feat: add dashboard-aware presentation tools to cve-impact and fleet-inventory skills

rh-sre/mcps.json

@@ -10,7 +10,7 @@
         "LIGHTSPEED_CLIENT_ID",
         "--env",
         "LIGHTSPEED_CLIENT_SECRET",
-        "quay.io/redhat-services-prod/insights-management-tenant/insights-mcp/red-hat-lightspeed-mcp@sha256:98ee33fa7cb690d02d33f57900ab95ad831b8e7985710e0ccb87f53ce1b09865"
+        "quay.io/redhat-services-prod/insights-management-tenant/insights-mcp/red-hat-lightspeed-mcp@sha256:90473f1e97a1e637465c01c2f2ab8858525c187a2d0be20e62e4f6d30c27773c"
       ],
       "env": {
         "LIGHTSPEED_CLIENT_ID": "${LIGHTSPEED_CLIENT_ID}",

rh-sre/skills/cve-impact/SKILL.md

@@ -11,7 +11,7 @@ description: |
 model: inherit
 color: blue
 license: Apache-2.0
-allowed-tools: vulnerability__get_cves vulnerability__get_cve vulnerability__get_cve_systems vulnerability__get_system_cves inventory__find_host_by_name inventory__get_host_details
+allowed-tools: vulnerability__get_cves vulnerability__get_cve vulnerability__get_cve_systems vulnerability__get_system_cves vulnerability__load_cve_dashboard inventory__find_host_by_name inventory__get_host_details
 ---
 
 # CVE Impact Analysis Skill
@@ -35,6 +35,7 @@ When invoked by another skill (e.g. remediation), use the Skill tool—do NOT us
 - `get_cve` (from lightspeed-mcp) - Get specific CVE details
 - `get_cve_systems` (from lightspeed-mcp) - Find systems affected by CVEs
 - `get_system_cves` (from lightspeed-mcp) - List CVEs affecting a specific system (uses `system_uuid` only)
+- `load_cve_dashboard` (from lightspeed-mcp) - Open the interactive CVE dashboard with query parameters. If the client does not support UI, the tool instructs the model to present the data as text.
 
 **Required Environment Variables**:
 - `LIGHTSPEED_CLIENT_ID` - Red Hat Lightspeed service account client ID
@@ -375,6 +376,11 @@ Save each MCP tool result to a file, then run the parser with one or more paths.
   - Does NOT support: impact, limit, severity filters - filter results client-side
   - Returns: List of CVEs affecting the system
 
+- `load_cve_dashboard` (from lightspeed-mcp) - Open the interactive CVE dashboard
+  - Parameters: Query parameters matching the data tool call (system_uuid, limit, sort, impact, advisory_available, etc.)
+  - Returns: Interactive dashboard with CVE browsing, filtering, and drill-down
+  - Falls back to text if unavailable or client does not support UI
+
 ### Related Skills
 - `mcp-lightspeed-validator` - **PREREQUISITE** - Validates Lightspeed MCP server before operations
   - Use before: ALL cve-impact operations (Step 0 in workflow)

rh-sre/skills/cve-impact/references/flows/01-account-cves.md

@@ -2,7 +2,7 @@
 
 **Scope**: devices=all (account-wide) | severities=all, most critical, or selected | remediation=available or does not matter
 
-**Tool**: `vulnerability__get_cves` (single request; no offset pagination in API)
+**Tools**: `vulnerability__get_cves` fetching the data for analysis and `vulnerability__load_cve_dashboard` displaying an interactive dashboard
 
 ## When to Use
 
@@ -36,9 +36,9 @@ Proceed with limit=20? (yes/no) Or specify a different limit.
 - **User specifies N** → use `limit=N`
 - **no** → Stop execution
 
-## Step 3: MCP Tool Invocation
+## Step 3: MCP Tools Invocation
 
-**Tool**: `vulnerability__get_cves` (from lightspeed-mcp)
+**Tools**: `vulnerability__load_cve_dashboard` and `vulnerability__get_cves` (from lightspeed-mcp)
 
 **Parameters**:
 
@@ -54,6 +54,30 @@ Proceed with limit=20? (yes/no) Or specify a different limit.
 - `sort`: `"-cvss_score"` (descending by CVSS)
 - `limit`: From HITL (default 20)
 
