vulnerability

The vulnerability domain has 16 actions. On the meta surface they are all reached through arcane_vulnerability; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
vulnerability.export	Export environment vulnerabilities	read
vulnerability.ignore	Ignore a vulnerability	write
vulnerability.ignore_bulk	Ignore vulnerabilities in bulk	write
vulnerability.ignored	List ignored vulnerabilities	read
vulnerability.image_list	List image vulnerabilities	read
vulnerability.image_options	List vulnerability image options	read
vulnerability.image_scan	Scan image for vulnerabilities	write
vulnerability.image_scan_result	Get vulnerability scan result	read
vulnerability.image_summaries	Get vulnerability scan summaries	read
vulnerability.image_summary	Get vulnerability scan summary	read
vulnerability.list	List environment vulnerabilities	read
vulnerability.overview	Get environment vulnerability risk overview	read
vulnerability.scanner_status	Get vulnerability scanner status	read
vulnerability.summary	Get environment vulnerability summary	read
vulnerability.unignore	Unignore a vulnerability	destructive
vulnerability.unignore_bulk	Restore ignored vulnerabilities in bulk	write

Actions

vulnerability.export

Export environment vulnerabilities

Downloads every vulnerability matching the given filters as a CSV file

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "export"
• Individual tool: arcane_vulnerability_export
• Arcane route: GET /api/environments/{id}/vulnerabilities/export
• Operation ID: export-environment-vulnerabilities
• Since: Arcane v2.12.0
• Usage: Returns every matching finding at once as CSV text (content plus a .csv filename), with the same filters and sort as vulnerability.list but no paging. ignored=true exports the ignored findings instead of the active ones. A very large export is cut at arcane-mcp’s download limit (truncated=true in the result).
• Related actions: vulnerability.list, vulnerability.image_options

vulnerability.ignore

Ignore a vulnerability

Creates an ignore record for a specific vulnerability

• Kind: write
• Required parameters: imageId, pkgName, vulnerabilityId
• Meta tool: arcane_vulnerability with "action": "ignore"
• Individual tool: arcane_vulnerability_ignore
• Arcane route: POST /api/environments/{id}/vulnerabilities/ignore
• Operation ID: ignore-vulnerability
• Usage: Hides one finding of one image from the active views and the risk score. Copy imageId, vulnerabilityId, pkgName and installedVersion from a finding of vulnerability.image_scan_result or vulnerability.list: the four together must match the finding exactly, so omit installedVersion only when the finding has none. Arcane does not check that the finding exists, so a mistyped record is still created and hides nothing. reason is optional, and createdBy is set by Arcane from the caller. 409 if already ignored. The returned id is the ignoreId for vulnerability.unignore. Needs vulnerabilities:manage.
• Related actions: vulnerability.image_scan_result, vulnerability.list, vulnerability.ignored, vulnerability.unignore, vulnerability.ignore_bulk

vulnerability.ignore_bulk

Ignore vulnerabilities in bulk

Creates ignore records for every active vulnerability matching the given filters

• Kind: write
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "ignore_bulk"
• Individual tool: arcane_vulnerability_ignore_bulk
• Arcane route: POST /api/environments/{id}/vulnerabilities/ignore/bulk
• Operation ID: bulk-ignore-vulnerabilities
• Since: Arcane v2.14.0
• Usage: Ignores every active finding matching the filters (severity, imageName, fixAvailable, search: the same matching as vulnerability.list), without a reason. With no filter it ignores every active finding of the environment. Preview the set with vulnerability.list first. Returns affectedCount. Undo with vulnerability.unignore_bulk and the same filters, which also restores matching findings that were ignored before. Needs vulnerabilities:manage.
• Related actions: vulnerability.list, vulnerability.unignore_bulk, vulnerability.ignore, vulnerability.ignored

vulnerability.ignored

List ignored vulnerabilities

Retrieves a list of all ignored vulnerabilities for the environment

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "ignored"
• Individual tool: arcane_vulnerability_ignored
• Arcane route: GET /api/environments/{id}/vulnerabilities/ignored
• Operation ID: list-ignored-vulnerabilities
• Usage: Lists the environment’s ignore records (id, imageId, vulnerabilityId, pkgName, installedVersion, reason, createdBy, createdAt), newest first by default. id is the ignoreId for vulnerability.unignore. search matches vulnerabilityId, pkgName, installedVersion, imageId or reason. sort accepts createdAt or vulnerabilityId with order asc or desc (a - prefix also sorts descending, and any other sort field falls back to newest first), and start and limit page. vulnerability.list with ignored=true lists the ignored findings themselves.
• Related actions: vulnerability.unignore, vulnerability.unignore_bulk, vulnerability.list

