Vulnerabilidades

Las vulnerabilidades son los registros que GitLab mantiene de lo que encontraron sus analizadores de seguridad, con seguimiento entre pipelines. Estas acciones listan las vulnerabilidades de un proyecto con filtros, leen una, la clasifican (confirmarla, descartarla, resolverla o devolverla a detectada), cuentan las vulnerabilidades de un proyecto por gravedad y resumen los informes de seguridad de un pipeline. Lo que notificaron los analizadores de un solo pipeline está en Hallazgos de seguridad.

Preguntas de ejemplo

• “Lista las vulnerabilidades críticas del proyecto 42”
• “Descarta la vulnerabilidad 42 como falso positivo”
• “¿Cuántas vulnerabilidades tiene el proyecto 42 por gravedad?”
• “¿Qué analizadores se ejecutaron en el pipeline 123?”

Cómo llamarlo

• Dinámica, la superficie predeterminada: llama a gitlab_execute_action con action igual al ID de la acción, como vulnerability.confirm, y sus parámetros en params. gitlab_find_action encuentra un ID a partir de una descripción de la tarea.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): llama a gitlab_vulnerability con action igual al nombre de la acción, como confirm, y sus parámetros en params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): llama a la herramienta propia de la acción, como gitlab_confirm_vulnerability, pasándole directamente sus parámetros.

Disponibilidad

Cuántas de estas acciones sirve una instancia en cada nivel, de un total de 8:

• Free: 0
• Premium: 0
• Ultimate: 8

Acciones de solo lectura: 4 de 8, las que conserva un despliegue en modo de solo lectura.

Acciones

La descripción de cada acción, y la de cada uno de sus parámetros, es el texto que sirve el servidor para ella en la superficie predeterminada, citado tal cual; por eso está en inglés.

Acción	Individual
vulnerability.confirm	gitlab_confirm_vulnerability
vulnerability.dismiss	gitlab_dismiss_vulnerability
vulnerability.get	gitlab_get_vulnerability
vulnerability.list	gitlab_list_vulnerabilities
vulnerability.pipeline_security_summary	gitlab_pipeline_security_summary
vulnerability.resolve	gitlab_resolve_vulnerability
vulnerability.revert	gitlab_revert_vulnerability
vulnerability.severity_count	gitlab_vulnerability_severity_count

vulnerability.confirm

Confirm a vulnerability as a real finding. Returns: the updated vulnerability with its new confirmed state and timestamp. See also: vulnerability.get, vulnerability.dismiss, vulnerability.resolve.

• Meta-herramienta: gitlab_vulnerability, acción confirm
• Herramienta individual: gitlab_confirm_vulnerability
• Nivel: Ultimate
• Comportamiento: escribe, idempotente

Parámetro	Tipo	Requerido	Descripción
id	string	sí	Vulnerability GID (e.g. gid://gitlab/Vulnerability/42)

vulnerability.dismiss

Dismiss a vulnerability with a dismissal reason. Returns: the updated vulnerability with its new dismissed state and timestamp. See also: vulnerability.get, vulnerability.confirm, vulnerability.revert.

• Meta-herramienta: gitlab_vulnerability, acción dismiss
• Herramienta individual: gitlab_dismiss_vulnerability
• Nivel: Ultimate
• Comportamiento: escribe, idempotente

Parámetro	Tipo	Requerido	Descripción
id	string	sí	Vulnerability GID (e.g. gid://gitlab/Vulnerability/42)
comment	string	no	Reason for dismissal
dismissal_reason	string (ACCEPTABLE_RISK, FALSE_POSITIVE, MITIGATING_CONTROL, NOT_APPLICABLE, USED_IN_TESTS)	no	Dismissal reason: ACCEPTABLE_RISK, FALSE_POSITIVE, MITIGATING_CONTROL, USED_IN_TESTS, NOT_APPLICABLE

vulnerability.get

Get a single vulnerability by global ID. Returns: title, description, severity, state and its comment, report type, scanner, identifiers, CVSS assessments, EPSS and known-exploit data, location, solution, report links, a leaked token’s status, who confirmed, dismissed or resolved it, linked issues, and merge request. See also: vulnerability.list, vulnerability.dismiss, vulnerability.confirm.

