You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+13-5Lines changed: 13 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,23 +21,31 @@ _Changes on `main` since the latest tagged release that have not yet been includ
21
21
-**Persistent MRVA workflow state and caching** — Introduced a new `SqliteStore` backend plus opt-in annotation, audit, and query result cache tools to support the next phase of MCP-assisted CodeQL development and `seclab-taskflow-agent` integration. ([#169](https://github.com/advanced-security/codeql-development-mcp-server/pull/169))
22
22
-**Rust language support** — Added first-class Rust support with `PrintAST`, `PrintCFG`, `CallGraphFrom`, `CallGraphTo`, and `CallGraphFromTo` queries, bringing the total supported languages to 10. ([#195](https://github.com/advanced-security/codeql-development-mcp-server/pull/195))
23
23
-**Bug fixes and design improvements from v2.25.1-next.2 evaluation** — Fixed 5 bugs across `bqrs_interpret`, `bqrs_info`, `annotation_search`, `audit_add_notes`, and `query_results_cache_compare`; added `database_analyze` auto-caching and per-database mutex serialization; auto-enabled annotation tools in VS Code extension. ([#199](https://github.com/advanced-security/codeql-development-mcp-server/pull/199))
24
+
-**SARIF analysis tools and cache model improvements** — Added `sarif_list_rules`, `sarif_extract_rule`, `sarif_rule_to_markdown`, `sarif_compare_alerts`, and `sarif_diff_runs` tools for rule-level SARIF extraction, Mermaid dataflow visualization, alert overlap analysis, and cross-run behavioral comparison. Extended cache model with `rule_id` and `run_id` columns; added `ruleId` filter to all cache tools; auto-decompose `database_analyze` SARIF into per-rule cache entries. Added `compare_overlapping_alerts` prompt and updated all SARIF-related prompts with tool recommendations. Extracted shared libraries for database metadata and SARIF rule name resolution. ([#201](https://github.com/advanced-security/codeql-development-mcp-server/issues/201))
Copy file name to clipboardExpand all lines: server/src/prompts/compare-overlapping-alerts.prompt.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ This workflow supports:
19
19
20
20
### Step 1: Discover available rules
21
21
22
-
Use `sarif_list_rules` on each SARIF source to understand what rules and result counts are present:
22
+
Use #sarif_list_rules on each SARIF source to understand what rules and result counts are present:
23
23
24
24
```
25
25
sarif_list_rules(sarifPath="{{sarifPathA}}")
@@ -34,18 +34,18 @@ Depending on the use case, choose the appropriate strategy:
34
34
35
35
**Same-file, different rules** (custom vs standard overlap):
36
36
37
-
- Use `sarif_extract_rule` to extract each rule's results from the same file
38
-
- Use `sarif_compare_alerts` to compare individual alert pairs
37
+
- Use #sarif_extract_rule to extract each rule's results from the same file
38
+
- Use #sarif_compare_alerts to compare individual alert pairs
39
39
40
40
**Different files, same rule** (behavioral deviation across runs):
41
41
42
-
- Use `sarif_diff_runs` to get a high-level diff of added/removed/changed rules
43
-
- For changed rules, use `sarif_extract_rule` on both files and compare results
42
+
- Use #sarif_diff_runs to get a high-level diff of added/removed/changed rules
43
+
- For changed rules, use #sarif_extract_rule on both files and compare results
44
44
45
45
**Different files, different rules** (cross-pack overlap):
46
46
47
-
- Use `sarif_extract_rule` on each file with the respective rule IDs
48
-
- Use `sarif_compare_alerts` with different `sarifPath` values for alertA and alertB
47
+
- Use #sarif_extract_rule on each file with the respective rule IDs
48
+
- Use #sarif_compare_alerts with different `sarifPath` values for alertA and alertB
49
49
50
50
### Step 3: Diff runs (for cross-run comparison)
51
51
@@ -80,7 +80,7 @@ The markdown report includes:
80
80
81
81
### Step 5: Compare specific alerts for overlap
82
82
83
-
Use `sarif_compare_alerts` to compare individual results between rules or files. Each alert specifier can reference a **different SARIF file**:
83
+
Use #sarif_compare_alerts to compare individual results between rules or files. Each alert specifier can reference a **different SARIF file**:
84
84
85
85
```
86
86
sarif_compare_alerts(
@@ -99,7 +99,7 @@ If sink overlap is found, re-check with `source` and `full-path` modes:
99
99
100
100
### Step 6: Read source code context
101
101
102
-
For each overlapping pair, use `read_database_source` to read the relevant source file from the CodeQL database. **Note**: the `filePath` parameter uses the URI from the SARIF alert location, not an absolute path:
102
+
For each overlapping pair, use #read_database_source to read the relevant source file from the CodeQL database. **Note**: the `filePath` parameter uses the URI from the SARIF alert location, not an absolute path:
- For cross-version comparison, run `codeql database analyze` with two different CodeQL CLI versions against the same database, save both SARIF files, and use `sarif_diff_runs` to compare
147
+
- For cross-version comparison, run `codeql database analyze` with two different CodeQL CLI versions against the same database, save both SARIF files, and use #sarif_diff_runs to compare
Copy file name to clipboardExpand all lines: server/src/prompts/run-query-and-summarize-false-positives.prompt.md
+10-7Lines changed: 10 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,15 +12,18 @@ Help a developer discover what kinds of false positives are produced by their cu
12
12
13
13
1. Read the provided CodeQL query to understand what patterns it is designed to detect.
14
14
2. Discover the results of this query on a real database, by:
15
-
- Running the tool #list_query_run_results to find existing runs for this query
16
-
- If no existing runs are found, run the query on a relevant database using #codeql_query_run tool
17
-
3. Analyze and group the results into what appear to be similar types of results. This may mean:
15
+
- Using #query_results_cache_lookup with `ruleId` (the query's `@id` metadata) to find previously cached results
16
+
- Running #list_query_run_results to find existing run artifacts
17
+
- If no existing results are found, run the query using #codeql_query_run with `format: "sarif-latest"` to produce SARIF output (results are auto-cached with `ruleId` for later lookup)
18
+
3. Use #sarif_list_rules on the SARIF output to confirm rule metadata and result counts. For multi-rule SARIF, use #sarif_extract_rule to isolate the specific query's results.
