Validate numeric options, accept dismissed aliases in MCP, and keep dismissal comments

- Numeric options reject non-integers, negatives, zero counts, and values above
  the documented maximum instead of passing NaN or 0 through
- codeant_scans_dismissed accepts sast and anti_patterns like the CLI
- metadata carries comment_for_dismiss, and secrets with a FALSE_POSITIVE
  confidence are marked false_positive

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: pranavcodeant

changelog.md

@@ -8,7 +8,8 @@
 - SCA severity is read from the advisory rating instead of defaulting to medium
 - Extra dead-code file paths no longer end in the result file name
 - Removed a debug dump of full scan responses to stderr
-- Fixed numeric options with defaults (`scans results --limit`, `scans history --limit`, PR comment `--limit`) being parsed in the wrong radix
+- Fixed numeric options with defaults (`scans results --limit`, `scans history --limit`, PR comment `--limit`) being parsed in the wrong radix; numeric options now reject non-integers, negative values, zero counts, and values above the documented maximum
+- The dismissal comment (`metadata.comment_for_dismiss`) and secrets with a `FALSE_POSITIVE` confidence are reported in `metadata`
 
 ## [0.5.8] - 02/10/2026
 - `findings antipatterns` and VM/container `findings cloud list` are paged (`--limit`, `--offset`, `--all`), so large organizations and scans no longer fail with a 502

mcp.md

@@ -15,7 +15,7 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_history` | read | Recent scan runs for a repo. |
 | `codeant_scans_get` | read | Severity/category summary for one scan. |
 | `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
-| `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
+| `codeant_scans_dismissed` | read | Dismissed alerts for a repo (any analysis type; `sast` and `anti_patterns` are accepted as aliases). |
 | `codeant_scans_overrides` | read | User false-positive, confidence, and severity overrides for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |

src/commands/scans/index.js

@@ -7,9 +7,10 @@ import { runDismissed, runOverrides } from './dismissed.js';
 import { runStartScan } from './start-scan.js';
 import { setQuiet, setNoColor } from './lib/log.js';
 import { setNoColor as tableSetNoColor } from './formatters/table.js';
+import { intOption } from '../../utils/intOption.js';
 
-// Commander passes the default as the parser's second argument; keep it out of the radix.
-const toInt = (value) => Number.parseInt(value, 10);
+const toCount = intOption({ min: 1 });
+const toOffset = intOption();
 
 /**
  * Register all `codeant scans <verb>` subcommands.
@@ -40,7 +41,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
     .option('--branch <name>', 'Filter by branch name')
     .option('--since <iso>', 'Show scans since ISO date')
-    .option('--limit <n>', 'Max results (default: 20)', toInt, 20)
+    .option('--limit <n>', 'Max results (default: 20)', toCount, 20)
     .action((opts) =>
       runCmd(() => runHistory({ repo: opts.repo, branch: opts.branch, since: opts.since, limit: opts.limit }))
     );
@@ -79,8 +80,8 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
     .option('--output <path>', 'Write output to file instead of stdout')
     .option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
-    .option('--limit <n>', 'Max findings per page (default: 100)', toInt, 100)
-    .option('--offset <n>', 'Pagination offset (default: 0)', toInt, 0)
+    .option('--limit <n>', 'Max findings per page (default: 100)', toCount, 100)
+    .option('--offset <n>', 'Pagination offset (default: 0)', toOffset, 0)
     .option('--fail-fast', 'Exit 3 on first category fetch failure')
     .option('--no-color', 'Disable ANSI color (auto-disabled when not a TTY)')
     .option('--quiet', 'Suppress progress output on stderr')

src/commands/scans/lib/normalize.js

@@ -96,8 +96,12 @@ export function normalizeIssue(issue, category) {
   if (issue.is_dismissed === true) {
     metadata.dismissed = true;
     if (issue.reason_for_dismiss) metadata.reason_for_dismiss = issue.reason_for_dismiss;
+    if (issue.comment_for_dismiss) metadata.comment_for_dismiss = issue.comment_for_dismiss;
+  }
+  // Secrets from older backends only carry the FALSE_POSITIVE confidence.
+  if (issue.is_false_positive === true || String(issue.confidence_score || '').toUpperCase() === 'FALSE_POSITIVE') {
+    metadata.false_positive = true;
   }
-  if (issue.is_false_positive === true) metadata.false_positive = true;
 
