Reporting security posture

Security Report

What this skill uses

Harness MCP tools: harness:harness_create, harness:harness_describe, harness:harness_execute, harness:harness_get, harness:harness_list Resource types: artifact_security, code_repo_security, pipeline_security_issue, scs_artifact_component, scs_bom_violation, scs_component_remediation, scs_component_search, scs_component_vulnerability, scs_oss_risk_summary, scs_project_security_overview, scs_remediation_pr, scs_sbom_drift (+2 more) References: references/scs-drill-in-workflow.md

See also: references/scs-drill-in-workflow.md - SCS drill-in workflow (project overview -> remediation PR, with the full path).

Generate security and supply chain reports using Harness STO and SCS via MCP. The SCS surface has expanded substantially - start broad with scs_project_security_overview and drill into the specific dimension you need.

Recommended starting point

Call MCP tool: harness:harness_get
Parameters:
 resource_type: "scs_project_security_overview"
 org_id: "<org>"
 project_id: "<project>"

This returns one consolidated view (vulns, compliance, enforcement, SBOM coverage, deployment summary). From here, drill into the specific area you need.

Instructions

Step 1: STO - pipeline-driven vulnerabilities

Resource type	Use it for
security_issue	Account/project-level issue catalog (filter by severity, status, scanner)
security_issue_filter	Available filter values for the issue catalog
pipeline_security_issue	Issues attributed to a specific pipeline execution
pipeline_security_step	Scan steps that ran in an execution
security_exemption	Waivers / exceptions / exempts (list/create/approve/reject)

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "security_issue"
 org_id: "<org>"
 project_id: "<project>"
 filters:
 severity: "CRITICAL" # or HIGH | MEDIUM | LOW
 status: "OPEN"

For pipeline-attributed issues:

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "pipeline_security_issue"
 url: "https://app.harness.io/.../pipelines/<id>/executions/<exec-id>"

Step 2: SCS - artifacts, SBOMs, components

Resource type	Use it for
scs_artifact_source	Artifact registries / sources tracked by SCS
artifact_security	Per-artifact security posture (vulns, SBOM, attestations)
scs_artifact_component	Components inside an artifact (direct + transitive deps)
scs_component_search	Cross-artifact: which artifacts use a given component?
scs_component_dependencies	Dependency tree (depends-on chain) for one component
scs_sbom	SBOM downloads (CycloneDX/SPDX)
scs_sbom_drift	SBOM diff calculation between two artifact versions
scs_component_drift	Component-level diff details (added/removed/modified)
scs_chain_of_custody	Provenance, attestations, signing, SLSA evidence

Drill from artifact to component:

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "artifact_security"
 org_id: "<org>"
 project_id: "<project>"

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "scs_artifact_component"
 params:
 artifact_id: "<artifact-id>"

Find every artifact using a vulnerable component:

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "scs_component_search"
 filters:
 name: "log4j-core"
 version: "2.14.1"

SBOM diff between versions:

Call MCP tool: harness:harness_execute
Parameters:
 resource_type: "scs_sbom_drift"
 action: "calculate"
 body:
 base_artifact_id: "<v1>"
 head_artifact_id: "<v2>"

Step 3: SCS - vulnerabilities, OSS risk, code repo posture

Resource type	Use it for
scs_component_vulnerability	CVE / CVSS detail for a specific component
scs_component_enrichment	OSS risk: EOL, maintenance status, version risk
scs_oss_risk_summary	Project-wide OSS risk roll-up
code_repo_security	Source repository posture and findings

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "scs_component_vulnerability"
 params:
 artifact_id: "<artifact-id>"
 component_id: "<component-id>"

Project OSS risk overview:

Call MCP tool: harness:harness_get
Parameters:
 resource_type: "scs_oss_risk_summary"
 org_id: "<org>"
 project_id: "<project>"

Repo-level findings:

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "code_repo_security"
 org_id: "<org>"
 project_id: "<project>"

Step 4: SCS - BOM enforcement and policy compliance

Resource type	Use it for
scs_compliance_result	CIS/OWASP/policy compliance check results
scs_bom_violation	BOM enforcement violations (deny-list, allow-list, policy hits)
policy / policy_set	OPA policies and sets governing supply chain rules

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "scs_bom_violation"
 org_id: "<org>"
 project_id: "<project>"

Step 5: SCS - remediation

Resource type	Use it for
scs_component_remediation	Safe upgrade suggestion for a vulnerable component (preferred)
scs_artifact_remediation	Legacy roll-up; prefer scs_component_remediation
scs_remediation_pr	Generate or list remediation pull requests
scs_auto_pr_config	Auto-PR configuration (read/update)

Get a safe-upgrade suggestion:

Call MCP tool: harness:harness_get
Parameters:
 resource_type: "scs_component_remediation"
 params:
 artifact_id: "<artifact>"
 component_id: "<component>"

Open a remediation PR. The body takes a single component identified by its purl (package URL), plus the safe target version. artifact_id lives in params, not the body. To upgrade multiple components, loop one call per purl.