vulnerability.image_list

List image vulnerabilities

Retrieves paginated vulnerabilities for an image

• Kind: read
• Required parameters: imageId
• Meta tool: arcane_vulnerability with "action": "image_list"
• Individual tool: arcane_vulnerability_image_list
• Arcane route: GET /api/environments/{id}/images/{imageId}/vulnerabilities/list
• Operation ID: list-image-vulnerabilities
• Usage: Pages through one scanned image’s findings with search (CVE ID, package, versions, title), severity (e.g. CRITICAL), sort (vulnerabilityId, pkgName, severity, installedVersion, fixedVersion) with order asc/desc, and start/limit (limit defaults to 20). Unlike vulnerability.image_scan_result it does not hide ignored findings. 404 when the image has no scan. Use vulnerability.list to search across all images.
• Related actions: vulnerability.image_scan_result, vulnerability.list, vulnerability.ignore

vulnerability.image_options

List vulnerability image options

Retrieves available image filter options for environment vulnerabilities

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "image_options"
• Individual tool: arcane_vulnerability_image_options
• Arcane route: GET /api/environments/{id}/vulnerabilities/image-options
• Operation ID: list-environment-vulnerability-image-options
• Usage: Lists the image names (or image IDs for unnamed images) that have at least one finding in a completed scan, the valid values for the imageName filter of vulnerability.list, vulnerability.export and the bulk ignore actions. severity (comma-separated) narrows it to images with findings of those severities.
• Related actions: vulnerability.list, vulnerability.export, vulnerability.ignore_bulk

vulnerability.image_scan

Scan image for vulnerabilities

Initiates a vulnerability scan for the specified image using Trivy

• Kind: write
• Required parameters: imageId
• Meta tool: arcane_vulnerability with "action": "image_scan"
• Individual tool: arcane_vulnerability_image_scan
• Arcane route: POST /api/environments/{id}/images/{imageId}/vulnerabilities/scan
• Operation ID: scan-image-vulnerabilities
• Usage: Starts a Trivy scan in the background and returns at once with status pending or scanning and an activityId. Poll vulnerability.image_scan_result until status is completed or failed. Pass the image’s sha256 ID (id from image.get or image.list): the scan is stored under the exact string given, and the environment-wide views (vulnerability.list, vulnerability.summary, vulnerability.overview) only match scans stored under the image ID. Needs the vulnerabilities:scan permission.
• Related actions: image.get, vulnerability.image_scan_result, vulnerability.scanner_status, activity.get

vulnerability.image_scan_result

Get vulnerability scan result

Retrieves the most recent vulnerability scan result for an image

• Kind: read
• Required parameters: imageId
• Meta tool: arcane_vulnerability with "action": "image_scan_result"
• Individual tool: arcane_vulnerability_image_scan_result
• Arcane route: GET /api/environments/{id}/images/{imageId}/vulnerabilities
• Operation ID: get-image-vulnerabilities
• Usage: Use to poll a scan started by vulnerability.image_scan (status pending, scanning, completed or failed, with error on failure) and to read one image’s full findings plus risk insights. imageId is the same string the scan was started with. Ignored findings are left out of vulnerabilities, and 404 means the image was never scanned. Each finding’s vulnerabilityId, pkgName and installedVersion are the inputs of vulnerability.ignore.
• Related actions: vulnerability.image_scan, vulnerability.image_list, vulnerability.image_summary, vulnerability.ignore

vulnerability.image_summaries

Get vulnerability scan summaries

Retrieves scan summaries for a list of images (batch)

• Kind: read
• Required parameters: imageIds
• Meta tool: arcane_vulnerability with "action": "image_summaries"
• Individual tool: arcane_vulnerability_image_summaries
• Arcane route: POST /api/environments/{id}/images/vulnerabilities/summaries
• Operation ID: get-image-vulnerability-summaries
• Usage: Batch form of vulnerability.image_summary: pass imageIds (image IDs from image.list) and get summaries, a map keyed by image ID. Images never scanned are simply absent from the map.
• Related actions: image.list, vulnerability.image_summary, vulnerability.image_scan

vulnerability.image_summary

Get vulnerability scan summary

Retrieves just the summary of vulnerabilities for an image (for list views)

• Kind: read
• Required parameters: imageId
• Meta tool: arcane_vulnerability with "action": "image_summary"
• Individual tool: arcane_vulnerability_image_summary
• Arcane route: GET /api/environments/{id}/images/{imageId}/vulnerabilities/summary
• Operation ID: get-image-vulnerability-summary
• Usage: Use for just one image’s scan status and per-severity counts (summary.critical/high/medium/low/unknown/total) without the findings, with imageId as given to vulnerability.image_scan. The counts are those recorded at scan time, so they still include ignored findings. 404 when the image has no scan.
• Related actions: vulnerability.image_scan_result, vulnerability.image_summaries, vulnerability.image_scan

