Fortify Software Security Center (SSC) Skill

Fortify Software Security Center (SSC) integration via Model Context Protocol (MCP).

When to Use This Skill

• List application and application version
• List security issues/vulnerabilities with filtering by severity, category, etc.
• Count issues grouped by severity, category, etc.

Available MCP Tools

Only key MCP tools for SSC are listed here.

Tool	Description	When to Use
fcli_ssc_session_list	List authentication sessions	Check authentication status
fcli_ssc_app_list	List applications	Discover available applications
fcli_ssc_app_get	Get details of a specific application	Retrieve detailed information about an application
fcli_ssc_appversion_list	List application versions	Discover available application versions
fcli_ssc_appversion_get	Get details of a specific application version	Retrieve detailed information about an application version
fcli_ssc_issue_list	List issues	Retrieve a list of security issues/vulnerabilities
fcli_ssc_issue_list_filters	Discover available filtering options for issues	Look for most appropriate filter to use
fcli_ssc_issue_list_groups	Discover available grouping options for issues	Look for most appropriate group to use
fcli_ssc_issue_count	Group and count issues	Count issues grouped by severity, category, etc. Always include --by parameter
fcli_ssc_mcp_job	Wait for background jobs to complete	When pagination.jobToken is present in responses

Parameter Formats

Common formats and examples for key parameters:

Parameter	Format	Example
appVersionNameOrId or --appversion	"<App>:<Version>" - case-sensitive, colon-separated	"MyApp:MyRelease"
--filter	"<FilterType>:<Value>" - preferred server-side filtering; discover via issue_list_filters first	"Folder:Critical"
--filterset	Filter set title or ID - predefined SSC filter combinations (e.g., "Security Auditor View", "Quick View"); distinct from --filter	"Security Auditor View"
--embed	Comma-separated values to include additional data (see reference files for specific options)	"details,auditHistory"
--by	Group name from issue_list_groups - always include when using issue_count	"Folder", "Category"

Authentication

All operations require authentication. Always verify session before any operation:

fcli_ssc_session_list with refresh-cache=true

• If Expired = No → proceed
• If expired → ask user to run locally: fcli ssc session login --url "<URL>" -u "<user>" -p '<pass>'
• When running any SSC tool, if authentication error occurs, prompt user to re-authenticate locally.

Note: Reference workflows assume authentication has been verified.

Filtering: Prefer --filter; query Optional

• Prefer --filter for server-side filtering (fastest, smallest payloads)
• Optionally use query as a client-side post-filter when you need a simple match on returned fields
• Always discover available filters with issue_list_filters before applying them

Pagination

• If pagination.hasMore = true → use pagination-offset for next page
• If pagination.jobToken present → background loading; wait with fcli_ssc_mcp_job (see Background Job Handling)
• Once pagination.totalRecords appears → all records collected

Error Recovery

Error	Recovery
"Session expired"	Refer to flow in Authentication section
"Application version not found"	Run app_list to discover correct names
"Unknown filter"	Run issue_list_filters to discover valid filters

Decision Tree: Choosing the Right Approach

User Intent	Action
"list/show vulnerabilities"	issue_list with --filter + --embed details
"how many / count / summary"	issue_count with --by
"find app / which version"	app_list → appversion_list

Best Practices

DO:

• ✅ Use --filter for filtering
• ✅ Prioritize server-side filtering over client-side
• ✅ Prioritize use MCP tool over FCLI CLI directly

Do NOT:

• ❌ Guess application/version names - ask the user
• ❌ Prompt user for credentials - ask user to run fcli ssc session login locally
• ❌ Assume filter names exist - always run issue_list_filters first
• ❌ Make multiple API calls for details - use --embed parameter instead

References

Example Workflows

Workflow	Use When User Says...
List and find Applications Versions	"list applications", "show application versions", "what applications are available"
List, Filter and Query Issues	"list vulnerabilities", "show security issues", "filter issues by severity", "include suppressed issues"
Summarise and Count Issues	"count issues", "show summary", "breakdown by severity"
Provide Recommendations	"show recommendations", "provide remediation advice", "how to fix"
Background Job Handling	When pagination.jobToken appears in responses, background data loading

External Resources

• FCLI Documentation
• SSC Documentation (version format: YY.Quarter.patch, e.g., 25.4.0)
• SSC User Guide