Call MCP tool: harness:harness_create
Parameters:
  resource_type: "scs_remediation_pr"
  params:
    artifact_id: "<artifact>"
  body:
    purl: "pkg:maven/org.apache.logging.log4j/[email protected]"
    target_version: "2.24.1"

Step 6: STO - exemptions

Call MCP tool: harness:harness_list
Parameters:
 resource_type: "security_exemption"
 org_id: "<org>"
 project_id: "<project>"

Create an exemption. Required body fields: issue_id, type, reason. expiration is a Unix epoch timestamp (number), not a date string.

Call MCP tool: harness:harness_create
Parameters:
  resource_type: "security_exemption"
  body:
    issue_id: "<id>"
    type: "False Positive"
    reason: "Not exploitable in our config; library is loaded in test paths only."
    expiration: 1798761600

Approve / reject. The scope field on the body is required for approve (and any reject that promotes the decision beyond CURRENT). Values: CURRENT, ORG, ACCOUNT, PROJECT.

Call MCP tool: harness:harness_execute
Parameters:
  resource_type: "security_exemption"
  action: "approve"   # or "reject"
  resource_id: "<exemption_id>"
  body:
    scope: "CURRENT"

Recommended drill-in workflow

For any "where am I most exposed" question:

1. scs_project_security_overview - top-line numbers and worst areas
2. scs_oss_risk_summary - narrow to OSS health (EOL / unmaintained / outdated)
3. artifact_security - pick the worst artifacts
4. scs_artifact_component - which components are actually risky?
5. scs_component_vulnerability + scs_component_enrichment - CVE + EOL detail
6. scs_component_remediation - get the upgrade target
7. scs_remediation_pr - open the fix as a PR

Report Format

## Security Compliance Report

**Date:** <date>
**Scope:** <project/artifact>

### Posture Snapshot (scs_project_security_overview)
- Open critical CVEs: X
- BOM enforcement violations: X
- SBOM coverage: X%
- Compliance checks passing: X / Y
- Recently deployed artifacts at risk: X

### Vulnerability Summary
| Severity | Count | New | Fixed |
|----------|-------|-----|-------|
| Critical | X | X | X |
| High | X | X | X |
| Medium | X | X | X |
| Low | X | X | X |

### Top Critical CVEs
1. **CVE-XXXX-XXXXX** in `<package>:<version>` - <artifact> 
 - Remediation: upgrade to `<safe-version>` (per scs_component_remediation)
2. ...

### OSS Health (scs_oss_risk_summary)
- EOL packages: X
- Unmaintained packages: X
- Outdated by 2+ majors: X

### BOM Enforcement
- Deny-list violations: X
- Allow-list misses: X
- Policy hits: X

### Drift (scs_sbom_drift)
- New components in last release: X
- Removed components: X

### Active Exemptions
- X active, Y pending review

### Remediation
- PRs open: X
- Auto-PRs scheduled: Y

### Recommendations
1. <prioritized fix action>
2. <next>

Examples

• "Where am I most exposed?" → scs_project_security_overview then drill via the workflow above
• "Critical CVEs across the org" → harness:harness_list security_issue filtered to severity=CRITICAL, status=OPEN
• "Anyone using log4j 2.14.1?" → scs_component_search with name + version filters
• "Diff our v1.2 vs v1.3 SBOM" → scs_sbom_drift calculate
• "Show OSS health for the platform project" → scs_oss_risk_summary
• "Open a fix PR for log4j" → scs_component_remediation to find target version, then scs_remediation_pr to create
• "Are we passing CIS benchmarks?" → scs_compliance_result
• "Show BOM violations" → scs_bom_violation
• "Create an exemption for CVE-2024-1234" → security_exemption create + execute approve

Related skills

Composes with (skills commonly invoked together):

• /briefing-ciso
• /reviewing-security-posture

Follow-ups (skills commonly chained after this one):

• /managing-pull-requests
• /creating-policies

Performance Notes

• scs_project_security_overview is the cheapest entry point - always start there before listing every resource type.
• Drift calculation (scs_sbom_drift) operates on full SBOMs; pass exact artifact IDs.
• Cross-artifact search (scs_component_search) is the right tool for "blast radius" questions; do not list every SBOM and filter client-side.
• harness:harness_describe(toolset='scs') is the live source of truth for available SCS resource types and their operations.

Troubleshooting

• No vulnerabilities shown - confirm STO scan steps are configured and ran in a recent execution. Use pipeline_security_step to verify.
• SBOM missing - confirm SBOM generation is enabled in the pipeline and artifact registry tracking is on. Check scs_artifact_source for the registry.
• scs_artifact_remediation is legacy - prefer scs_component_remediation (component-level, more accurate). The legacy resource still works but the recommendation tree is being consolidated.
• BOM enforcement failing unexpectedly - inspect policy_set and individual policy definitions; create-policy can scaffold new ones.
• Not sure which type to use - harness:harness_describe(search_term='<keyword>') matches across name, description, and aliases.