Add SCM context to lightweight MCP response: purl, scm_type, and rename ref to git_ref

Co-authored-by: fproulx-boostsecurity <76956526+fproulx-boostsecurity@users.noreply.github.com>

Author: Copilot

cmd/mcp_lightweight_test.go

@@ -73,8 +73,10 @@ func TestMCPResponseStructure(t *testing.T) {
 	response := mcpAnalysisResponse{
 		Findings:   []results.Finding{},
 		Rules:      map[string]results.Rule{},
+		Purl:       "pkg:github/owner/repo@main",
 		Repository: "owner/repo",
-		Ref:        "main",
+		ScmType:    "github",
+		GitRef:     "main",
 		CommitSha:  "abc123",
 		LastCommit: "2023-01-01T00:00:00Z",
 	}
@@ -87,8 +89,10 @@ func TestMCPResponseStructure(t *testing.T) {
 	// Verify lightweight structure
 	assert.Contains(t, jsonStr, "\"findings\":")
 	assert.Contains(t, jsonStr, "\"rules\":")
+	assert.Contains(t, jsonStr, "\"purl\":")
 	assert.Contains(t, jsonStr, "\"repository\":")
-	assert.Contains(t, jsonStr, "\"ref\":")
+	assert.Contains(t, jsonStr, "\"scm_type\":")
+	assert.Contains(t, jsonStr, "\"git_ref\":")
 	assert.Contains(t, jsonStr, "\"commit_sha\":")
 	assert.Contains(t, jsonStr, "\"last_commit\":")
 
@@ -115,8 +119,10 @@ func TestMCPResponseOmitsEmptyFields(t *testing.T) {
 	jsonStr := string(data)
 
 	// These fields should be omitted when empty due to omitempty tag
+	assert.NotContains(t, jsonStr, "\"purl\":")
 	assert.NotContains(t, jsonStr, "\"repository\":")
-	assert.NotContains(t, jsonStr, "\"ref\":")
+	assert.NotContains(t, jsonStr, "\"scm_type\":")
+	assert.NotContains(t, jsonStr, "\"git_ref\":")
 	assert.NotContains(t, jsonStr, "\"commit_sha\":")
 	assert.NotContains(t, jsonStr, "\"last_commit\":")
 
@@ -133,8 +139,10 @@ func TestMCPResponseSizeReduction(t *testing.T) {
 	lightweightResponse := mcpAnalysisResponse{
 		Findings:   []results.Finding{},
 		Rules:      map[string]results.Rule{},
+		Purl:       "pkg:github/test/repo@main",
 		Repository: "test/repo",
-		Ref:        "main",
+		ScmType:    "github",
+		GitRef:     "main",
 		CommitSha:  "abc123",
 		LastCommit: "2023-01-01T00:00:00Z",
 	}

cmd/mcp_server.go

@@ -26,8 +26,10 @@ type mcpAnalysisResponse struct {
 	Findings []results.Finding       `json:"findings"`
 	Rules    map[string]results.Rule `json:"rules"`
 	// Essential repository metadata
+	Purl       string `json:"purl,omitempty"`
 	Repository string `json:"repository,omitempty"`
-	Ref        string `json:"ref,omitempty"`
+	ScmType    string `json:"scm_type,omitempty"`
+	GitRef     string `json:"git_ref,omitempty"`
 	CommitSha  string `json:"commit_sha,omitempty"`
 	LastCommit string `json:"last_commit,omitempty"`
 }
@@ -312,8 +314,10 @@ func handleAnalyzeOrg(ctx context.Context, request mcp.CallToolRequest) (*mcp.Ca
 		combinedResponses = append(combinedResponses, mcpAnalysisResponse{
 			Findings:   pkgInsights.FindingsResults.Findings,
 			Rules:      pkgInsights.FindingsResults.Rules,
+			Purl:       pkgInsights.Purl,
 			Repository: pkgInsights.SourceGitRepo,
-			Ref:        pkgInsights.SourceGitRef,
+			ScmType:    pkgInsights.SourceScmType,
+			GitRef:     pkgInsights.SourceGitRef,
 			CommitSha:  pkgInsights.SourceGitCommitSha,
 			LastCommit: pkgInsights.LastCommitedAt,
 		})
@@ -357,8 +361,10 @@ func handleAnalyzeRepo(ctx context.Context, request mcp.CallToolRequest) (*mcp.C
 	combinedResponse := mcpAnalysisResponse{
 		Findings:   analysisResults.FindingsResults.Findings,
 		Rules:      analysisResults.FindingsResults.Rules,
+		Purl:       analysisResults.Purl,
 		Repository: analysisResults.SourceGitRepo,
-		Ref:        analysisResults.SourceGitRef,
+		ScmType:    analysisResults.SourceScmType,
+		GitRef:     analysisResults.SourceGitRef,
 		CommitSha:  analysisResults.SourceGitCommitSha,
 		LastCommit: analysisResults.LastCommitedAt,
 	}
@@ -398,8 +404,10 @@ func handleAnalyzeLocal(ctx context.Context, request mcp.CallToolRequest, opaCli
 	combinedResponse := mcpAnalysisResponse{
 		Findings:   analysisResults.FindingsResults.Findings,
 		Rules:      analysisResults.FindingsResults.Rules,
+		Purl:       analysisResults.Purl,
 		Repository: analysisResults.SourceGitRepo,
-		Ref:        analysisResults.SourceGitRef,
+		ScmType:    analysisResults.SourceScmType,
+		GitRef:     analysisResults.SourceGitRef,
 		CommitSha:  analysisResults.SourceGitCommitSha,
 		LastCommit: analysisResults.LastCommitedAt,
 	}
@@ -450,8 +458,10 @@ func handleAnalyzeStaleBranches(ctx context.Context, request mcp.CallToolRequest
 	combinedResponse := mcpAnalysisResponse{
 		Findings:   analysisResults.FindingsResults.Findings,
 		Rules:      analysisResults.FindingsResults.Rules,
+		Purl:       analysisResults.Purl,
 		Repository: analysisResults.SourceGitRepo,
-		Ref:        analysisResults.SourceGitRef,
+		ScmType:    analysisResults.SourceScmType,
+		GitRef:     analysisResults.SourceGitRef,
 		CommitSha:  analysisResults.SourceGitCommitSha,
 		LastCommit: analysisResults.LastCommitedAt,
 	}