Find Remediation Notes

Description

Lists the remediation notes attached to one or more AttackForge vulnerabilities. A remediation note is a timestamped, authored comment recording remediation progress, guidance, or discussion for a single vulnerability. Use this when you need the actual records - call count_remediation_notes when only a total is needed.

Supply the vulnerabilities to inspect via vulnerability_ids. Results are automatically scoped to notes on vulnerabilities the caller can see (View access for released, Edit access for pending); notes the caller cannot see are silently omitted. Results are paginated (default 10 per page, max 50).

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_remediation_notes and click Add

Example Prompts

• Show me the remediation notes on vulnerability X.

• What is the latest remediation progress on my critical findings?

• Who has commented on this vulnerability, and when?

• Find remediation notes mentioning a patch or workaround.

• Show me the remediation notes added since January.

• List the files attached to the remediation notes on this finding.

Parameters

Parameter	Type	Required	Description
vulnerability_ids	array	Yes	The vulnerabilities whose remediation notes you want to list (array of 24-hex ids). Source: find_vulnerabilities. Ids the caller cannot see under the visibility rule are silently dropped.
filter	object	No	A MongoDB-style filter. Supported fields are listed below.
visibility	string	No	'visible' (default), 'pending', or 'all' - see count_remediation_notes.
fields	array	No	Fields to include on each note (id is always returned). Supported values are listed below.
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported filter fields:

Field	Type / Values
id	ObjectId('<24 hex>')
created, modified	ISO-8601 datetime
note	string (the note content)
author_id	ObjectId('<24 hex>') - the user who authored the note
vulnerability_id	ObjectId('<24 hex>') - the parent vulnerability

Do NOT restrict which vulnerabilities are inspected via filter - use the vulnerability_ids parameter.

Supported fields values:

Field	Type
id	string
created, modified	ISO-8601 datetime
note	string (AttackForge richtext)
files	array of { id, created, modified, name, mimeType, hash, size, storage_name, storage_location }
author_id	string
vulnerability_id	string

Fetch the binary contents of any attached file with get_file, using the id from files.

Example Response

{
  "data": [
    {
      "id": "6981b0c4a1d3e45f77c20981",
      "created": "2026-03-04T09:12:44.021Z",
      "modified": "2026-03-04T09:12:44.021Z",
      "note": "<p>Vendor patch 4.2.1 has been applied to the affected hosts. Awaiting confirmation from the platform team before requesting a retest.</p>",
      "author_id": "5ad737d6e576e6290aff1808",
      "vulnerability_id": "656168055d7035a12ade4cb3",
      "files": [
        {
          "id": "6981b0c4a1d3e45f77c20982",
          "created": "2026-03-04T09:12:44.500Z",
          "modified": "2026-03-04T09:12:44.500Z",
          "name": "patch-evidence.png",
          "mimeType": "image/png",
          "hash": "0f1c2a1e2f3c4b5a6978daf0e1b2c3d4e5f60718293a4b5c6d7e8f9012345678",
          "size": 84213,
          "storage_name": "kx8m2p4qw9r1t3y5u7i0o2a4s6d8f0g2h4j6k8l0z2x4c6v8b0n2m4q6w8e0r2t4",
          "storage_location": "test-attackforge-dev/issues/2026-3-4/656168055d7035a12ade4cb3"
        }
      ]
    }
  ],
  "count": 1,
  "total": 4
}