101 lines
3.2 KiB
Markdown
101 lines
3.2 KiB
Markdown
# dependencyTrack-MCP
|
|
|
|
MCP-Server fuer [OWASP Dependency-Track](https://dependencytrack.org/), in Rust.
|
|
Read-only Zugriff auf Projekte, Findings und Metriken.
|
|
|
|
Zwei Frontends, eine gemeinsame Tool-Logik:
|
|
|
|
| Modus | Binary | Einsatz |
|
|
|---|---|---|
|
|
| **stdio** | `dtrack-stdio` | Arbeitsrechner: von Claude Desktop via `podman run -i` gestartet |
|
|
| **HTTP** | `dtrack-http` | Server: StreamableHTTP `/mcp`, Multi-Client, Bearer-Auth |
|
|
|
|
> **Status: Stage 2** -- HTTP-Frontend + Bearer-Auth stehen. Admin-UI +
|
|
> Permission-Engine + SSO folgen (siehe Roadmap).
|
|
|
|
## Architektur
|
|
|
|
```
|
|
crates/dtrack-config Config (TOML laden/speichern, Secret-Masking)
|
|
crates/dtrack-core DT-REST-Client (reqwest+rustls, read-only)
|
|
crates/dtrack-tools rmcp-Server (die Tools) -- transport-unabhaengig, geteilt
|
|
crates/dtrack-stdio Bin: stdio-Frontend
|
|
crates/dtrack-http Bin: HTTP-Frontend (axum + StreamableHTTP)
|
|
```
|
|
|
|
## Tools
|
|
|
|
| Tool | Argument | DT-Endpoint |
|
|
|---|---|---|
|
|
| `list_projects` | -- | `GET /project` |
|
|
| `project_findings` | `uuid` | `GET /finding/project/{uuid}` |
|
|
| `project_metrics` | `uuid` | `GET /metrics/project/{uuid}/current` |
|
|
|
|
## Konfiguration (Umgebungsvariablen)
|
|
|
|
| Var | Pflicht | Bedeutung |
|
|
|---|---|---|
|
|
| `DTRACK_URL` | ja* | Basis-URL der DT-Instanz |
|
|
| `DTRACK_API_KEY` | ja* | API-Key eines **read-only** Teams (`VIEW_PORTFOLIO`, `VIEW_VULNERABILITY`) |
|
|
| `DTRACK_INSECURE` | nein | `1`/`true` -> TLS-Pruefung aus (Notbehelf bei internem CA-Cert) |
|
|
| `DTRACK_CONFIG` | nein | Pfad zu einer TOML-Config; hat Vorrang vor den env-Werten |
|
|
| `DTRACK_HTTP_TOKENS` | nein | (nur HTTP) kommagetrennte erlaubte Bearer-Tokens; leer = ungeschuetzt |
|
|
| `DTRACK_HTTP_ADDR` | nein | (nur HTTP) Bind-Adresse, Default `0.0.0.0:8080` |
|
|
|
|
\* oder ueber `DTRACK_CONFIG`-Datei.
|
|
|
|
## Server-Modus testen (z.B. Gaming-PC)
|
|
|
|
```sh
|
|
cp .env.example .env # DTRACK_URL / DTRACK_API_KEY ausfuellen
|
|
podman compose up --build
|
|
```
|
|
|
|
MCP-Client auf `http://<host>:8080/mcp` zeigen lassen; falls `DTRACK_HTTP_TOKENS`
|
|
gesetzt ist, `Authorization: Bearer <token>` mitgeben. Health-Check:
|
|
`curl http://localhost:8080/health`.
|
|
|
|
## stdio-Modus (Arbeitsrechner)
|
|
|
|
```sh
|
|
# bauen
|
|
cargo build --release --bin dtrack-stdio
|
|
podman build -t dtrack-mcp:latest -f Containerfile .
|
|
|
|
# transfer ohne Registry
|
|
podman save dtrack-mcp:latest | gzip > dtrack-mcp.tar.gz # -> uebertragen
|
|
podman load < dtrack-mcp.tar.gz # auf dem Laptop
|
|
```
|
|
|
|
Claude Desktop (`--network=host` fuer DT ueber die VPN-Route des Hosts):
|
|
|
|
```json
|
|
{
|
|
"mcpServers": {
|
|
"dependency-track": {
|
|
"command": "podman",
|
|
"args": [
|
|
"run", "-i", "--rm", "--network=host",
|
|
"-e", "DTRACK_URL", "-e", "DTRACK_API_KEY", "-e", "DTRACK_INSECURE",
|
|
"dtrack-mcp:latest"
|
|
],
|
|
"env": {
|
|
"DTRACK_URL": "https://dtrack.firma.intern",
|
|
"DTRACK_API_KEY": "odt_...",
|
|
"DTRACK_INSECURE": "0"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
## Roadmap
|
|
|
|
| Stage | Inhalt | Status |
|
|
|---|---|---|
|
|
| 0 | stdio, read-only, 3 Tools, CI, Container | ✅ |
|
|
| 1 | Config-Layer + geteiltes Tool-Crate | ✅ |
|
|
| 2 | HTTP-Frontend + Bearer-Auth | ✅ |
|
|
| 3 | Admin-UI (URL/Key/Rechte pflegbar, maskiert) + Permission-Engine + Audit | … |
|
|
| 4 | SSO (Gitea-OIDC) | … |
|