Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/tools/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import { registerIssueTools } from "./issues.js";
import { registerMetadataTools } from "./metadata.js";
import { registerModuleIssueTools } from "./module-issues.js";
import { registerModuleTools } from "./modules.js";
import { registerProjectIssueTools } from "./project-issues.js";
import { registerProjectTools } from "./projects.js";
import { registerUserTools } from "./user.js";
import { registerWorkLogTools } from "./work-log.js";
Expand All @@ -15,6 +16,7 @@ export const registerTools = (server: McpServer) => {
registerUserTools(server);

registerProjectTools(server);
registerProjectIssueTools(server);
registerModuleTools(server);
registerModuleIssueTools(server);
registerIssueTools(server);
Expand Down
28 changes: 28 additions & 0 deletions src/tools/project-issues.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { z } from "zod";

import { makePlaneRequest } from "../common/request-helper.js";

export const registerProjectIssueTools = (server: McpServer): void => {
server.tool(
"list_project_issues",
"Get all issues for a specific project",
{
project_id: z.string().describe("The uuid identifier of the project to get issues for"),

@coderabbitai coderabbitai Bot Sep 13, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Tighten input validation to enforce UUIDs.
Prevents malformed IDs and path injection via slashes.

Apply this diff:

-      project_id: z.string().describe("The uuid identifier of the project to get issues for"),
+      project_id: z.string().uuid().describe("The UUID of the project to get issues for"),
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
project_id: z.string().describe("The uuid identifier of the project to get issues for"),
project_id: z.string().uuid().describe("The UUID of the project to get issues for"),
🤖 Prompt for AI Agents
In src/tools/project-issues.ts around line 11, the project_id schema uses
z.string() which allows malformed IDs and path-injection characters; replace it
with z.string().uuid().describe("The uuid identifier of the project to get
issues for") to validate proper UUID format (this also prevents slashes), and
update any affected callers/tests to supply valid UUIDs.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sushitommy please resolve this commit

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

},
async ({ project_id }) => {
const response = await makePlaneRequest(
"GET",
`workspaces/${process.env.PLANE_WORKSPACE_SLUG}/projects/${project_id}/issues/`
);
Comment thread
Prashant-Surya marked this conversation as resolved.
return {
content: [
{
type: "text",
text: JSON.stringify(response, null, 2),
},
],
};
}
);
};