wires up the upgrade-guidance endpoint that Black Duck exposes but the existing MCP tools never call. Tries transitive-upgrade-guidance first, falls back to upgrade-guidance since the transitive variant requires an originId not always available from list_project_components. Also adds componentId/componentVersionId to list_project_components output so results can be chained straight into this tool. Verified live against a real 2025.7.1 instance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The MCP server (
blackduck/mcp_server.py) exposeslist_project_componentsandget_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.What this adds
get_upgrade_guidance(component_id, component_version_id)tool. It tries.../transitive-upgrade-guidancefirst, then falls back to.../upgrade-guidance— the transitive variant needs anoriginIdthat isn't always available fromlist_project_components's output, so the fallback keeps the tool useful even without it.componentId/componentVersionIdfields added tolist_project_components's output (extracted from the existingcomponent/componentVersionhref fields), so a caller can chain straight fromlist_project_componentsintoget_upgrade_guidancewithout any extra lookups.Testing
ag-grid-community 24.0.0) —transitive-upgrade-guidance404'd (nooriginId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).Apache Commons BeanUtils(1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.test/test_mcp_server_upgrade_guidance.py: unit tests (mockedClient, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition tolist_project_components.pytest test/) — all 45 tests pass, no regressions.Note: the new test file guards its
fastmcpimport withpytest.importorskipsincefastmcpisn't inrequirements.lock.txt(it's the optionalmcpextra) — so it skips cleanly rather than failing CI in environments without it installed.Possible follow-ups (didn't want to scope-creep this PR)
transitive-upgrade-guidancecan actually succeed when anoriginIdis available (e.g. threading it through from a BOM listing that includes origins).list_project_componentscould optionally returnoriginIdalongsidecomponentId/componentVersionIdto support the above.Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).