vulnerability.list

List environment vulnerabilities

Retrieves paginated vulnerabilities across all scanned images in the environment

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "list"
• Individual tool: arcane_vulnerability_list
• Arcane route: GET /api/environments/{id}/vulnerabilities/all
• Operation ID: list-environment-vulnerabilities
• Usage: Pages through the findings of every completed scan of images still present in the environment, each row with imageId and imageName. Filters: severity (comma-separated, e.g. CRITICAL,HIGH), imageName (case-insensitive substring, comma-separated alternatives, values from vulnerability.image_options), fixAvailable=true, search (CVE ID, package, versions, title, image name or ID). ignored=true lists ignored findings instead of active ones, each with its ignoreId for vulnerability.unignore. Sort by vulnerabilityId, pkgName, severity, installedVersion, fixedVersion or imageName. limit defaults to 20.
• Related actions: vulnerability.image_options, vulnerability.export, vulnerability.ignore, vulnerability.ignore_bulk, vulnerability.unignore

vulnerability.overview

Get environment vulnerability risk overview

Retrieves the environment risk score, trend, drivers, riskiest images and priority findings

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "overview"
• Individual tool: arcane_vulnerability_overview
• Arcane route: GET /api/environments/{id}/vulnerabilities/overview
• Operation ID: get-environment-vulnerability-overview
• Since: Arcane v2.14.0
• Usage: Use to decide what to fix first: riskScore and riskBand with a 7-day delta and trend, the drivers behind the score (findings, fixable, knownExploited, highEpss, imagesScanned…), exposure (findings counted by whether their image is used by running containers, only by stopped ones, or by none), riskiestImages, riskiestFindings and prevalentFindings. Ignored findings are not scored.
• Related actions: vulnerability.summary, vulnerability.list, vulnerability.image_scan_result, image.patch_targets

vulnerability.scanner_status

Get vulnerability scanner status

Check if the vulnerability scanner (Trivy) is available and get its version

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "scanner_status"
• Individual tool: arcane_vulnerability_scanner_status
• Arcane route: GET /api/environments/{id}/vulnerabilities/scanner-status
• Operation ID: get-vulnerability-scanner-status
• Usage: Check before a first scan: available is false (with an empty version) when Arcane cannot run Trivy. It may pull Arcane’s tools image and start a short-lived container to read the version. Every vulnerability action answers 403 when the vulnerability management feature (setting featureVulnerabilityManagementEnabled, on by default) is off.
• Related actions: vulnerability.image_scan, settings.get, settings.update

vulnerability.summary

Get environment vulnerability summary

Retrieves aggregated vulnerability counts across all images in the environment

• Kind: read
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "summary"
• Individual tool: arcane_vulnerability_summary
• Arcane route: GET /api/environments/{id}/vulnerabilities/summary
• Operation ID: get-environment-vulnerability-summary
• Usage: Quick environment totals: totalImages on the daemon, scannedImages with a completed scan, and summary with per-severity finding counts summed over those scans, ignored findings included. Use vulnerability.overview for the risk score and priorities, vulnerability.list for the findings themselves.
• Related actions: vulnerability.overview, vulnerability.list, vulnerability.image_summaries

vulnerability.unignore

Unignore a vulnerability

Removes an ignore record for a vulnerability

• Kind: destructive — requires confirm: true
• Required parameters: ignoreId
• Meta tool: arcane_vulnerability with "action": "unignore"
• Individual tool: arcane_vulnerability_unignore
• Arcane route: DELETE /api/environments/{id}/vulnerabilities/ignore/{ignoreId}
• Operation ID: unignore-vulnerability
• Usage: Deletes one ignore record so its finding is active again, together with any duplicate record for the same finding. ignoreId comes from vulnerability.ignored, from the id returned by vulnerability.ignore, or from ignoreId in vulnerability.list with ignored=true. 404 if the record does not exist. Needs vulnerabilities:manage.
• Related actions: vulnerability.ignored, vulnerability.list, vulnerability.unignore_bulk

vulnerability.unignore_bulk

Restore ignored vulnerabilities in bulk

Removes every ignore record matching the given filters

• Kind: write
• Required parameters: none
• Meta tool: arcane_vulnerability with "action": "unignore_bulk"
• Individual tool: arcane_vulnerability_unignore_bulk
• Arcane route: POST /api/environments/{id}/vulnerabilities/unignore/bulk
• Operation ID: bulk-unignore-vulnerabilities
• Since: Arcane v2.14.0
• Usage: Deletes every ignore record whose finding matches the filters (severity, imageName, fixAvailable, search: the same matching as vulnerability.list with ignored=true). With no filter it restores every ignored finding of a completed scan of an image still present, while records for removed or unscanned images stay (delete those with vulnerability.unignore). Returns affectedCount. Needs vulnerabilities:manage.
• Related actions: vulnerability.list, vulnerability.ignore_bulk, vulnerability.ignored, vulnerability.unignore