+
+**Before** continuing further, invoke the dashboard tool to initiate the dashboard, and examine the instruction returning from the tool.
+
+**Example** (most critical, remediatable):
+```
+vulnerability__load_cve_dashboard(
+  impact="7,6",
+  sort="-cvss_score",
+  limit=20,
+  advisory_available="true"
+)
+```
+
+**Example** (all severities, remediation doesn't matter):
+```
+vulnerability__load_cve_dashboard(
+  impact="7,6,5,4",
+  sort="-cvss_score",
+  limit=20,
+  advisory_available="true,false"
+)
+```
+
+**After** the dashboard is loaded, get the raw data for further analysis.
 **Example** (most critical, remediatable):
 ```
 vulnerability__get_cves(
@@ -74,11 +98,16 @@ vulnerability__get_cves(
 )
 ```
 
-## Step 4: After Listing
+## Step 4: Present Results
 
+**If the dashboard was successful**, DO NOT PRINT the CVE table, as it's covered in the dashboard. SKIP to the follow-ups.
+**ONLY If the dashboard was NOT successful**:
 - **Parse response** (if needed): Use [references/01-cve-response-parser.py](../references/01-cve-response-parser.py). Do NOT use jq or inline Python. See [02-cve-parsing-guide.md](../references/02-cve-parsing-guide.md).
 - Sort by CVSS score (highest first) or by affected system count
 - Provide summary table: CVE ID, severity, affected systems count, remediation availability
+
+## Step 5: Follow-up
+
 - Offer to analyze a specific CVE (see [SKILL.md](../SKILL.md) — Step 2: CVE Information Retrieval)
 - Offer to create remediation plan (invoke `/remediation` skill)
 

rh-sre/skills/cve-impact/references/flows/02-system-all-cves.md

@@ -2,7 +2,7 @@
 
 **Scope**: devices=selected | severities=all, most critical, or selected | remediation=does not matter
 
-**Tool**: `vulnerability__get_system_cves` (paginated via `limit` + `offset`)
+**Tools**: `vulnerability__get_system_cves` fetching the data for analysis and `vulnerability__load_cve_dashboard` displaying an interactive dashboard
 
 **BLOCKING**: HITL (Step -1 in SKILL.md) MUST be your first action. Reply to the user with the pagination prompt before ANY tool call. Do NOT proceed to this flow until the user has responded to the HITL prompt.
 
@@ -15,10 +15,10 @@
 
 ## Step 1: HITL — Pagination Strategy (Done in SKILL.md Step -1)
 
-**If you have not yet replied to the user with the pagination prompt**: Stop. Go to [SKILL.md](../SKILL.md) Step -1. Your first reply to the user must be the prompt below. Do NOT call `inventory__find_host_by_name` or `vulnerability__get_system_cves` until the user responds.
+**If you have not yet replied to the user with the pagination prompt**: Stop. Go to [SKILL.md](../SKILL.md) Step -1. Your first reply to the user must be the prompt below. Do NOT call `inventory__find_host_by_name`, `vulnerability__load_cve_dashboard`, or `vulnerability__get_system_cves` until the user responds.
 
 ```
-This system may have many CVEs. I will paginate through vulnerability__get_system_cves (limit=100 per page).
+This system may have many CVEs. I will paginate through them (limit=100 per page).
 
 Options:
 - **First page only**: Fetch 100 CVEs, then stop (quick overview)
@@ -48,13 +48,19 @@ How would you like to proceed? (first page / all pages / N pages)
 
 ## Step 4: MCP Tool Invocation
 
-**Tool**: `vulnerability__get_system_cves` (from lightspeed-mcp)
+**Tools**: `vulnerability__load_cve_dashboard` and `vulnerability__get_system_cves` (from lightspeed-mcp)
 
 **Parameters**:
 - `system_uuid`: Required (from Step 2)
 - `limit`: `100` (fewer pages)
 - `offset`: `0`, `100`, `200`, ... per pagination strategy
 
+**Before** continuing further, invoke the dashboard tool to initiate the dashboard, and examine the instruction returning from the tool:
+```
+vulnerability__load_cve_dashboard(system_uuid="<resolved-uuid>", limit=100)
+```
+
+**After** the dashboard is loaded, get the raw data for further analysis.
 **First call** (to get total estimate if available):
 ```
 vulnerability__get_system_cves(system_uuid="<resolved-uuid>", limit=100, offset=0)
@@ -82,8 +88,15 @@ while (strategy allows):
 | most critical | Keep items where severity in (Critical, High) |
 | selected | Keep items matching user-specified severity |
 
