Blazemeter When to use
Load this skill for any Mend/WhiteSource read: fetching a project's alerts, resolving a project token, or interpreting CVE severity. It does not apply fixes — pair it with dep-remediation (how to fix), and the mend-blz recipe drives the end-to-end loop.
Credentials
Three values, from environment or ~/.claude/team-config.md:
MEND_URL—https://saas-eu.whitesourcesoftware.comMEND_USER_KEY— per-user key (issued toTCohen@perforce.com; the value is a secret, the email only identifies the owner).getOrganizationProjectVitalsneeds an org-admin key;getProjectAlertsByTypeworks for any member once the project token is known.MEND_ORG_TOKEN— the Blazemeter org token, exported under bothBlazemeterandBlazemeter_GHC(same value, different code paths read different names). No org selection/fallback logic.
Never echo these to logs, Slack, PRs, or Jira. Validate presence at the start and abort with an actionable error if any is missing.
Quick reference (REST v1.3)
All calls are POSTs to ${MEND_URL}/api/v1.3 with a JSON body carrying userKey + orgToken. Full request/response shapes and examples: references/api.md.
| Task | requestType | Key params |
|---|---|---|
| Find a project's token | getOrganizationProjectVitals |
match projectVitals[].name against the target's Mend project name |
| Fetch alerts | getProjectAlertsByType |
userKey + projectToken + alertType: SECURITY_VULNERABILITY |
Project-name matching (in order)
Mend project names drift from repo names (e.g. a.blazemeter.com → BZA-Backend).
- Exact (case-insensitive) match of the configured Mend project name against
projectVitals[].name. - Substring match either direction.
- No match → abort and list the first 10 project names so the user can spot the mismatch.
Severity
- Mend returns severity lowercase (
"low"/"medium"/"high"/"critical") — always compare case-insensitively; a== "HIGH"check silently misses real alerts. - Two fields: legacy
severityandcvss3_severity/cvss3_score— prefer cvss3 when present. - Fix hint is
fixResolutionText(human string) +topFix/allFixes(structured). There is nofixResolutionfield. - Library identity =
library.name+library.version(artifactIdmay be a filename;groupIdonly meaningful for Maven). - Default scope = HIGH + CRITICAL when the caller doesn't specify; MEDIUM/LOW are deferred unless requested.
Gotchas
- Empty
alerts[]does NOT mean clean — may mean "not scanned recently." CheckprojectVitals[].lastUpdated; warn if older than 7 days. - No on-demand rescan in v1.3. A re-query right after a fix shows the last scan, not local edits. Absent alerts → likely cleared at the resolved-tree layer; still-present → label
pending Mend rescan, notfailed fix. Final confirmation is the Jenkins mend stage. - API version
v1.3. A newer GraphQL API exists, but the creds are wired for v1.3 REST — don't migrate without re-validating creds. - Dual-name org token.
BlazemeterandBlazemeter_GHCare the same value — never branch logic on which.
Test mode
With a test flag, skip the API entirely and read pre-seeded JSON from /tmp/mend-<component>-vulns.json (same shape as getProjectAlertsByType). Missing file → abort with a clear error pointing at the expected path.
References
- api.md — endpoint specs, request/response shapes, field notes, examples.