Feat/additional metrics studio remy split#46
Conversation
Dedupes the required/not-required branching in createToolFromDefinition and adds enum/object property support, so tool definitions can declare constrained string values and nested object parameters. Unused until a later commit adds schema entries that need it.
Mint one correlation ID per studio-mcp process (each IDE connection gets a fresh process) and stamp it on every snyk_send_feedback analytics event via NewAnalyticsEventParam, so events emitted by the same session can be joined downstream instead of each call minting its own random ID.
…an-result cache Cache the freshest scan findings per file path from successful snyk_code_scan/snyk_sca_scan calls, then check snyk_send_feedback's claimed IDs against that cache and stamp the result (verified/unverifiable/mismatch) on the analytics event. Verification never blocks or delays the feedback call - it's a best-effort, observational check only.
Add optional severity/scan-type breakdowns, outcome, breakabilityRisk(+source), strategy, and testsPassed fields to snyk_send_feedback, populated by remediation callers (snyk-fix.md, snyk-batch-fix.md, skills/snyk-fix/SKILL.md) and the secure-at-inception Stop Hook. All fields are optional and additive: counts remain the authoritative metric.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit da9bd29. Configure here.
| if isWithinDir(filePath, workDir) { | ||
| idsByFile[filePath] = make(map[string]struct{}) | ||
| } | ||
| } |
There was a problem hiding this comment.
File scan clears sibling cache
Medium Severity
When a scan tool is invoked with a file path, workingDir is the file’s parent directory, but updateScanCache treats any existing directory workDir as a full-tree authoritative scan and zeroes cached findings for every same-type file under that directory not present in the current SARIF/SCA output. A narrow re-scan can therefore wipe still-vulnerable siblings and make verifyIDs report verified for fixes that were not validated.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit da9bd29. Configure here.
2 participants
Description
Extends the snyk_send_feedback MCP tool to capture richer, more trustworthy remediation/prevention analytics.
Changes:
Checklist
make generate)make lint-fix)Note
Medium Risk
Adds new analytics behavior and a breaking signature on NewAnalyticsEventParam (fourth arg); verification is heuristic and in-memory only, so mismatch/unverifiable tags can misrepresent edge cases without affecting user-facing tool success.
Overview
Extends
snyk_send_feedbackso remediation/prevention telemetry is richer and easier to trust downstream, without changing the existing count fields as the source of truth.Session correlation: A UUID is minted once per MCP process at
Start()and passed intoNewAnalyticsEventParamasInteractionUUID, so multiple feedback events in the same IDE session share one interaction URN instead of each call getting a new ID.Scan-result cache & verification: Successful
snyk_code_scan/snyk_sca_scanruns (before output enhancement) populate an in-process, LRU-capped cache of findings per file.snyk_send_feedbackbest-effort checksfixedIssueIds/preventedIssueIdsagainst that cache and addsmcp::verification(verified|unverifiable|mismatch); it never blocks the tool.Schema & payload: Tool JSON and MCP schema building gain object / enum params. New optional feedback args (e.g.
fixedIssueIds, severity/scan-type breakdowns, outcome, breakability, strategy,testsPassed) are forwarded into the analytics extension when present.golangci-lintis bumped in the Makefile.Reviewed by Cursor Bugbot for commit da9bd29. Bugbot is set up for automated code reviews on this repo. Configure here.