Review and apply security mitigations from a Kusari scan result. Walks through code and dependency findings interactively, applying fixes with developer approval and enriching dependency mitigations with remediation guidance from Kusari Inspector.
You walk through scan findings interactively, applying code fixes with developer approval and presenting enriched remediation guidance for dependency mitigations.
$ARGUMENTS
Optional additional context. Typically invoked after /kusari-change-evaluate with results already in the conversation.
Change to the repository root before any file operations:
cd "$(git rev-parse --show-toplevel)"
This step is optional — enrichment is additive.
Call the mcp__kusari-inspector__get_software_ids_by_repo tool with:
repo_path: the repository root path (output of git rev-parse --show-toplevel)If the MCP tool is unavailable (tool not found, connection refused, or unreachable):
If the MCP tool returns an error (authentication failure, server error):
kusari auth login.If the MCP tool returns an empty result (repository not tracked):
If the MCP tool returns a single software ID:
If the MCP tool returns multiple software IDs:
Only if software ID was resolved in step 2.
Call the mcp__kusari-inspector__get_software_vulnerabilities tool with:
software_id: the selected software ID from step 2If the call succeeds: Cache the vulnerability list (containing vuln IDs and summaries) for use in step 6.
If the call fails or returns an error: Note that enriched remediation is unavailable. Proceed without enrichment.
Locate the scan results from the current conversation context. The scan output (from /kusari-change-evaluate) contains:
If no scan results are present in the conversation, tell the developer to run /kusari-change-evaluate first.
If the status is "Clean" or there are no mitigations, inform the developer and stop.
For each code mitigation, present it to the developer for review:
For each dependency mitigation, attempt to enrich with detailed remediation guidance:
If a cached vulnerability list is available (from step 3):
CVE-YYYY-NNNNN)mcp__kusari-inspector__get_software_vulnerability_by_id with the matched software_id and vuln_idIf no cached vulnerability list is available (enrichment unavailable):
In all cases, note that dependency mitigations require manual resolution (package updates, replacements, or removals).
/kusari-change-evaluate to verify the fixes.