   const id = buildId(category, filePath, lineNumber, checkId, message);
 

src/index.js

@@ -20,6 +20,7 @@ import ScanCenter from './components/ScanCenter.js';
 import Welcome from './components/Welcome.js';
 import * as scm from './scm/index.js';
 import { setConfigValue } from './utils/config.js';
+import { intOption } from './utils/intOption.js';
 import { track, shutdown as analyticsShutdown, isTelemetryDisabled } from './utils/analytics.js';
 import registerScansCommands from './commands/scans/index.js';
 import registerSettingsCommands from './commands/settings/index.js';
@@ -31,9 +32,8 @@ import registerFindingsCommands from './commands/findings/index.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 
-// Commander passes an option's default as the parser's second argument, so a
-// bare `parseInt` would use it as the radix (`--limit 30` with default 20 → 60).
-const toInt = (value) => Number.parseInt(value, 10);
+const toCount = intOption({ min: 1 });
+const toOffset = intOption();
 
 // Split comma-separated globs while preserving commas inside {} brace expansions (e.g. "*.{js,ts}")
 function splitGlobs(input) {
@@ -71,7 +71,7 @@ program
   .option('--uncommitted', 'Scan only uncommitted changes (staged + unstaged + untracked)')
   .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
-  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', toInt)
+  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', toCount)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
@@ -122,7 +122,7 @@ program
   .option('--uncommitted', 'Review only uncommitted changes (staged + unstaged + untracked)')
   .option('--staged', 'Review only staged files')
   .option('--last-commit', 'Review last commit')
-  .option('--last-n-commits <n>', 'Review last n commits (max 5)', toInt)
+  .option('--last-n-commits <n>', 'Review last n commits (max 5)', toCount)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
@@ -303,8 +303,8 @@ program
     .option('--source-branch <branch>', 'Filter by source branch (partial match)')
     .option('--author <login>', 'Filter by author (fuzzy match)')
     .option('--state <state>', 'open or closed (default: open)', 'open')
-    .option('--limit <n>', 'Max results (default: 20, max: 100)', toInt, 20)
-    .option('--offset <n>', 'Pagination offset', toInt, 0)
+    .option('--limit <n>', 'Max results (default: 20, max: 100)', intOption({ min: 1, max: 100 }), 20)
+    .option('--offset <n>', 'Pagination offset', toOffset, 0)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.listPullRequests({
@@ -319,7 +319,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .requiredOption('--pr-number <n>', 'PR number', toInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.getPullRequest({
@@ -333,7 +333,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .requiredOption('--pr-number <n>', 'PR number', toInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .option('--codeant-generated <bool>', 'Filter by CodeAnt authorship (true/false)', (v) => v === 'true')
     .option('--addressed', 'Filter by addressed/resolved status')
     .option('--created-after <date>', 'ISO 8601 date filter')
@@ -351,8 +351,8 @@ program
     .description('Resolve a conversation/comment thread on a PR')
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
-    .requiredOption('--pr-number <n>', 'PR number', toInt)
-    .option('--comment-id <id>', 'Comment ID (GitHub, Bitbucket)', toInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
+    .option('--comment-id <id>', 'Comment ID (GitHub, Bitbucket)', toCount)
     .option('--thread-id <id>', 'Thread/node ID (GitHub GraphQL, Azure)')
     .option('--discussion-id <id>', 'Discussion ID (GitLab)')
     .action((options) => {
@@ -374,10 +374,10 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .option('--pr-number <n>', 'Filter by PR number', toInt)
+    .option('--pr-number <n>', 'Filter by PR number', toCount)
     .option('--status <status>', 'Filter by status (PENDING, COMPLETED, FAILED, etc.)')
-    .option('--limit <n>', 'Max results (default: 20)', toInt, 20)
-    .option('--offset <n>', 'Pagination offset', toInt, 0)
+    .option('--limit <n>', 'Max results (default: 20)', toCount, 20)
+    .option('--offset <n>', 'Pagination offset', toOffset, 0)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.listCodeReviews({
@@ -391,7 +391,7 @@ program
     .description('Get detailed information for a specific code review')
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
-    .requiredOption('--pr-number <n>', 'PR number', toInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .requiredOption('--review-id <id>', 'Code review ID')
     .action((options) => {
       const opts = resolveRepoOpts(options);
@@ -409,7 +409,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .requiredOption('--query <term>', 'Search term')
-    .option('--limit <n>', 'Max results (default: 10, max: 50)', toInt, 10)
+    .option('--limit <n>', 'Max results (default: 10, max: 50)', intOption({ min: 1, max: 50 }), 10)
     .option('--include-addressed', 'Include resolved comments (default: false)')
     .option('--created-after <date>', 'ISO 8601 date filter')
     .action((options) => {

