[lerouxb]

Add @mongodb-js/auto-vulnerability-triage

An AI-assisted first pass on npm dependency vulnerability tickets in Jira. For each candidate ticket it investigates whether the finding affects the released product and current main independently — pinned commits, not working trees — gathers cited evidence (advisories, dependency graphs, source, release artifacts), and drafts per-target review comments with a provisional verdict: likely affected, likely not affected, or needs investigation, with explicit evidence gaps when it can't tell.

A human makes the final call. The tool never closes tickets, accepts risk, or changes status. Comments carry anchors and input fingerprints so repeat runs skip unchanged tickets for free (zero model calls).

Modes

• --mode dry-run (default): previews proposed comments locally, marked NOT SENT. Jira receives GET requests only. Full per-ticket audit JSONL lands in ./triage-results.
• --mode update-jira (opt-in): creates or updates the proposed comments on matching tickets as the JIRA_TOKEN identity. Write failures mark the ticket failed and exit nonzero; partial writes are recorded in the audit file.
• --ignore-comments: plans as if the ticket had no existing comments (they're left untouched) — useful for a fresh first write.
• Also: --discover (credential-light routing preview, no model calls) and --replay-file (offline re-check of a saved audit file).

Required flags

--jql and --repo are required with no defaults — choosing the ticket queue and the target checkout is always an explicit decision, so an accidental queue sweep against the wrong repository can't happen silently:

auto-vulnerability-triage \
  --repo /path/to/checkout \
  --product packages/<product>/package.json \
  --jql '<saved filter or key = VULN-12345>'

Required environment variables

Variable	Purpose
JIRA_URL	Jira base URL (HTTPS, no embedded credentials)
JIRA_TOKEN	Jira Bearer/PAT. A read-only identity suffices for dry runs; update-jira needs comment write permission
GROVE_API_KEY	Approved gateway key for model inference
GITHUB_TOKEN	Public-repo read access for advisory/source evidence (falls back to gh auth token)

Usage

# preview routing and product selection (no model cost)
auto-vulnerability-triage --repo /path/to/checkout --jql '<query>' --discover --limit 5

# one ticket, dry run
auto-vulnerability-triage --repo /path/to/checkout --product packages/<product>/package.json --jql 'key = VULN-12345' --limit 1

# write the proposed comments (opt-in)
auto-vulnerability-triage --repo /path/to/checkout --product packages/<product>/package.json --jql 'key = VULN-12345' --limit 1 --mode update-jira

Examples

node packages/auto-vulnerability-triage/bin/auto-vulnerability-triage.js \
  --repo "$HOME/mongo/compass" \
  --jql 'filter = 60860 AND project != CLOUDP AND created >= "2026-01-01"' \
  --product packages/compass/package.json \
  --ticket-workers 3 \
  --limit 100 \
  --debug

# because reasons
git -C "$HOME/mongo/mongosh" config remote.origin.tagOpt --tags
git -C "$HOME/mongo/mongosh" fetch origin --tags

node packages/auto-vulnerability-triage/bin/auto-vulnerability-triage.js \
  --repo "$HOME/mongo/mongosh" \
  --jql 'filter = 60860 AND project != CLOUDP AND created >= "2026-01-01"' \
  --product packages/mongosh/package.json \
  --ticket-workers 3 \
  --limit 100 \
  --debug

node packages/auto-vulnerability-triage/bin/auto-vulnerability-triage.js \
  --repo "$HOME/mongo/vscode" \
  --product package.json \
  --jql 'filter = 60860 AND project != CLOUDP AND created >= "2026-01-01"' \
  --ticket-workers 3 \
  --limit 100 \
  --debug

node packages/auto-vulnerability-triage/bin/auto-vulnerability-triage.js \
  --repo "$HOME/mongo/mongodb-mcp-server" \
  --product packages/mongodb-mcp-server/package.json \
  --jql 'filter = 63609' \
  --ticket-workers 3 \
  --limit 100 \
  --debug

Safety properties worth reviewing

• All external reads are allowlisted and pinned (registry, GitHub, NVD, Jira GET); no writes anywhere in dry-run.
• The report validator is deterministic: machine-observed dependency versions, advisory ranges, and packaging evidence gate every verdict — model prose alone can't establish "not affected".
• Ticket text and external content are treated as untrusted evidence, never instructions.

Reviewer notes

Large diff, mostly tests. Suggested order: src/vulnerability-triage.ts (planning + Jira client + writer) → src/triage-evidence.ts (evidence readers) → src/triage-dependencies.ts (lockfile graphs) → src/triage-assessment.ts (report validation/rendering) → src/triage-vulnerabilities.ts (CLI orchestration). test/ fixtures + *.spec.ts are mechanical.

Follow-up actions

• GitHub Actions for compass, mongosh, vscode and mongodb-mcp-server to call this regularly
• GitHub secrets for those repos with the grove and jira tokens
• will have to commission these tokens too.

(Right now someone has to run this themselves.)