AIML-226: Fix tool names exceeding Claude API 64-char limit

[ChrisEdwards]

DO NOT MERGE - PR IN PROGRESS - WAITING FOR AIML-189 PR

Summary

This PR shortens two MCP tool names that exceed Claude API's 64-character limit, fixes parameter inconsistency, and adds version logging to server startup.

Changes

1. Tool Renames (mcp-439):

• list_vulnerabilities_by_application_and_session_metadata (71 chars)
  → list_vulns_by_app_and_metadata (47 chars with mcp__contrast__ prefix)
• list_vulnerabilities_by_application_and_latest_session (69 chars)
  → list_vulns_by_app_latest_session (46 chars with mcp__contrast__ prefix)

2. Parameter Consistency Fix (mcp-6bs):

• Updated both renamed tools to accept appID parameter instead of app_name
• Renamed methods to remove "ByName" suffix:
  • listVulnsInAppByNameAndSessionMetadata → listVulnsByAppIdAndSessionMetadata
  • listVulnsInAppByNameForLatestSession → listVulnsByAppIdForLatestSession
• Removed SDKHelper.getApplicationByName() lookups for better performance
• Updated @tool descriptions to mention using list_applications_with_name first
• Makes tools consistent with AIML-189 standardization (all app tools use appID)

3. Version Logging on Startup:

• Added Spring Boot BuildProperties to log application version on startup
• Updated pom.xml to generate build-info.properties
• Logs version automatically when server starts for production debugging

Files Modified:

• src/main/java/com/contrast/labs/ai/mcp/contrast/AssessService.java
  • Updated @tool annotations and method signatures (lines 203-269)
• src/test/java/com/contrast/labs/ai/mcp/contrast/AssessServiceIntegrationTest.java
  • Updated test to use appID parameter
• pom.xml
  • Added build-info goal to spring-boot-maven-plugin
• src/main/java/com/contrast/labs/ai/mcp/contrast/McpContrastApplication.java
  • Added ApplicationRunner bean for version logging

Testing

• ✅ Unit tests pass: mvn test (all tests passing)
• ✅ Integration tests updated to use appID
• ✅ Integration tests: Pending mvn verify

Context

This is a tactical fix to meet the 64-char Claude API requirement. Future work to consolidate these tools into a single unified tool is tracked in bead mcp-dno.

Research findings (documented in mcp-dno):

• SDK supports TraceFilterBody.metadataFilters for server-side filtering
• TeamServer API requires numeric field IDs (not field names)
• Current implementation filters by displayLabel in-memory
• Consolidation requires field name → ID lookup mechanism

Manual Testing

✅ Manual JAR Build and Testing Passed

Built and tested the JAR locally:

mvn clean package

Results:

• Build: Successful (exit code 0)
• JAR created: target/mcp-contrast-0.0.16-SNAPSHOT.jar (27MB)
• Build time: ~2.5 minutes
• All tests passed: 220 tests run, 0 failures, 0 errors
• Integration tests: Successfully connected to live Contrast Security API

The JAR was manually tested in Copilot in VSCode and confirmed the MCP server worked properly for the two modified tools.

Dependencies

This PR depends on:

• ⚠️ PR AIML-189: Remove duplicate app_name/app_id tool variants to optimize AI context usage #26 (AIML-189) must be merged first
• Currently based on branch: AIML-189-remove-duplicate-tools
• Will need to be rebased onto main after AIML-189 merges

Related

• Bead: mcp-439 (tool rename)
• Bead: mcp-6bs (parameter consistency fix)
• Jira: AIML-226
• Depends on: mcp-15 (AIML-189)
• Future consolidation: mcp-dno

Acceptance Criteria

• Both tool names shortened to <= 64 chars (including mcp__contrast__ prefix)
• Tools use appID parameter consistently with AIML-189
• All references updated in code and tests
• Unit tests pass (mvn test)
• Version logging implemented on startup
• Integration tests pass (mvn verify)
• Manual testing with MCP server

Commits

• dc55776 - Rename tools to meet 64-char limit (mcp-439)
• 6cb9a12 - Add validation test for empty string sessionMetadataValue (MCP-3EG)
• 3fb6af3 - Fix mcp-6bs: Change list_vulns_by_app tools to use appID parameter
• 63b786a - Add version logging on server startup

[Copilot]

Pull Request Overview

This PR addresses Claude API's 64-character tool name limit by shortening two MCP tool names, standardizes parameter usage from app_name to appID for consistency with other tools, and adds version logging on server startup for better production debugging.

Key Changes:

• Shortened tool names to comply with 64-character limit (including mcp__contrast__ prefix)
• Standardized both tools to use appID parameter instead of app_name, removing app name lookup calls
• Added version logging on application startup using Spring Boot BuildProperties

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
AssessService.java	Renamed two tool methods, updated parameter from app_name to appID, removed app lookup logic
AssessServiceIntegrationTest.java	Updated integration test to use appID parameter instead of app_name
McpContrastApplication.java	Added ApplicationRunner bean to log application version on startup
pom.xml	Added build-info goal to spring-boot-maven-plugin to generate build properties

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seschis]

this doesn't need a more complete description?

[ChrisEdwards]

Looks like it does. I just consolidated methods, so this must be how this already was. All the tool descriptions and tool names are getting a full makeover. I am getting down to the the tools I want to keep before I invest in that. So yes, this will get a full description,.

[seschis]

not a huge fan of tests that require hitting production infrastructure... there is probably a better way.

Also, this test can silently stop running if the env doesn't have CONTRAST_HOST_NAME defined, and no one would know that it could have been broken.

[ChrisEdwards]

This is a temporary scenario. I created the tests before making changes to get some form of end-to-end validation in place to ensure I didn't break existing functionality. I made sure the tests passed before making changes, then made the changes. The tests are temporary until we can address these tests properly. Since I am the only person maintaining this right now, I am making sure I run them myself before any push. They don't run in the CI to ensure they don't break releases. I understand the risks and we will remove them once these large changes are done.

[seschis]

left a lot of nit pick comments on things. Nothing major, just stuff to make the code read better or be less cognitive load.