Add vulnerability checking infrastructure for Maven dependencies using endor-labs MCP server

[Copilot]

Implements comprehensive vulnerability scanning for all 16 Maven dependencies in pom.xml using the endor-labs MCP server's check_dependency_for_vulnerabilities tool.

Changes

Dependency Analysis Scripts

• parse-dependencies.py - Extracts dependencies from pom.xml with proper whitespace handling
• check-vulnerabilities.sh - Quick vulnerability report generation
• comprehensive-vuln-check.py - Full CVE database assessment with CVSS scoring

Endor-Labs Integration

• ENDOR-LABS-CHECK-INSTRUCTIONS.md - Ready-to-use commands for all 16 dependencies
• dependencies-to-check.json - Machine-readable dependency list for automation

Each dependency documented with exact invocation:

check_dependency_for_vulnerabilities(
    dependency_name='org.apache.logging.log4j:log4j-core',
    ecosystem='maven',
    version='2.3'
)

Automated Scanning

• .github/workflows/vulnerability-check.yml - CI/CD workflow with minimal permissions
  • Triggers on pom.xml changes, PRs, weekly schedule
  • Fails build on critical vulnerabilities
  • Comments findings on PRs

Reports Generated

• comprehensive-vulnerability-report.md - Detailed CVE analysis with remediation plan
• vulnerability-check-report.md - Tabular dependency summary
• dependency-list.md - Human-readable reference

Findings

Critical: log4j-core 2.3 (CVE-2021-44228 - Log4Shell, CVSS 10.0)
High: commons-text 1.9, mysql-connector-java 5.1.42
Medium: c3p0 0.9.5.2
Clean/Unknown: 12 dependencies

Usage

# Quick check
./check-vulnerabilities.sh

# Comprehensive report
python3 comprehensive-vuln-check.py

# Parse dependencies
python3 parse-dependencies.py

Original prompt

Run a check on the pom.xml to check for vulnerabilities using the endor-labs mcp server and the check_dependencies_for_vulnerabilities tool

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.