Cork MCP

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Record one or more "this query -> this resource" mappings so the next query that matches surfaces the right resources without re-running discovery. This command is designed to be backgrounded by an LLM right before it emits the user-facing response: silent on success, errors only to the CLI state directory's teach.log, safe to fire-and-forget. Disabling: pass --no-learn or set CORK_NO_LEARN=true.

Adds one row to entity_lookups. Used by the recall path's pattern engine to substitute values for canonical names at substitution time. Computed kinds (lowercase, uppercase, kebab-case, capitalize-first, slug) cannot be taught — they are derived from the canonical input.

Adds one row to search_patterns. The recall path uses patterns to substitute live query entities into a resource template, so a pattern with query_template="items in {entity}" and resource_template="GROUP-{entity:category}" generalizes one teach into a whole family.

Stores a structured CLI command sequence (with entity slots) and/or free-form gotchas/workarounds, keyed on the structural query family. The recall path surfaces this whenever a future query of the same family fires, so the agent can replay the choreography and read the notes verbatim. At least one of --playbook-json/--playbook-file and --notes/--notes-file must be set. --playbook-json takes the playbook body inline so MCP-only agents can record playbooks without a file on disk.

List every affected client, device, product, and version for a single CVE id. Cork exposes CVE ids only nested inside each vulnerability row and offers no CVE filter on any endpoint, so this question cannot be asked upstream at any page size. This command scans the vulnerability collection and matches locally, resolving client and device UUIDs against the local mirror. Use this command when a specific CVE is named and you need the list of affected clients and devices. Do NOT use this command to build a general patch queue with no CVE in hand; use 'vulnerabilities triage' instead.

List individual software vulnerabilities with full CVE details including CVSS score, EPSS score, KEV (known exploited) status, and impacted version. Filter by minimum_cvss_score, minimum_epss_score, minimum_priority, or only_known_exploited=true to focus on the highest-risk findings. Scope by client_uuid or device_uuid. Optional: page (default: 1), page_size (default: 10), sw_vendor (plus 9 more). Returns array of SoftwareVulnerability.

Get a rollup of CVEs grouped by software product, showing number of impacted devices, impacted versions, and highest severity rating. Use client_uuid to scope to a single client. Follow up with `Get Software Vulnerabilities` to drill into specific CVEs for a product. Optional: page (default: 1), page_size (default: 10), sw_vendor (plus 4 more). Returns array of SoftwareVulnerabilitySummary.

Rank vulnerabilities across all clients by known-exploited status, then EPSS, then CVSS, rolled up per software product with a blast-radius device count. Cork's API can only sort by software vendor or product, so exploitability ranking cannot be requested upstream. Vulnerability rows also carry bare client UUIDs, which this command resolves against the local mirror. Use this command to build a ranked patch queue across clients. Do NOT use this command to answer "are we exposed to a specific CVE"; use 'vulnerabilities exposure' instead.

Rank unwarranted or lapsed clients by current risk so coverage conversations start with the ones that need it most. Warranty state, client warranty status, and score trend live on three separate paths, so this ranking exists in no single Cork response and is normally a manual spreadsheet merge that goes stale as soon as a score moves. Use this command to rank clients for coverage conversations. Do NOT use this command to inspect warranty records or billing detail; use 'warranties' and 'invoices' instead.

List active cyber warranty packages. To identify which clients lack coverage, check the warranty_status field in `Get Clients` results - clients with 'unwarranted' status have no active warranty. Optional: partner_uuid, page (default: 1), page_size (default: 10). Returns array of Warranty.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources