oscerd opened a new pull request, #25028: URL: https://github.com/apache/camel/pull/25028
## Summary Adds a new MCP tool `camel_dependency_security_audit` that scans a Camel project's dependencies for known CVEs using the [Sonatype OSS Index](https://ossindex.sonatype.org/) API. Distinct from `camel_dependency_check` (dependency resolution/conflicts) and `camel_security_advisories` (Camel-specific CVEs from the catalog). ### How it works 1. Parses the provided `pom.xml` to extract all `<dependency>` elements (not just Camel ones) 2. Skips `<dependencyManagement>` entries and `test`-scoped dependencies 3. Resolves Maven `${property}` placeholders from `<properties>` 4. Converts dependencies to [Package URL](https://github.com/package-url/purl-spec) format (`pkg:maven/groupId/artifactId@version`) 5. Queries the OSS Index API in batches of 128 coordinates (API limit) 6. Returns structured findings sorted by CVSS score (highest first) ### Output per finding | Field | Description | |-------|-------------| | `cve` | CVE identifier (e.g., CVE-2022-42003) | | `title` | Vulnerability title | | `description` | Truncated description | | `severity` | critical/high/medium/low/none (from CVSS score) | | `cvssScore` | CVSS 3.x score (0.0–10.0) | | `cvssVector` | CVSS vector string | | `cwe` | CWE identifier | | `reference` | URL to vulnerability details | | `groupId`, `artifactId`, `version` | Affected dependency | | `isCamelDependency` | Whether it's a Camel dependency | | `isCoreTransitive` | Whether it's included transitively via camel-core | ### Design notes - Uses JDK `java.net.http.HttpClient` — zero new dependencies added - First tool in the module with `openWorldHint = true` (external network call) - POM secrets sanitized via `PomSanitizer` before processing - Leverages existing `DependencyData.isCoreTransitive()` for dependency classification ## Test plan - [x] Input validation (null/blank pom.xml) - [x] Dependency parsing: basic, property resolution, test-scope exclusion, dependencyManagement exclusion - [x] Camel vs third-party dependency classification - [x] Core-transitive dependency flagging - [x] OSS Index response parsing: vulns present, no vulns, multiple vulns per component - [x] CVSS severity scoring: all 5 levels - [x] Edge cases: empty dependencies section, no dependencies section, BOM-managed (no version) - [x] All 315 existing tests pass (no regressions) _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
