Croway opened a new pull request, #29989: URL: https://github.com/apache/camel/pull/29989
JIRA: [CAMEL-26963](https://issues.apache.org/jira/browse/CAMEL-26963), a sub-task of [CAMEL-25639](https://issues.apache.org/jira/browse/CAMEL-25639) (the consolidation of the camel-jbang-mcp tools). Every camel-jbang-mcp tool is listed to every client (CAMEL-25537), so a tool that is stale or a subset of another one costs context on every session. This removes four of them. ## Folded: `camel_dependency_security_audit` into `camel_dependency_check` Both tools read the POM and took the same arguments (`pomContent`, `routes`, `runtime`, `camelVersion`, `platformBom`, `sanitizePom`), and the advisories ship with the catalog, so the check gains the audit without a network call: - New `security` section in the answer: the published CVE advisories of each declared artifact at the project's Camel version, with severity, affected and fixed versions, `reachable` when routes are given (null otherwise), the advisories that name no component as `uncheckedAdvisories`, and `clean`. - When the `pom.xml` sets no Camel version, it checks the `camelVersion` argument, else lists every advisory of the declared components and says so in `security.warnings` (the audit's behaviour, unchanged). - The summary gains `vulnerableArtifactCount`, counted in `totalIssueCount` only when the Camel version is known: without one, every advisory of a declared component is listed whether or not it applies, so it would make almost every parent-managed project unhealthy. - Recommendations of category `Security`: upgrade (priority high with a critical or high CVE), call again with `camelVersion`, or review the unchecked advisories. - The route components are parsed once and shared by the missing-dependency check and the reachability check. - If the catalog carries no advisory data, the check still answers and says so in `security.warnings` (`clean` false), instead of failing the whole call. ## Removed, with no replacement tool | Tool | Why | |---|---| | `camel_ai_pipeline_scaffold` | The route it returned refers to beans it never defines (`#buildSummarizationPrompt`, `#buildExtractionPrompt`, `#buildRagPrompt`, `#buildClassificationPrompt`, `#mergeDoclingAndTextract`, `#bedrockEmbedding`), and its default model is Claude Sonnet 4. A route like it can be built with `camel_catalog_doc` and the AI components. | | `camel_route_cost_estimate` | Prices written into the code; every Bedrock call was priced as Claude Sonnet 4. | | `camel_route_test_scaffold` | It wrote a JUnit 5 test (`CamelTestSupport` / `@CamelSpringBootTest`). The Camel CLI runs Citrus tests: `camel test init` creates one, `camel test run` runs it, and `camel_write_file` already checks a Citrus test. | `TestInfraData` stays (the `camel://test-infra` resources use it); its sendable-schemes helper, used only by the test scaffold, is removed. ## Not in this PR `camel_error_diagnose` is one of the shared authoring tools of camel-jbang-core (listed by `camel mcp` and `camel tui --mcp`, used by the TUI agent), so whether it stays is asked on the JIRA and left for a follow-up. ## Docs - `camel-jbang-mcp.adoc`: the removed rows and sections, the `security` section of `camel_dependency_check`, the examples. - 4.24 upgrade guide: a new section for the fold and the removals; the earlier 4.24 paragraph on the audit now covers `camel_dependency_check` only. ## Tests - `DependencyCheckToolsTest`: the audit's cases ported (CVEs of an older version, clean recent version, reachable and not reachable, undetected version with and without `camelVersion`, unchecked advisories, empty routes) plus the new summary and recommendation behaviour. - `McpSecuredToolClassesTest`: its guard against an empty scan expected more than 20 tool classes; 20 remain, so it now expects more than 15. - Whole camel-jbang-mcp module run locally: 485 tests, all green except `RouteDiagramToolsTest.imageWithoutATheme`, which fails the same way on an unchanged `main` on my machine (a locally installed Camel CLI plugin built for 4.23 is loaded by the in-process run), unrelated to this change. _Claude Code on behalf of Croway_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
