Skip to content

Add get_upgrade_guidance MCP tool - #299

Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom
singhrohit90:feature/get-upgrade-guidance-tool
Open

Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom
singhrohit90:feature/get-upgrade-guidance-tool

Conversation

@singhrohit90

@singhrohit90singhrohit90 commented Aug 29, 2026

Copy link
Copy Markdown

Summary

The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.

What this adds

  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.

Testing

  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.

Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.

Possible follow-ups (didn't want to scope-creep this PR)

  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.

Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.

Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).

rohising added 2 commits August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Add get_upgrade_guidance MCP tool by singhrohit90 · Pull Request #299 · blackducksoftware/hub-rest-api-python · GitHub
Skip to content
Add get_upgrade_guidance MCP tool - #299
Open
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Open
Add get_upgrade_guidance MCP tool#299
singhrohit90 wants to merge 2 commits into
blackducksoftware:masterfrom 
singhrohit90:feature/get-upgrade-guidance-tool
Conversation
@singhrohit90
@singhrohit90singhrohit90
commented
Aug 29, 2026

Copy link


Copy Markdown

Summary
The MCP server (blackduck/mcp_server.py) exposes list_project_components and get_project_vulnerabilities, but nothing wires up BlackDuck's upgrade-guidance endpoints — so an agent using this MCP server can find a vulnerable component but has no way to ask "what should I upgrade to?" without dropping out of MCP and hitting the REST API directly.
What this adds
  • A new get_upgrade_guidance(component_id, component_version_id) tool. It tries .../transitive-upgrade-guidance first, then falls back to .../upgrade-guidance — the transitive variant needs an originId that isn't always available from list_project_components's output, so the fallback keeps the tool useful even without it.
  • componentId / componentVersionId fields added to list_project_components's output (extracted from the existing component/componentVersion href fields), so a caller can chain straight from list_project_components into get_upgrade_guidance without any extra lookups.
Testing
  • Live-verified against a real BlackDuck 2025.7.1 instance on an actual vulnerable component (ag-grid-community 24.0.0) — transitive-upgrade-guidance 404'd (no originId), correctly fell back, and returned real short/long-term upgrade recommendations with vulnerability-risk counts (e.g. long-term target with 0 critical/high/medium/low).
  • Also verified on Apache Commons BeanUtils (1.8.0/1.9.1/1.9.3) — all three resolved to the same safe target version (1.11.0, zero known vulnerabilities), consistent with what the BlackDuck UI itself would recommend.
  • Added test/test_mcp_server_upgrade_guidance.py: unit tests (mocked Client, no network) covering the fallback behavior, the both-endpoints-unavailable case, and the id-extraction addition to list_project_components.
  • Ran the full existing suite (pytest test/) — all 45 tests pass, no regressions.
Note: the new test file guards its fastmcp import with pytest.importorskip since fastmcp isn't in requirements.lock.txt (it's the optional mcp extra) — so it skips cleanly rather than failing CI in environments without it installed.
Possible follow-ups (didn't want to scope-creep this PR)
  • Origin-aware lookup so transitive-upgrade-guidance can actually succeed when an originId is available (e.g. threading it through from a BOM listing that includes origins).
  • list_project_components could optionally return originId alongside componentId/componentVersionId to support the above.
Happy to adjust scope, naming, or approach — this is one of my first contributions to a project I don't maintain, so please push back on anything that doesn't fit your conventions.
Related: #298 (independent bug fix in the same file, opened separately so it can be reviewed/merged on its own).
rohising
added 2 commits
August 29, 2026 16:58
rohising
Add get_upgrade_guidance MCP tool
62aefda
Wires up the upgrade-guidance endpoint that Black Duck exposes but the
existing MCP tools never call. Tries transitive-upgrade-guidance first,
falls back to upgrade-guidance since the transitive variant requires an
originId not always available from list_project_components. Also adds
componentId/componentVersionId to list_project_components output so
results can be chained straight into this tool.
Verified live against a real 2025.7.1 instance.
rohising
Add tests for get_upgrade_guidance tool and list_project_components i…
5d9b92a
…d extraction
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@singhrohit90