[kyletser]

Summary

get_global_security_advisory now accepts either a GHSA ID or a CVE ID.

Why

Fixes #3546

Agents asked to assess a CVE usually have the CVE ID, but the tool only accepted a GHSA ID, so the agent had to resolve the CVE through another source before it could read the advisory. Extending the existing tool keeps one advisory tool in the toolset.

What changed

• GetGlobalSecurityAdvisoryInput gains an optional cveId field; ghsaId is no longer required on its own, so the JSON schema publishes both as optional and the handler decides.
• findGlobalSecurityAdvisory keeps the GHSA path as a direct GET /advisories/{ghsa_id} fetch and resolves a CVE ID through GET /advisories?cve_id=, which is the filter GitHub provides for it.
• A CVE that matches no advisory returns a tool error; one that matches several returns the matching GHSA IDs and asks for a ghsaId, because the tool returns a single advisory and picking one silently would hide the others.
• Tool description, README, and the tool snapshot are regenerated from the schema.

MCP impact

• Tool schema or behavior changed
• No tool or API changes
• New tool added

get_global_security_advisory keeps its name, its security_events scope, its read-only annotation, and its output schema. Only the input schema and how the identifier is resolved change. Existing callers that pass ghsaId are unaffected.

Prompts tested (tool changes only)

• "Does CVE-2025-71330 affect my project?" — resolves the CVE to its advisory instead of requiring the GHSA ID first.
• "What is the severity of GHSA-w3rx-r6r6-pgpr?" — unchanged path through the GHSA lookup.
• "Summarize CVE-0000-00000" (no advisory) — reports that no advisory matches.

Security / limits

• Auth / permissions considered
• No security or limits impact
• Data exposure, filtering, or token/size limits considered

The scope is unchanged (security_events), and the result keeps the existing global-advisory IFC label, so the new path returns the same public, externally authored data as the GHSA path.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

golangci-lint v2.14.0 run ./pkg/github/... reports 0 issues, and gofmt -l is clean for the three touched Go files. go test ./... passes. ./script/test runs with -race, which needs cgo; this machine has no C compiler (gcc not found), so the suite was run without -race.

New test cases in pkg/github/security_advisories_test.go: lookup by CVE ID, a CVE with no advisory, a CVE with several advisories, neither identifier, and both identifiers. Each was checked to fail against the code before the cveId path was wired up.

Docs

• Updated (README / docs / examples)
• Not needed

README was regenerated with go run ./cmd/github-mcp-server generate-docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.