Fortify on Demand (FoD) Skill

Fortify on Demand (FoD) integration via Model Context Protocol (MCP).

When to Use This Skill

• List applications and releases
• Run security scans (SAST, SCA, DAST, MAST)
• List security issues/vulnerabilities with filtering by severity, category, etc.
• Count issues grouped by severity, category, etc.
• Manage scan configurations and monitor scan progress
• Generate and download security reports

Available MCP Tools

Only key MCP tools for FoD are listed here.

Parameter Formats

Common formats and examples for key parameters:

Authentication

All operations require authentication. Always verify session before any operation:

fcli_fod_session_list refresh-cache=true

• If Expired = No → proceed
• If expired → ask user to run locally: fcli fod session login --url <URL> --client-id <id> --client-secret <secret>
• When running any FoD tool, if authentication error occurs, prompt user to re-authenticate locally.

Note: Reference workflows assume authentication has been verified.

Domain-Specific Guidance

Scan Workflows: Always Check Settings First

Before starting any scan, follow this sequence:

1. Check existing scan configuration using *_scan_get_config command
2. If not configured → Always ask user for required settings (language, build tool, framework, etc.)
3. Never infer settings from workspace - build tools, language versions, and frameworks must be user-confirmed
4. Package source code (SAST/SCA only) using fcli_fod_action_package
5. Upload and start scan using appropriate *_scan_start command
6. Monitor progress using *_scan_wait_for or periodic *_scan_get calls

Packaging Requirements

• SAST scans: Package source code with fcli_fod_action_package
• SCA/OSS scans: Package source code with fcli_fod_action_package (same as SAST)
• DAST scans: No packaging needed - scans live running application
• MAST scans: Upload mobile app binary (APK/IPA file)
• Note: To enable Open Source Analysis in a SAST scan, use --oss flag in fcli_fod_sast_scan_setup

Filtering: Prefer --filters-param for Server-Side

• Prefer --filters-param for server-side filtering (fastest, smallest payloads)
• Optionally use query as a client-side post-filter when you need a simple match on returned fields
• Common filters: severityString:Critical, severityString:High, category:SQL Injection

Pagination

• If pagination.hasMore = true → use pagination-offset for next page
• Continue until pagination.hasMore = false or pagination.totalRecords reached

Error Recovery

Decision Tree: Choosing the Right Approach

Best Practices

DO:

• ✅ Always verify authentication before operations
• ✅ Check scan configuration before starting SAST scans
• ✅ Always ask user for SAST scan settings (language, build tool, framework)
• ✅ Use --oss flag in sast_scan_setup to enable Open Source Analysis in SAST scans
• ✅ Use --filters-param for server-side filtering
• ✅ Use --embed to include details, recommendations, and history
• ✅ Prioritize Fortify Aviator code fix suggestions in remediation
• ✅ Use MCP tools over FCLI CLI directly
• ✅ Monitor long-running scans with *_scan_wait_for

DO NOT:

• ❌ Guess release names - always discover with release_list if uncertain
• ❌ Infer SAST scan settings from workspace - always ask user
• ❌ Skip SAST scan configuration validation
• ❌ Prompt user for credentials - ask user to run fcli fod session login locally
• ❌ Start scans without confirming settings with user
• ❌ Package source code for DAST scans (not needed)

References

Example Workflows

External Resources

• FCLI Documentation
• FoD Documentation
• FoD User Guide