Fortify Software Security Center (SSC) Skill

When to Use This Skill

• List application and application version
• List security issues/vulnerabilities with filtering by severity, category, etc.
• Count issues grouped by severity, category, etc.

Available MCP Tools

fcli_ssc_session_list

fcli_ssc_app_list

fcli_ssc_app_get

fcli_ssc_appversion_list

fcli_ssc_appversion_get

fcli_ssc_issue_list

fcli_ssc_issue_list_filters

fcli_ssc_issue_list_groups

fcli_ssc_issue_count

--by

fcli_ssc_mcp_job

pagination.jobToken

Parameter Formats

appVersionNameOrId

--appversion

"<App>:<Version>"

"MyApp:MyRelease"

--filter

"<FilterType>:<Value>"

issue_list_filters

"Folder:Critical"

--filterset

--filter

"Security Auditor View"

--embed

"details,auditHistory"

--by

issue_list_groups

issue_count

"Folder"

"Category"

Authentication

fcli_ssc_session_list with refresh-cache=true

• If

  Expired

  =

  No

  → proceed
• If expired → ask user to run locally:

  fcli ssc session login --url "<URL>" -u "<user>" -p '<pass>'

• When running any SSC tool, if authentication error occurs, prompt user to re-authenticate locally.

Filtering: Prefer --filter; query Optional

• Prefer

  --filter

  for server-side filtering (fastest, smallest payloads)
• Optionally use

  query

  as a client-side post-filter when you need a simple match on returned fields
• Always discover available filters with

  issue_list_filters

  before applying them

Pagination

• If

  pagination.hasMore

  = true → use

  pagination-offset

  for next page
• If

  pagination.jobToken

  present → background loading; wait with

  fcli_ssc_mcp_job

  (see Background Job Handling)
• Once

  pagination.totalRecords

  appears → all records collected

Error Recovery

Authentication

app_list

issue_list_filters

Decision Tree: Choosing the Right Approach

issue_list

--filter

--embed details

issue_count

--by

app_list

appversion_list

Best Practices

• ✅ Use

  --filter

  for filtering
• ✅ Prioritize server-side filtering over client-side
• ✅ Prioritize use MCP tool over FCLI CLI directly

• ❌ Guess application/version names - ask the user
• ❌ Prompt user for credentials - ask user to run

  fcli ssc session login

  locally
• ❌ Assume filter names exist - always run

  issue_list_filters

  first
• ❌ Make multiple API calls for details - use

  --embed

  parameter instead

References

Example Workflows

pagination.jobToken

External Resources

• FCLI Documentation
• SSC Documentation (version in YY.<Quarter>.<patch> format)
• SSC User Guide