findings

/zeropath:findings

Read-path entrypoint. Inline, no subagent - this is just an MCP call and a render.

What you do

1. Get the repo binding once. One bash call:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/current-binding.mjs"
   

   Branch on the result:

   • ok: true → use repositoryIds: ["<repositoryId>"] and organizationId: "<orgId>" in the MCP call. Mention the repo in your reply ("Open findings in <orgName>/<repoUrl>:").
   • ok: false, reason: "resolve_failed" → ask in plain chat whether to add the repo to ZeroPath via repositories.addByUrl or list org-wide for now. Don't auto-add.
   • Any other failure → fall back to org-wide and tell the user one line ("Can't auto-detect a ZeroPath repo for this directory; listing org-wide.").

   Don't probe creds, the CLI, or config in chat - the auto-bootstrap handles all that.

2. Call issues.list with sensible defaults:

   {
     "offset": 0,
     "limit": 25,
     "statuses": ["PENDING_REVIEW"],
     "sortBy": "score",
     "sortOrder": "desc"
   }
   

   Layer on scoreLevels, vulnerabilityClasses, repositoryBranches, searchQuery based on the user's filter.

3. Render compactly. One row per finding: id | severity | vuln class | repo | file:line | title. Cap output to ~20 rows; surface counts.total and offer to page.

4. Recognize adjacent intents and route to other MCP tools. Same underlying server exposes more than issues.list. Reach for these when the user's intent points at them:

   • "Any dependency vulns?" / "What about lodash?" → sca.list.
   • "Any CVEs for X?" → vulnerabilities.search.
   • "What endpoints do we expose?" → endpoints.search with the bound repositoryId.
   • "How are we doing?" / "Give me a summary" → stats.summary (+ stats.assets).
   • "Has this pattern been used elsewhere?" → code.search with the bound organizationId.

5. Hand off explicit follow-ups. Map specific intents to the right slash command:

   • "Explain this one" → /zeropath:explain <id>
   • "Investigate this deeper" → /zeropath:investigate <id>
   • "Fix this" → /zeropath:fix <id>
   • "Triage these" → /zeropath:triage

6. Never invent fields. If issues.list doesn't return something in its response shape, omit it from the table.