For the complete documentation index, see llms.txt. This page is also available as Markdown.

Update Vulnerability Status

Description

Updates the status of an AttackForge vulnerability (also called a finding or issue) inside an existing project. This is a write operation.

Use this tool - not patch_vulnerability - whenever you want to reopen, close, or request a retest of a vulnerability. patch_vulnerability cannot make these transitions.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed. The accepted shape depends on the status being set:

  • Open and Closed both require a reason explaining the change.

  • Retest requests a retest to confirm remediation and must be sent without a reason.

Preconditions: the caller needs Edit access to the target vulnerability. On success the updated vulnerability id is returned.

How To Enable

  1. Go to Users

  2. Select the user you would like to provide access to this tool

  3. Click on Access > MCP

  4. Click on Add Tools

  5. Select the tool update_vulnerability_status and click Add

Example Prompts

  • Close vulnerability X - the issue has been fixed.

  • Close this finding, the risk has been formally accepted.

  • Reopen vulnerability X, it has not been fixed.

  • Submit vulnerability X for retest.

  • Request a retest on all the critical findings I fixed in project Y.

Parameters

Parameter
Type
Required
Description

args

object

Yes

The status-update payload. Its accepted keys depend on status - see the two shapes below.

args for Open / Closed:

Key
Type
Required
Description

project_id

string

Yes

Id (24-hex) of the project the vulnerability belongs to. Source: find_projects.

vulnerability_id

string

Yes

Id (24-hex) of the vulnerability. Source: find_vulnerabilities.

status

string

Yes

'Open' when the vulnerability is still present and unresolved, or 'Closed' when it no longer needs to be tracked.

reason

string

Yes

Why the status is being changed. For Open, e.g. "Issue has not been fixed". For Closed, e.g. "Issue has been fixed" or "Risk accepted". Prefer the suggested wording when it matches; otherwise supply a specific free-text reason.

args for Retest:

Key
Type
Required
Description

project_id

string

Yes

Id (24-hex) of the project the vulnerability belongs to. Source: find_projects.

vulnerability_id

string

Yes

Id (24-hex) of the vulnerability being submitted for retest. Source: find_vulnerabilities.

status

string

Yes

Must be 'Retest'.

reason must not be supplied when status is 'Retest'; the call is rejected if it is.

Example Response

Last updated