Open
Conversation
Add MCP prompts infrastructure to guide LLMs in performing comprehensive vulnerability detection workflows. Without prompts, LLMs may only call one tool (e.g., just deployments) missing coverage across orchestrator components, deployments, and nodes. Implement two prompts: - check-vuln: Flexible vulnerability detection with scope-based workflows (fleet/cluster/workloads) supporting single or multiple CVE checks - list-cluster: Simple cluster inventory prompt The prompts provide explicit workflows ensuring consistent, complete vulnerability assessment across all infrastructure layers. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Refactor check_vuln.go to address linting issues:
- Extract parseArguments into focused helper methods to reduce complexity
- Replace interface{} with any for modern Go style
- Use fmt.Fprintf instead of WriteString(fmt.Sprintf) for efficiency
- Fix function ordering (unexported after exported)
- Use switch statements instead of if-else chains
- Add required whitespace for readability
- Fix line length violations
- Rename short variables (sb -> builder, v -> value)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Code quality improvements: - Extract common prompt handler boilerplate into RegisterWithStandardHandler - Remove redundant name field from prompt structs (return directly) - Add string builder capacity hint for better memory efficiency - Wrap errors in standard handler for better context This reduces duplication and makes adding new prompts easier: - Before: 13 lines of boilerplate per prompt - After: 1 line using RegisterWithStandardHandler Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add unit tests for all prompt components: - Registry tests: GetAllPrompts, GetPromptsets, enabled/disabled filtering - Base handler tests: RegisterWithStandardHandler with various scenarios - List cluster prompt tests: GetPrompt, GetMessages, RegisterWith - Check vuln prompt tests: - Argument parsing (single/multiple CVEs, various scopes) - Validation (required fields, scope validation) - Message generation (fleet/cluster/workloads scopes) - Error handling - Promptset tests: IsEnabled, GetPrompts Coverage: - internal/prompts: 57.9% - internal/prompts/config: 100.0% - internal/prompts/vulnerability: 88.1% All 45 tests passing. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Export ScopeFleet, ScopeCluster, ScopeWorkloads constants to eliminate stringly-typed code in tests. Update all test cases to use constants instead of hardcoded strings. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add t.Parallel() to all independent tests and subtests to enable concurrent execution. Reduces test execution time on multi-core systems. Added to 44 test functions across: - internal/prompts/base_test.go (4 tests) - internal/prompts/registry_test.go (4 tests) - internal/prompts/config/*.go (8 tests) - internal/prompts/vulnerability/*.go (28 tests) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
❌ 2 Tests Failed:
View the full list of 2 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
E2E Test ResultsCommit: 9533da0 |
mtodor
reviewed
Apr 10, 2026
Collaborator
mtodor
left a comment
mtodor
left a comment
There was a problem hiding this comment.
There are two conceptual things that we should consider changing:
-
Config: I find the configuration a bit complex. It would be best if we could couple prompts with already existing toolsets. In that case, we know if a toolset is enabled, all tools relevant for a specific prompt are available. In this case, we could get it in a situation where prompt is enabled, but actually, tools are not, and we should avoid such situations.
-
Prompt prefix: Is prefix
mcp__<mcp-server>__<prompt>something that's standardized or not? If not, we could have situations where prompts are colliding with other MCP servers. It would be best if we would prefix prompts withacsorstackrox, depending on the build. (i.e.acs-list-cluster).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add MCP prompts infrastructure to guide LLMs in performing comprehensive vulnerability detection workflows. Without prompts, LLMs may only call one tool (e.g., just deployments) missing coverage across orchestrator components, deployments, and nodes.
Implement two prompts:
(fleet/cluster/workloads) supporting single or multiple CVE checks
The prompts provide explicit workflows ensuring consistent, complete vulnerability assessment across all infrastructure layers.
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com### Description
Validation