fortify-fod（强化食物）

Fortify on Demand (FoD) Skill

Fortify on Demand (FoD) integration via Model Context Protocol (MCP).

When to Use This Skill

• List applications and releases
• Run security scans (SAST, SCA, DAST, MAST)
• List security issues/vulnerabilities with filtering by severity, category, etc.
• Count issues grouped by severity, category, etc.
• Manage scan configurations and monitor scan progress
• Generate and download security reports

Parameter Formats

Common formats and examples for key parameters:

Authentication

All operations require authentication. Always verify session before any operation:

fcli_fod_session_list refresh-cache=true

• If Expired = No → proceed
• If expired → ask user to run locally: fcli fod session login --url <URL> --client-id <id> --client-secret <secret>
• When running any FoD tool, if authentication error occurs, prompt user to re-authenticate locally.

Note: Reference workflows assume authentication has been verified.

Domain-Specific Guidance

Scan Workflows: Always Check Settings First

Before starting any scan, follow this sequence:

1. Check existing scan configuration using *_scan_get_config command
2. If not configured → Always ask user for required settings (language, build tool, framework, etc.)
3. Never infer settings from workspace - build tools, language versions, and frameworks must be user-confirmed
4. Package source code (SAST/SCA only) using fcli_fod_action_package
5. Upload and start scan using appropriate *_scan_start command
6. Monitor progress using *_scan_wait_for or periodic *_scan_get calls

Packaging Requirements

• SAST scans: Package source code with fcli_fod_action_package
• SCA/OSS scans: Package source code with fcli_fod_action_package (same as SAST)
• DAST scans: No packaging needed - scans live running application
• MAST scans: Upload mobile app binary (APK/IPA file)
• Note: To enable Open Source Analysis in a SAST scan, use --oss flag in fcli_fod_sast_scan_setup

Filtering: Use query for Client-Side, --include for Status

• Use query for client-side filtering by valid fields: category, foundInReleases, instanceId, location, severity, visibilityMarker
• Use --include to control issue status visibility: visible (default), fixed, suppressed
• --filters-param does NOT exist — do not use it; it will fail
• Common examples: query {"severity": "Critical"}, query {"category": "SQL Injection"}, --include "suppressed"

Pagination

• If pagination.hasMore = true → use pagination-offset for next page
• Continue until pagination.hasMore = false or pagination.totalRecords reached

Error Recovery

Decision Tree: Choosing the Right Approach

Best Practices

DO:

• ✅ Always verify authentication before operations
• ✅ Check scan configuration before starting SAST scans
• ✅ Always ask user for SAST scan settings (language, build tool, framework)
• ✅ Use --oss flag in sast_scan_setup to enable Open Source Analysis in SAST scans
• ✅ Use query for client-side filtering (valid fields: severity, category, location, instanceId, foundInReleases, visibilityMarker)
• ✅ Use --include "suppressed" or --include "fixed" to retrieve non-default issue statuses
• ✅ Use --embed to include details, recommendations, and history
• ✅ Prioritize Fortify Aviator code fix suggestions in remediation
• ✅ Use MCP tools over FCLI CLI directly
• ✅ Monitor long-running scans with *_scan_wait_for

DO NOT:

• ❌ Guess release names - always discover with release_list if uncertain
• ❌ Infer SAST scan settings from workspace - always ask user
• ❌ Skip SAST scan configuration validation
• ❌ Prompt user for credentials - ask user to run fcli fod session login locally
• ❌ Start scans without confirming settings with user
• ❌ Package source code for DAST scans (not needed)
• ❌ Use dast_scan_setup_* for non-automated (manually-conducted) DAST assessments — only DAST Automated assessment types are supported

References

Example Workflows

External Resources

• FCLI Documentation
• FoD Documentation
• FoD User Guide