19
+
4. Use #sarif_rule_to_markdown to generate a structured overview with a results table and Mermaid dataflow diagrams for path-problem results. This gives an immediate visual summary of all findings.
20
+
5. Analyze and group the results into what appear to be similar types of results. This may mean:
18
21
- Grouping results in the same file
19
22
- Grouping results that reference the same elements
20
23
- Grouping results with similar messages
21
-
4. For each group, explore the actual code for a sample of alerts in that group, using the #read_database_source tool to triage the results and determine which groups appear to be false positives
22
-
5. For each false positive case discovered in this exploration, group them into categories of similar root causes. For example, a query might not properly account for unreachable code, or there may be a commonly used library that violates the query's assumptions but is actually safe.
23
-
6. Explain these results to the user in order of most common to least common, so they can understand where their query may need improvement to reduce false positives.
24
+
6. For each group, explore the actual code for a sample of alerts using #read_database_source with the `filePath` from the SARIF alert URI and 10–20 lines of context around the flagged location.
25
+
7. For each false positive case discovered, group them into categories of similar root causes.
26
+
8. Explain these results to the user in order of most common to least common.
24
27
25
28
## Input Context
26
29
@@ -32,7 +35,7 @@ You will be provided with:
32
35
33
36
### Exploring code paths
34
37
35
-
The tool #read_database_source can be used to read the code of a particular finding. A good strategy to explore the code paths of a finding is:
38
+
Use #read_database_source with the `filePath` from the SARIF alert's `physicalLocation.artifactLocation.uri` and the `databasePath` of the CodeQL database. Read 10–20 lines around the flagged location:
36
39
37
40
1. Read in the immediate context of the violation.
38
41
- Some queries may depend on later context (e.g., an "unused variable" may only be used after its declaration)
Copy file name to clipboardExpand all lines: server/src/prompts/sarif-rank-false-positives.prompt.md
+12Lines changed: 12 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,18 @@ You will be provided with:
18
18
-**SARIF Results**: Array of results to analyze
19
19
-**Code Snippets**: When available, code snippets from SARIF physical locations
20
20
21
+
## Recommended Tool Usage
22
+
23
+
Use these tools to gather context for each result:
24
+
25
+
1.**#sarif_list_rules** — Discover all rules and result counts in the SARIF data. Helps scope the analysis.
26
+
2.**#sarif_extract_rule** — Extract results for the specific query `@id` from multi-rule SARIF. Returns a clean SARIF subset.
27
+
3.**#sarif_rule_to_markdown** — Generate a structured markdown report with results table and Mermaid dataflow diagrams. Provides an immediate visual overview of all findings.
28
+
4.**#read_database_source** — Read source code from the CodeQL database using the `filePath` from the SARIF alert URI. Read 10–20 lines around each flagged location for context.
29
+
5.**#query_results_cache_lookup** with `ruleId` — Check if results for this query are already cached from previous runs.
30
+
6.**#sarif_compare_alerts** — When the same codebase has results from both standard and custom queries, compare alert locations to distinguish unique findings from overlapping ones.
31
+
7.**#sarif_diff_runs** — Compare against a baseline SARIF run to identify new results vs previously known findings.
32
+
21
33
## Analysis Guidelines
22
34
23
35
### What Makes a Result Likely to be a False Positive?
Copy file name to clipboardExpand all lines: server/src/prompts/sarif-rank-true-positives.prompt.md
+12Lines changed: 12 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,18 @@ You will be provided with:
18
18
-**SARIF Results**: Array of results to analyze
19
19
-**Code Snippets**: When available, code snippets from SARIF physical locations
20
20
21
+
## Recommended Tool Usage
22
+
23
+
Use these tools to gather context for each result:
24
+
25
+
1.**#sarif_list_rules** — Discover all rules and result counts in the SARIF data. Helps scope the analysis.
26
+
2.**#sarif_extract_rule** — Extract results for the specific query `@id` from multi-rule SARIF. Returns a clean SARIF subset.
27
+
3.**#sarif_rule_to_markdown** — Generate a structured markdown report with results table and Mermaid dataflow diagrams. Provides quick visual triage of dataflow paths.
28
+
4.**#read_database_source** — Read source code from the CodeQL database using the `filePath` from the SARIF alert URI. Read 10–20 lines around each flagged location to verify vulnerability patterns.
29
+
5.**#query_results_cache_lookup** with `ruleId` — Check if results for this query are already cached from previous runs.
30
+
6.**#sarif_compare_alerts** — Compare results across different SARIF files (e.g., standard vs custom query packs) to identify which findings are unique to the query under analysis.
31
+
7.**#sarif_diff_runs** — Compare against a baseline SARIF run to distinguish new findings from regressions.
32
+
21
33
## Analysis Guidelines
22
34
23
35
### What Makes a Result Likely to be a True Positive?
0 commit comments