Fortify on Demand (FoD) Skill

Fortify on Demand (FoD) integration via Model Context Protocol (MCP).

When to Use This Skill

• List applications and releases
• Run security scans (SAST, SCA, DAST, MAST)
• List security issues/vulnerabilities with filtering by severity, category, etc.
• Count issues grouped by severity, category, etc.
• Manage scan configurations and monitor scan progress
• Generate and download security reports

Parameter Formats

Common formats and examples for key parameters: | Parameter | Format | Example | |-----------|-------------|-------------| | --release | "<App>[:<MicroService>]:<Release>" - case-sensitive, colon-separated (for *_list, *_scan_setup, *_scan_start, *_scan_get_config tools) | "MyApp:MyRelease" or "MyApp:MyService:MyRelease" | | qualifiedReleaseNameOrId | "<App>[:<MicroService>]:<Release>" - positional param, case-sensitive, colon-separated (for release_get tool) | "MyApp:MyRelease" or "MyApp:MyService:MyRelease" | | appNameOrId | Application name or ID - positional param, camelCase (for app_get tool) | "MyApp" or "5011" | | releaseQualifiedScanOrId | Scan ID or qualified scan ID (for *_scan_get tools) - Always use scan ID returned from *_scan_start or from *_scan_list | "12345" or "MyApp:MyRelease:12345" | | --include | Control which issue statuses to include. By default, only visible issues returned. Comma-separated values: visible, fixed, suppressed | "visible,fixed" or "suppressed" | | --embed | Comma-separated values to include additional data. Valid values: allData, summary, details, recommendations, history, requestResponse, headers, parameters, traces | "details,recommendations,history" | | file | Path to packaged zip or report output | "package.zip", "report.pdf" |

Authentication

All operations require authentication. Always verify session before any operation:

fcli_fod_session_list refresh-cache=true

• If Expired = No → proceed
• If expired → ask user to run locally: fcli fod session login --url <URL> --client-id <id> --client-secret <secret>
• When running any FoD tool, if authentication error occurs, prompt user to re-authenticate locally.

Note: Reference workflows assume authentication has been verified.

Domain-Specific Guidance

Scan Workflows: Always Check Settings First

Before starting any scan, follow this sequence:

1. Check existing scan configuration using *_scan_get_config command
2. If not configured → Always ask user for required settings (language, build tool, framework, etc.)
3. Never infer settings from workspace - build tools, language versions, and frameworks must be user-confirmed
4. Package source code (SAST/SCA only) using fcli_fod_action_package
5. Upload and start scan using appropriate *_scan_start command
6. Monitor progress using *_scan_wait_for or periodic *_scan_get calls

Packaging Requirements

• SAST scans: Package source code with fcli_fod_action_package
• SCA/OSS scans: Package source code with fcli_fod_action_package (same as SAST)
• DAST scans: No packaging needed - scans live running application
• MAST scans: Upload mobile app binary (APK/IPA file)
• Note: To enable Open Source Analysis in a SAST scan, use --oss flag in fcli_fod_sast_scan_setup

Filtering: Use query for Client-Side, --include for Status

• Use query for client-side filtering by valid fields: category, foundInReleases, instanceId, location, severity, visibilityMarker
• Use --include to control issue status visibility: visible (default), fixed, suppressed
• --filters-param does NOT exist — do not use it; it will fail
• Common examples: query {"severity": "Critical"}, query {"category": "SQL Injection"}, --include "suppressed"

Pagination

• If pagination.hasMore = true → use pagination-offset for next page
• Continue until pagination.hasMore = false or pagination.totalRecords reached

Error Recovery

| Error | Recovery | |-------|----------| | "Session expired" | Refer to flow in Authentication section | | "Release not found" | Run release_list to discover correct names (see Finding Releases) | | "Scan not configured" | Ask user for scan settings and run *_scan_setup | | "Package required" | Run fcli_fod_action_package to package source code |

Decision Tree: Choosing the Right Approach

| User Intent | Action | |-------|----------| | "run SAST scan" / "static analysis" | Check config → ask settings → package → sast_scan_start (see SAST Workflow) | | "run SCA scan" / "open source scan" | Package → oss_scan_start (see SCA Workflow) | | "run DAST scan" / "dynamic scan" | DAST Automated only — setup-website/api/workflow only support automated DAST types; manually-conducted Dynamic Assessments cannot be configured via MCP. Check config → ask settings → dast_scan_start (see DAST Workflow) | | "list/show vulnerabilities" | issue_list with query {"severity": "Critical"} + --embed details,recommendations — see List and Filter Vulnerabilities | | "how many / count / summary" | issue_list and aggregate results client-side — see Vulnerability Summary | | "find release / which release" | release_list → release_get (see Finding Releases) | | "show recommendations / how to fix" | issue_list with --embed recommendations,history → prioritize Aviator (see Remediation) |

Best Practices

DO:

• ✅ Always verify authentication before operations
• ✅ Check scan configuration before starting SAST scans
• ✅ Always ask user for SAST scan settings (language, build tool, framework)
• ✅ Use --oss flag in sast_scan_setup to enable Open Source Analysis in SAST scans
• ✅ Use query for client-side filtering (valid fields: severity, category, location, instanceId, foundInReleases, visibilityMarker)
• ✅ Use --include "suppressed" or --include "fixed" to retrieve non-default issue statuses
• ✅ Use --embed to include details, recommendations, and history
• ✅ Prioritize Fortify Aviator code fix suggestions in remediation
• ✅ Use MCP tools over FCLI CLI directly
• ✅ Monitor long-running scans with *_scan_wait_for

DO NOT:

• ❌ Guess release names - always discover with release_list if uncertain
• ❌ Infer SAST scan settings from workspace - always ask user
• ❌ Skip SAST scan configuration validation
• ❌ Prompt user for credentials - ask user to run fcli fod session login locally
• ❌ Start scans without confirming settings with user
• ❌ Package source code for DAST scans (not needed)
• ❌ Use dast_scan_setup_* for non-automated (manually-conducted) DAST assessments — only DAST Automated assessment types are supported

References

Example Workflows

| Workflow | Use When User Says... | |----------|----------------------| | Run SAST Scan | "run SAST scan", "static analysis", "scan source code", "check for code vulnerabilities" | | Run SCA Scan | "run SCA scan", "open source scan", "check dependencies", "OSS vulnerabilities", "software composition analysis" | | Run DAST Scan | "run DAST scan", "dynamic scan", "test running application", "web application security test" | | List and Filter Vulnerabilities | "list vulnerabilities", "show security issues", "filter issues by severity", "critical vulnerabilities" | | Find Release | "find release", "which release", "list releases", "search for application" | | Vulnerability Summary | "count vulnerabilities", "show summary", "breakdown by severity", "how many issues" | | Remediation Workflow | "show recommendations", "how to fix", "remediation advice", "Aviator suggestions", "code fixes" |

External Resources

• FCLI Documentation
• FoD Documentation
• FoD User Guide