Merge pull request #45 from CodeAnt-AI/pranav/cli-paginated-findings

Page anti-pattern and VM/container cloud findings (0.5.8)

Author: pranavcodeant

changelog.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## [0.5.8] - 02/10/2026
+- `findings antipatterns` and VM/container `findings cloud list` are paged (`--limit`, `--offset`, `--all`), so large organizations and scans no longer fail with a 502
+
 ## [0.5.7] - 28/09/2026
 - Login tokens are prefixed with `cli___` so CLI logins show up as CLI on the IDE users page
 

findings.md

@@ -75,9 +75,12 @@ codeant findings antipatterns --org CodeAnt-AI --service github
 codeant findings antipatterns \
   --org CodeAnt-AI --service github \
   --repos CodeAnt-AI/api,CodeAnt-AI/web
+
+# Every page, merged into one list
+codeant findings antipatterns --org CodeAnt-AI --service github --all
 ```
 
-When `--repos` is omitted, the CLI first lists the organization's repositories and sends all of them to the same aggregate anti-pattern endpoint used by the Quality Report UI.
+When `--repos` is omitted, the CLI first lists the organization's repositories and sends all of them to the aggregate anti-pattern endpoint. Results are paged because an organization-wide list can exceed the API's 1 MB response limit: `--limit` is 25, 100, or 500 (default 500), `--offset` is a multiple of `--limit` (default 0), and `--all` fetches every page from `--offset` on. Responses carry `total`, `limit`, and `offset`; `summary` and `total_issues` always cover every issue.
 
 ## Cloud security findings
 
@@ -98,8 +101,9 @@ codeant findings cloud history --provider all --kind container
 codeant findings cloud list --provider aws --scan-id <scan-id> --account-id <account-id>
 codeant findings cloud get --provider aws --scan-id <scan-id> --uid <finding-uid> --cloud-service iam
 
-# VM and container vulnerabilities use the same list/detail flow
+# VM and container vulnerabilities use the same list/detail flow (paged; --all merges every page)
 codeant findings cloud list --provider aws --kind vm --scan-id <scan-id>
+codeant findings cloud list --provider aws --kind container --scan-id <scan-id> --all
 codeant findings cloud get --provider gcp --kind container --scan-id <scan-id> --uid <finding-uid>
 
 # Azure requires the tenant ID
@@ -113,7 +117,7 @@ codeant findings cloud list \
   --framework cis
 ```
 
-`--kind` defaults to `cspm`; use `vm` or `container` for the other Cloud Security result views. CSPM `cloud list` supports `--cloud-service`, `--severity`, `--status`, `--framework`, and `--min-days-unused`. AWS additionally supports `--exploit-attempted-only`; Azure additionally supports `--subscription-id`. CSPM responses include `findings` and `dismissed_findings`; VM/container responses preserve their UI result payload unchanged.
+`--kind` defaults to `cspm`; use `vm` or `container` for the other Cloud Security result views. CSPM `cloud list` supports `--cloud-service`, `--severity`, `--status`, `--framework`, and `--min-days-unused`. AWS additionally supports `--exploit-attempted-only`; Azure additionally supports `--subscription-id`. CSPM responses include `findings` and `dismissed_findings`. VM/container responses keep the UI result payload, but `findings` is paged with the same `--limit`/`--offset`/`--all` options as anti-patterns and the response carries `total`; `findings_total` and `severity_rollup` still describe the whole scan.
 
 ## Pentest findings
 

mcp.md

@@ -18,9 +18,9 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
-| `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos. |
+| `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos (paged: `limit`, `offset`, `all`). |
 | `codeant_cloud_scan_history` | read | AWS/Azure/GCP CSPM, VM, or container scan history. |
-| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan. |
+| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan (VM/container paged: `limit`, `offset`, `all`). |
 | `codeant_cloud_finding_get` | read | Full detail for one cloud finding UID. |
 | `codeant_pentest_history` | read | Pentest engagement history. |
 | `codeant_pentest_issues` | read | All available issues for a pentest engagement. |

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {

package.json

@@ -54,6 +54,17 @@ function hotlistOptions(options) {
   };
 }
 
+function addPageOptions(command) {
+  return command
+    .option('--limit <n>', 'Page size: 25, 100, or 500', Number, 500)
+    .option('--offset <n>', 'Start offset, a multiple of --limit', Number, 0)
+    .option('--all', 'Fetch every page from --offset on', false);
+}
+
+function pageOptions(options) {
+  return { limit: options.limit, offset: options.offset, all: options.all };
+}
+
 function addCloudScopeOptions(command) {
   return addTenantOptions(command)
     .requiredOption('--provider <provider>', 'Cloud provider: aws, azure, or gcp')
@@ -157,9 +168,9 @@ export default function registerFindingsCommands(program, { runCmd }) {
       maxWaitSeconds: options.maxWait,
     })));
 