src/mcp/server.js

@@ -212,7 +212,7 @@ export async function startMcpServer() {
       description: 'List dismissed alerts (false positives, accepted risk, etc.) for a repository. Useful when triaging to avoid re-surfacing already-handled findings.',
       inputSchema: {
         repo: z.string().describe('Repository in owner/repo form.'),
-        analysisType: z.enum(['security', 'secrets', 'sca', 'iac', 'antipatterns', 'docstring', 'complex_functions', 'dead_code', 'duplicate_code']).optional().describe('Analysis type (default "security").'),
+        analysisType: z.enum(['security', 'sast', 'secrets', 'sca', 'iac', 'antipatterns', 'anti_patterns', 'docstring', 'complex_functions', 'dead_code', 'duplicate_code']).optional().describe('Analysis type (default "security"; sast and anti_patterns are aliases).'),
       },
       annotations: READ,
     },

src/utils/intOption.js

@@ -0,0 +1,18 @@
+import { InvalidArgumentError } from 'commander';
+
+/**
+ * Commander parser for an integer option within [min, max]. Commander passes the
+ * option's default as the parser's second argument, so a bare `parseInt` would
+ * use it as the radix (`--limit 30` with default 20 → 60).
+ */
+export function intOption({ min = 0, max = Infinity } = {}) {
+  return (value) => {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < min || n > max) {
+      throw new InvalidArgumentError(
+        max === Infinity ? `Must be an integer of at least ${min}.` : `Must be an integer from ${min} to ${max}.`
+      );
+    }
+    return n;
+  };
+}

tests/intOption.test.js

@@ -0,0 +1,25 @@
+import { Command } from 'commander';
+import { describe, expect, it } from 'vitest';
+import { intOption } from '../src/utils/intOption.js';
+
+function parse(parser, defaultValue, argv) {
+  const cmd = new Command().exitOverride().configureOutput({ writeErr: () => {} });
+  cmd.option('--limit <n>', 'limit', parser, defaultValue);
+  cmd.parse(argv, { from: 'user' });
+  return cmd.opts().limit;
+}
+
+describe('intOption', () => {
+  it('parses base 10 even though commander passes the default as the second argument', () => {
+    expect(parse(intOption({ min: 1 }), 20, ['--limit', '30'])).toBe(30);
+    expect(parse(intOption({ min: 1 }), 20, [])).toBe(20);
+  });
+
+  it.each([['0'], ['-1'], ['abc'], ['12abc'], ['1.5'], ['101']])('rejects %s', (value) => {
+    expect(() => parse(intOption({ min: 1, max: 100 }), 20, ['--limit', value])).toThrow(/Must be an integer/);
+  });
+
+  it('accepts zero for offsets', () => {
+    expect(parse(intOption(), 0, ['--limit', '0'])).toBe(0);
+  });
+});

tests/scansDismissFp.test.js

@@ -165,6 +165,7 @@ describe('dismissed and false-positive markers', () => {
       duplicate_locations: ['src/b.py:30-40'],
       is_dismissed: true,
       reason_for_dismiss: 'intentional',
+      comment_for_dismiss: 'kept for the v1 API',
       is_false_positive: true,
     }, 'duplicate_code');
 
@@ -173,7 +174,17 @@ describe('dismissed and false-positive markers', () => {
       duplicate_locations: ['src/b.py:30-40'],
       dismissed: true,
       reason_for_dismiss: 'intentional',
+      comment_for_dismiss: 'kept for the v1 API',
       false_positive: true,
     });
   });
+
+  it('marks secrets with a FALSE_POSITIVE confidence as false positives', () => {
+    const finding = normalizeIssue(
+      { file_path: '.env', line_number: 1, type: 'AWS Key', confidence_score: 'false_positive' },
+      'secrets'
+    );
+
+    expect(finding.metadata.false_positive).toBe(true);
+  });
 });