-## Step 6: After Retrieval
+## Step 6: Present Results
 
+**If the dashboard was successful**, DO NOT PRINT the CVE table, as it's covered in the dashboard. SKIP to the follow-ups.
+**ONLY If the dashboard was NOT successful**:
 - **Parse response**: Use [references/01-cve-response-parser.py](../references/01-cve-response-parser.py). Do NOT use jq or inline Python. See [02-cve-parsing-guide.md](../references/02-cve-parsing-guide.md).
 - Sort by CVSS score (highest first)
-- Provide summary table; offer to analyze specific CVEs or create remediation plan (`/remediation` skill)
+- Provide summary table
+
+## Step 7: Follow-up
+
+- Offer to analyze a specific CVE (see [SKILL.md](../SKILL.md) — Step 2: CVE Information Retrieval)
+- Offer to create remediation plan (invoke `/remediation` skill)

rh-sre/skills/cve-impact/references/flows/03-system-remediatable-cves.md

@@ -2,7 +2,7 @@
 
 **Scope**: devices=selected | severities=all, most critical, or selected | remediation=available
 
-**Tool**: `vulnerability__get_system_cves` (paginated; filter client-side for `advisory_available === true`)
+**Tools**: `vulnerability__get_system_cves` fetching the data for analysis and `vulnerability__load_cve_dashboard` displaying an interactive dashboard
 
 **BLOCKING**: HITL (Step -1 in SKILL.md) MUST be your first action. Reply to the user with the pagination prompt before ANY tool call. Do NOT proceed to this flow until the user has responded to the HITL prompt.
 
@@ -12,11 +12,11 @@
 - "CVEs with available remediation on device Y"
 - "Which CVEs can I fix on hostname Z?"
 
-**CRITICAL**: `get_system_cves` does NOT support `advisory_available` as a request parameter. We must paginate through ALL CVEs and filter client-side for `attributes.advisory_available === true`. Do NOT use `get_cves` + `get_cve_systems` per CVE—does not scale.
+**CRITICAL**: `get_system_cves` does NOT support `advisory_available` as a request parameter. We must paginate through ALL CVEs and filter client-side for `attributes.advisory_available === true`. `load_cve_dashboard` takes a string `advisory_available`. Do NOT use `get_cves` + `get_cve_systems` per CVE—does not scale.
 
 ## Step 1: HITL — Pagination Strategy (Done in SKILL.md Step -1)
 
-**If you have not yet replied to the user with the pagination prompt**: Stop. Go to [SKILL.md](../SKILL.md) Step -1. Your first reply to the user must be the prompt below. Do NOT call `inventory__find_host_by_name` or `vulnerability__get_system_cves` until the user responds.
+**If you have not yet replied to the user with the pagination prompt**: Stop. Go to [SKILL.md](../SKILL.md) Step -1. Your first reply to the user must be the prompt below. Do NOT call `inventory__find_host_by_name`, `vulnerability__load_cve_dashboard`, or `vulnerability__get_system_cves` until the user responds.
 
 ```
 To fetch remediatable CVEs on this system, I will:
@@ -54,13 +54,20 @@ How would you like to proceed? (first page / all pages / N pages)
 
 ## Step 4: MCP Tool Invocation
 
-**Tool**: `vulnerability__get_system_cves` (from lightspeed-mcp)
+**Tools**: `vulnerability__load_cve_dashboard` and `vulnerability__get_system_cves` (from lightspeed-mcp)
 
 **Parameters**:
 - `system_uuid`: Required (from Step 2)
 - `limit`: `100`
 - `offset`: `0`, `100`, `200`, ... per pagination strategy
+- `advisory_available`: `"true"` - Only exists in `load_cve_dashboard`
 
+**Before** continuing further, invoke the dashboard tool to initiate the dashboard, and examine the instruction returning from the tool:
+```
+vulnerability__load_cve_dashboard(system_uuid="<resolved-uuid>", limit=100, advisory_available="true")
+```
+
+**After** the dashboard is loaded, get the raw data for further analysis.
 **First call** (to get total estimate if available):
 ```
 vulnerability__get_system_cves(system_uuid="<resolved-uuid>", limit=100, offset=0)
@@ -89,8 +96,14 @@ After filtering for remediatable, optionally filter by severity:
 | most critical | Keep items where severity in (Critical, High) |
 | selected | Keep items matching user-specified severity |
 