-  addTenantOptions(findings.command('antipatterns').description('List anti-pattern findings across selected or all organization repositories'))
+  addPageOptions(addTenantOptions(findings.command('antipatterns').description('List anti-pattern findings across selected or all organization repositories')))
     .option('--repos <repos>', 'Comma-separated owner/repo values; defaults to every repository')
-    .action((options) => runCmd(() => runOrganizationAntipatterns({ ...tenantOptions(options), repos: options.repos })));
+    .action((options) => runCmd(() => runOrganizationAntipatterns({ ...tenantOptions(options), ...pageOptions(options), repos: options.repos })));
 
   const cloud = findings.command('cloud').description('Cloud security CSPM, VM, and container findings');
   addTenantOptions(cloud.command('history').description('List cloud scan history, or latest scans'))
@@ -168,14 +179,14 @@ export default function registerFindingsCommands(program, { runCmd }) {
     .option('--latest', 'Return only latest CSPM scans')
     .action((options) => runCmd(() => runCloudHistory({ ...tenantOptions(options), provider: options.provider, kind: options.kind, latest: options.latest })));
 
-  addCloudScopeOptions(cloud.command('list').description('List findings for a cloud scan'))
+  addPageOptions(addCloudScopeOptions(cloud.command('list').description('List findings for a cloud scan (VM/container results are paged)')))
     .option('--severity <value>', 'Severity filter')
     .option('--status <value>', 'Finding status filter')
     .option('--framework <value>', 'Compliance framework filter')
     .option('--subscription-id <id>', 'Azure subscription ID filter')
     .option('--exploit-attempted-only', 'AWS findings with validation attempts only')
     .option('--min-days-unused <n>', 'Minimum unused age in days', Number)
-    .action((options) => runCmd(() => runCloudFindings(cloudOptions(options))));
+    .action((options) => runCmd(() => runCloudFindings({ ...cloudOptions(options), ...pageOptions(options) })));
 
   addCloudScopeOptions(cloud.command('get').description('Get one cloud finding with full detail'))
     .requiredOption('--uid <uid>', 'Finding UID')

src/commands/findings/index.js

@@ -1,6 +1,6 @@
 import { resolveCliTenant } from '../api/tenant.js';
 import { runRepos } from '../commands/scans/repos.js';
-import { fetchAppApi } from '../utils/fetchApi.js';
+import { fetchPaginated } from './paginate.js';
 
 function splitRepos(value) {
   const values = Array.isArray(value) ? value : value ? [value] : [];
@@ -19,11 +19,12 @@ export async function runOrganizationAntipatterns(options = {}) {
   }
   if (repos.length === 0) throw new Error('No repositories are available for this organization.');
 
-  const result = await fetchAppApi(
-    '/explorer/quality/antipatterns',
-    'POST',
+  const result = await fetchPaginated(
+    '/explorer/quality/antipatterns/paginated',
     { ...tenant.requestBody, org: tenant.organization, repos },
     tenant,
+    'antipatterns',
+    options,
   );
   return { tenant: tenant.requestBody, ...result };
 }

src/findings/antipatterns.js

@@ -1,5 +1,6 @@
 import { resolveCliTenant } from '../api/tenant.js';
 import { fetchAppApi } from '../utils/fetchApi.js';
+import { fetchPaginated } from './paginate.js';
 
 const PROVIDERS = new Set(['aws', 'azure', 'gcp']);
 const KINDS = new Set(['cspm', 'vm', 'container']);
@@ -53,18 +54,13 @@ function optionalFilters(provider, options = {}) {
   return filters;
 }
 
-async function request(provider, kind, action, options = {}, extra = {}, resolvedTenant = null) {
+async function request(provider, kind, action, options = {}, extra = {}, resolvedTenant = null, pageKey = null) {
   const tenant = resolvedTenant || await resolveCliTenant(options);
-  const data = await fetchAppApi(
-    endpoint(provider, kind, action),
-    'POST',
-    {
-      ...tenant.requestBody,
-      username: tenant.organization,
-      ...extra,
-    },
-    tenant,
-  );
+  const path = endpoint(provider, kind, action);
+  const body = { ...tenant.requestBody, username: tenant.organization, ...extra };
+  const data = pageKey
+    ? await fetchPaginated(path, body, tenant, pageKey, options)
+    : await fetchAppApi(path, 'POST', body, tenant);
   return { tenant: tenant.requestBody, provider, kind, ...data };
 }
 
