feat: verify fixedIssueIds/preventedIssueIds against an in-process sc…

[MaVictor]

Description

Cache the freshest scan findings per file path from successful snyk_code_scan/snyk_sca_scan calls, then check snyk_send_feedback's claimed IDs against that cache and stamp the result (verified/unverifiable/mismatch) on the analytics event. Verification never blocks or delays the feedback call - it's a best-effort, observational check only.

Checklist

• Tests added and all succeed
• Regenerated mocks, etc. (make generate)
• Linted (make lint-fix)
• README.md updated, if user-facing
• License file updated, if new 3rd-party dependency is introduced

---

Note

Medium Risk
Touches the scan tool success path and feedback analytics semantics; incorrect cache scoping could mislabel verification, but feedback is observational only and does not gate tool success.

Overview
Adds an in-process scan-result cache (capped at 500 file paths) that records the latest SAST/SCA findings from successful snyk_code_scan and snyk_sca_scan calls. The cache is updated from raw CLI output before LLM-facing enhancement, using the tool’s original path argument as clear/authority scope so single-file rescans do not wipe sibling files.

snyk_send_feedback now accepts optional fixedIssueIds, emits those IDs on analytics, and runs a best-effort verification of combined preventedIssueIds + fixedIssueIds against the cache. Events get mcp::verification of verified, unverifiable, or mismatch (worst ID wins); verification never blocks the tool. Tool schema/docs are updated accordingly.

Cache logic handles clean rescans (zero findings), directory vs file scope, SAST/SCA separation on the same path, and LRU eviction. Broad unit and handler integration tests cover these cases.

^{Reviewed by Cursor Bugbot for commit d889a2d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ifeanyiecheruo
❌ MaVictor
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d889a2d. Configure here.}

[cursor]

Eviction yields false verified state

Medium Severity

VerifyID treats a claimed issue as verified whenever that ID is absent from every remaining cache entry of the matching scan type. After LRU eviction removes the only entries that ever held the ID, unrelated scans can still leave other same-type entries in the cache, so foundRelevantScan stays true and feedback can be tagged verified with no fresh evidence for that file or ID.

 

^{Reviewed by Cursor Bugbot for commit d889a2d. Configure here.}

[ifeanyiecheruo]

Changes look good