• Meta-herramienta: gitlab_vulnerability, acción get
• Herramienta individual: gitlab_get_vulnerability
• Nivel: Ultimate
• Comportamiento: solo lectura, idempotente

Parámetro	Tipo	Requerido	Descripción
id	string	sí	Vulnerability GID (e.g. gid://gitlab/Vulnerability/42)

vulnerability.list

List a project’s vulnerabilities with severity, state, scanner, and report-type filters plus keyset pagination. Returns: matching vulnerabilities with UUID, title, severity, state, report type, scanner, identifiers, location, CVSS and EPSS data, who confirmed, dismissed or resolved each, detection time, and web URL. See also: vulnerability.get, vulnerability.severity_count, security_finding.list.

• Meta-herramienta: gitlab_vulnerability, acción list
• Herramienta individual: gitlab_list_vulnerabilities
• Nivel: Ultimate
• Comportamiento: solo lectura, idempotente

Parámetro	Tipo	Requerido	Descripción
project_path	string	sí	Full path of the project (e.g. my-group/my-project)
after	string	no	Cursor for forward pagination (from previous response end_cursor)
before	string	no	Cursor for backward pagination (from previous response start_cursor). The page size comes from last, or from first when last is omitted
first	integer	no	Number of items to return (default 20, max 100)
has_issues	boolean	no	Filter by whether a linked issue exists
has_resolution	boolean	no	Filter by whether a resolution exists
last	integer	no	Number of items to return from the end of the range (backward pagination). Cannot be combined with first
report_type	string[]	no	Filter by report type: SAST, DAST, DEPENDENCY_SCANNING, CONTAINER_SCANNING, CONTAINER_SCANNING_FOR_REGISTRY, SECRET_DETECTION, COVERAGE_FUZZING, API_FUZZING, CLUSTER_IMAGE_SCANNING, SARIF, GENERIC
scanner	string[]	no	Filter by scanner external IDs
severity	string[]	no	Filter by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, UNKNOWN
sort	string (severity_desc, severity_asc, detected_desc, detected_asc)	no	Sort order: severity_desc, severity_asc, detected_desc, detected_asc
state	string[]	no	Filter by state: DETECTED, CONFIRMED, DISMISSED, RESOLVED

vulnerability.pipeline_security_summary

Summarize a pipeline’s security scan results. Returns: per-scanner vulnerability and scanned-resource counts for the pipeline (SAST, DAST, and other report types), the scans that ran with their status, errors and warnings, and the first resources a DAST scan requested. See also: vulnerability.severity_count, vulnerability.list.

• Meta-herramienta: gitlab_vulnerability, acción pipeline_security_summary
• Herramienta individual: gitlab_pipeline_security_summary
• Nivel: Ultimate
• Comportamiento: solo lectura, idempotente

Parámetro	Tipo	Requerido	Descripción
pipeline_iid	string	sí	Pipeline IID (internal ID within the project)
project_path	string	sí	Full path of the project (e.g. my-group/my-project)

vulnerability.resolve

Resolve a vulnerability after it is fixed. Returns: the updated vulnerability with its new resolved state and timestamp. See also: vulnerability.get, vulnerability.confirm, vulnerability.revert.

• Meta-herramienta: gitlab_vulnerability, acción resolve
• Herramienta individual: gitlab_resolve_vulnerability
• Nivel: Ultimate
• Comportamiento: escribe, idempotente

Parámetro	Tipo	Requerido	Descripción
id	string	sí	Vulnerability GID (e.g. gid://gitlab/Vulnerability/42)

vulnerability.revert

Revert a vulnerability back to the detected state. Returns: the updated vulnerability with its restored detected state. See also: vulnerability.get, vulnerability.dismiss, vulnerability.resolve.

• Meta-herramienta: gitlab_vulnerability, acción revert
• Herramienta individual: gitlab_revert_vulnerability
• Nivel: Ultimate
• Comportamiento: escribe, idempotente

Parámetro	Tipo	Requerido	Descripción
id	string	sí	Vulnerability GID (e.g. gid://gitlab/Vulnerability/42)

vulnerability.severity_count

Count a project’s vulnerabilities grouped by severity. Returns: critical, high, medium, low, info, and unknown counts. See also: vulnerability.list, vulnerability.pipeline_security_summary.

• Meta-herramienta: gitlab_vulnerability, acción severity_count
• Herramienta individual: gitlab_vulnerability_severity_count
• Nivel: Ultimate
• Comportamiento: solo lectura, idempotente

Parámetro	Tipo	Requerido	Descripción
project_path	string	sí	Full path of the project (e.g. my-group/my-project)