@@ -96,10 +92,14 @@ export async function runCloudFindings(options = {}) {
   const provider = normalizeProvider(options.provider);
   const kind = normalizeKind(options.kind);
   const scanId = requireValue(options.scanId, '--scan-id');
-  return request(provider, kind, kind === 'cspm' ? 'findings' : 'results', options, {
+  // VM/container scans can exceed the API's 1 MB response cap, so they are paged.
+  if (kind !== 'cspm') {
+    return request(provider, kind, 'results/paginated', options, { scan_id: scanId }, null, 'findings');
+  }
+  return request(provider, kind, 'findings', options, {
     scan_id: scanId,
-    ...(kind === 'cspm' ? providerScope(provider, options) : {}),
-    ...(kind === 'cspm' ? optionalFilters(provider, options) : {}),
+    ...providerScope(provider, options),
+    ...optionalFilters(provider, options),
   });
 }
 

src/findings/cloud.js

@@ -0,0 +1,32 @@
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+const LIMITS = [25, 100, 500];
+// Every page re-reads the whole result server-side, so fetch a few at a time.
+const CONCURRENCY = 5;
+
+function pageParams(options) {
+  const limit = options.limit === undefined ? 500 : Number(options.limit);
+  const offset = options.offset === undefined ? 0 : Number(options.offset);
+  if (!LIMITS.includes(limit)) throw new Error(`--limit must be one of: ${LIMITS.join(', ')}.`);
+  if (!Number.isInteger(offset) || offset < 0 || offset % limit) {
+    throw new Error('--offset must be a non-negative multiple of --limit.');
+  }
+  return { limit, offset };
+}
+
+// One page of `key` from a backend /paginated endpoint (with its `total`), or
+// with `all` every page from `offset` on, merged into one list.
+export async function fetchPaginated(endpoint, body, tenant, key, options = {}) {
+  const { limit, offset } = pageParams(options);
+  const fetchPage = (pageOffset) => fetchAppApi(endpoint, 'POST', { ...body, limit, offset: pageOffset }, tenant);
+  const first = await fetchPage(offset);
+  if (!options.all) return first;
+
+  const offsets = [];
+  for (let next = offset + limit; next < first.total; next += limit) offsets.push(next);
+  const pages = [first];
+  for (let index = 0; index < offsets.length; index += CONCURRENCY) {
+    pages.push(...await Promise.all(offsets.slice(index, index + CONCURRENCY).map(fetchPage)));
+  }
+  return { ...first, [key]: pages.flatMap((page) => page[key] || []) };
+}

src/findings/paginate.js

@@ -273,12 +273,15 @@ export async function startMcpServer() {
     'codeant_findings_antipatterns',
     {
       title: 'List organization anti-pattern findings',
-      description: 'Fetch anti-pattern findings across selected repositories, or every repository in the organization when repos is omitted.',
+      description: 'Fetch anti-pattern findings across selected repositories, or every repository in the organization when repos is omitted. Results are paged; the response carries total.',
       inputSchema: {
         org: z.string().optional(),
         service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
         providerBaseUrl: z.string().url().optional(),
         repos: z.array(z.string()).optional().describe('Repositories in owner/repo form. Omit to query every repository.'),
+        limit: z.union([z.literal(25), z.literal(100), z.literal(500)]).optional().describe('Page size (default 500).'),
+        offset: z.number().int().nonnegative().optional().describe('Start offset, a multiple of limit (default 0).'),
+        all: z.boolean().optional().describe('Fetch every page from offset on instead of one page.'),
       },
       annotations: READ,
     },
@@ -311,7 +314,7 @@ export async function startMcpServer() {
     'codeant_cloud_findings_list',
     {
       title: 'List cloud security findings',
-      description: 'Fetch findings for one AWS, Azure, or GCP CSPM, VM, or container scan using the same endpoint as the app.',
+      description: 'Fetch findings for one AWS, Azure, or GCP CSPM, VM, or container scan. VM and container results are paged (limit/offset/all) and carry total.',
       inputSchema: {
         org: z.string().optional(),
         service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
@@ -329,6 +332,9 @@ export async function startMcpServer() {
         subscriptionId: z.string().optional(),
         exploitAttemptedOnly: z.boolean().optional(),
         minDaysUnused: z.number().int().nonnegative().optional(),
+        limit: z.union([z.literal(25), z.literal(100), z.literal(500)]).optional().describe('Page size (default 500).'),
+        offset: z.number().int().nonnegative().optional().describe('Start offset, a multiple of limit (default 0).'),
+        all: z.boolean().optional().describe('Fetch every page from offset on instead of one page.'),
       },
       annotations: READ,
     },