# Mend

> Read and interpret Mend (formerly WhiteSource) SCA data — authenticate to the REST API v1.3, look up a project token, fetch SECURITY_VULNERABILITY alerts, and classify CVE severity. Load whenever the work involves Mend/WhiteSource, CVEs from Mend, or fetching/triaging vulnerability alerts. Generic SCA-read knowledge; the fix workflow lives in dep-remediation + the mend-blz recipe.

- Skill: `blazemeter/mend` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add blazemeter/mend`
- Raw SKILL.md: https://api.skillmd.com/api/skills/blazemeter/mend/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: Blazemeter (https://skillmd.com/u/blazemeter)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/blazemeter/mend

---


# When to use

Load this skill for any Mend/WhiteSource read: fetching a project's alerts, resolving a project
token, or interpreting CVE severity. It does **not** apply fixes — pair it with **dep-remediation**
(how to fix), and the **mend-blz** recipe drives the end-to-end loop.

# Credentials

Three values, from environment or `~/.claude/team-config.md`:

- `MEND_URL` — `https://saas-eu.whitesourcesoftware.com`
- `MEND_USER_KEY` — per-user key (issued to `TCohen@perforce.com`; the value is a secret, the email only identifies the owner). `getOrganizationProjectVitals` needs an **org-admin** key; `getProjectAlertsByType` works for any member once the project token is known.
- `MEND_ORG_TOKEN` — the Blazemeter org token, exported under **both** `Blazemeter` and `Blazemeter_GHC` (**same value**, different code paths read different names). No org selection/fallback logic.

**Never echo these** to logs, Slack, PRs, or Jira. Validate presence at the start and abort with an actionable error if any is missing.

# Quick reference (REST v1.3)

All calls are POSTs to `${MEND_URL}/api/v1.3` with a JSON body carrying `userKey` + `orgToken`. Full request/response shapes and examples: [references/api.md](references/api.md).

| Task | requestType | Key params |
|------|-------------|-----------|
| Find a project's token | `getOrganizationProjectVitals` | match `projectVitals[].name` against the target's Mend project name |
| Fetch alerts | `getProjectAlertsByType` | `userKey` + `projectToken` + `alertType: SECURITY_VULNERABILITY` |

## Project-name matching (in order)

Mend project names drift from repo names (e.g. `a.blazemeter.com` → `BZA-Backend`).
1. Exact (case-insensitive) match of the configured Mend project name against `projectVitals[].name`.
2. Substring match either direction.
3. No match → abort and list the first 10 project names so the user can spot the mismatch.

## Severity

- Mend returns severity **lowercase** (`"low"`/`"medium"`/`"high"`/`"critical"`) — **always compare case-insensitively**; a `== "HIGH"` check silently misses real alerts.
- Two fields: legacy `severity` and `cvss3_severity`/`cvss3_score` — **prefer cvss3 when present**.
- Fix hint is `fixResolutionText` (human string) + `topFix`/`allFixes` (structured). There is no `fixResolution` field.
- Library identity = `library.name` + `library.version` (`artifactId` may be a filename; `groupId` only meaningful for Maven).
- **Default scope = HIGH + CRITICAL** when the caller doesn't specify; MEDIUM/LOW are deferred unless requested.

# Gotchas

- **Empty `alerts[]` does NOT mean clean** — may mean "not scanned recently." Check `projectVitals[].lastUpdated`; warn if older than 7 days.
- **No on-demand rescan in v1.3.** A re-query right after a fix shows the *last* scan, not local edits. Absent alerts → likely cleared at the resolved-tree layer; still-present → label `pending Mend rescan`, not `failed fix`. Final confirmation is the Jenkins **mend** stage.
- **API version `v1.3`.** A newer GraphQL API exists, but the creds are wired for v1.3 REST — don't migrate without re-validating creds.
- **Dual-name org token.** `Blazemeter` and `Blazemeter_GHC` are the same value — never branch logic on which.

## Test mode

With a `test` flag, skip the API entirely and read pre-seeded JSON from `/tmp/mend-<component>-vulns.json` (same shape as `getProjectAlertsByType`). Missing file → abort with a clear error pointing at the expected path.

# References

- [api.md](references/api.md) — endpoint specs, request/response shapes, field notes, examples.