MindFort

Security Findings Browsing, Filtering, and Programmatic Retrieval

Enables searching, prioritizing, browsing, and triaging security findings across the organization, across all targets, or scoped by target UUID or assessment run UUID via the dashboard and programmatic interfaces (REST API GET /v1/findings, GET /v1/findings/{id}, get_finding, and MCP list_findings). Links each finding to an assessment ID, target ID, and target name for contextual traceability. Supports dashboard tabs (Open, Resolved, Archived) and API filters for lifecycle status (ACTIVE, RESOLVED, ARCHIVED), vulnerability status (vulnerable, secured, all), effective severity levels (critical, high, medium, low, secured, and legacy 'info'), finding type (restricting public API availability to red-team types), secured probe exclusion (exclude_secured), and ownership assignment (assigned to current user, specific user ID, or unassigned). Enforces positive field allowlists to restrict public API response payloads to explicitly allowed data fields. Provides full-text search across finding ID, title, description, endpoint, or impact (up to 500 characters), sorting by severity or creation date (created_at) ascending/descending, and cursor-based (limit 1-100, opaque next cursor) and offset-based pagination.

Detailed Finding Artifacts, Metadata, and Threat Modeling

Provides comprehensive finding details, metadata, artifacts, and AI-generated summaries, including finding descriptions, testing approaches, impact summaries, exploitability assessments, and finding-specific threat models explaining exploit mechanics and operational impact. Uses team-provided context to score vulnerabilities accurately for effective triage, delivering reproducible evidence, proof-of-concept details, attack flow graphs, remediation guidance, validation/retest actions, numeric severity scores, and CVSS v3.1 base scoring reflecting business context and blast radius. Includes categorizations with vulnerability tags and assigned OWASP categories, associated target metadata, and affected host, file path, component, package, or endpoint.

Finding Severity Override

Enables assigning and manually overriding a finding's severity level to critical, high, medium, low, or secured (supporting the deprecated 'info' value) via PATCH /v1/findings/{id}/severity or update_finding_severity when the finding-severity-overrides feature is enabled, recording the overridden severity separately from the original severity, and clearing overrides by setting severity to null.

Vulnerability Finding Lifecycle, Comments, and Bulk Management

Automates the triage, prioritization, deduplication, and tracking of vulnerability findings, providing UI and API capabilities to manage individual findings or perform bulk operations for up to 50 findings at once. Enables assigning/unassigning team member ownership for remediation tracking, updating lifecycle statuses (ACTIVE, RESOLVED, ARCHIVED with optional FIX or WONT_FIX reasons, resolve context, and up to 2000 characters of context), archiving/unarchiving, deleting, requesting patch pull requests, initiating retests, creating linked Jira/Linear issues, and querying posture analytics. Manages finding discussions and collaboration via REST endpoints and list_finding_comments to list, paginate, add (POST), edit (PATCH), and delete (DELETE) text comments displaying comment content, timestamps, and commenter profile details including username and profile picture URL.

Automated Asynchronous Finding Retesting and Capacity Management

Initiates, tracks, and monitors asynchronous retests for individual or bulk open red-team findings via the bulk action bar, POST /v1/findings/{id}/retest, or retest_finding (consuming one credit per retest with advance cost previews), re-running original exploits against live targets using authenticated sessions and saved credentials without re-entering secrets. Supports execution monitoring across queued (QUEUED), running/in progress (tracking boolean in-progress flags), confirmed fixed (transitioning to RESOLVED), still exploitable (transitioning to ACTIVE), failed (recording retest_failure_reason), couldn't complete, and timed-out states with start and completion timestamps. Executes task-based follow-up investigations, enforces single-retest concurrency with 409 errors, and queues/limits organization-wide retest capacity with HTTP 429 responses when thresholds are reached.