-## Step 6: After Retrieval
+## Step 6: Present Results
 
+**If the dashboard was successful**, DO NOT PRINT the CVE table, as it's covered in the dashboard. SKIP to the follow-ups.
+**ONLY If the dashboard was NOT successful**:
 - **Parse response**: Use [references/01-cve-response-parser.py](../references/01-cve-response-parser.py) with `FILTER_REMEDIATABLE=1`. Do NOT use jq or inline Python. See [02-cve-parsing-guide.md](../references/02-cve-parsing-guide.md).
 - Sort by CVSS score (highest first)
-- Provide summary table; offer to analyze specific CVEs or create remediation plan (`/remediation` skill)
+
+## Step 7: Follow-up
+
+- Offer to analyze a specific CVE (see [SKILL.md](../SKILL.md) — Step 2: CVE Information Retrieval)
+- Offer to create remediation plan (invoke `/remediation` skill)

rh-sre/skills/fleet-inventory/SKILL.md

@@ -19,7 +19,7 @@ description: |
 model: inherit
 color: blue
 license: Apache-2.0
-allowed-tools: inventory__list_hosts inventory__find_host_by_name inventory__get_host_details inventory__get_host_system_profile vulnerability__get_cve_systems
+allowed-tools: inventory__list_hosts inventory__find_host_by_name inventory__get_host_details inventory__get_host_system_profile inventory__load_inventory_dashboard vulnerability__get_cve_systems
 ---
 
 # Fleet Inventory Skill
@@ -36,6 +36,7 @@ This skill queries Red Hat Lightspeed to retrieve and display information about
 - `inventory__get_host_details` (from lightspeed-mcp) - Retrieve inventory metadata for known host UUIDs
 - `inventory__get_host_system_profile` (from lightspeed-mcp) - Retrieve OS version and system profile when needed
 - `vulnerability__get_cve_systems` (from lightspeed-mcp) - Find CVE-affected systems
+- `inventory__load_inventory_dashboard` (from lightspeed-mcp) - Open the interactive inventory dashboard with query parameters. If the client does not support UI, the tool instructs the model to present the data as text.
 
 **Required Environment Variables**:
 - `LIGHTSPEED_CLIENT_ID` - Red Hat Lightspeed service account client ID
@@ -106,12 +107,14 @@ Proceeding with fleet inventory query...
 1. **Action**: Read [insights-api.md](docs/insights/insights-api.md) using the Read tool to understand `inventory__list_hosts` response format and pagination handling
 2. **Output to user**: "I consulted [insights-api.md](docs/insights/insights-api.md) to understand the `inventory__list_hosts` response format and pagination handling."
 
-**MCP Tool**: `inventory__list_hosts` (from lightspeed-mcp)
+**MCP Tools**: `inventory__load_inventory_dashboard` and `inventory__list_hosts` (from lightspeed-mcp)
 
 **Purpose**: Query Lightspeed for registered hosts. Use for fleet discovery, tag filters, and environment scoping.
 
 **Parameters**: `per_page=10` on first call, then `page` for pagination. Optional filters: `display_name`, `tags`, `staleness`, `hostname_or_id`. See [references/01-parameter-reference.md](references/01-parameter-reference.md).
 
+**Before** continuing further, call `inventory__load_inventory_dashboard(...)` with the same query parameters used in the `list_hosts` call, and examine the instruction returning from the tool.
+
 **Optional enrichment**: After host UUIDs are known:
 - `inventory__get_host_details(host_ids="uuid-1,uuid-2")` — inventory metadata (similar fields to `list_hosts`)
 - `inventory__get_host_system_profile(host_ids="uuid-1")` — OS version and system profile when RHEL version is required (one or two UUIDs at a time; large response)
@@ -173,11 +176,12 @@ Status: "Not Affected"
 → Action: Exclude from affected count
 ```
 
-### Step 4: Generate Fleet Summary
+### Step 4: Present Results
 
-Create organized output. **Read [references/03-output-templates.md](references/03-output-templates.md)** for report format (Overview, RHEL/Environment breakdown, System Details, Stale Systems).
+**If the dashboard was successful**, DO NOT PRINT the inventory table, as it's covered in the dashboard. SKIP to the follow-ups.
+**ONLY If the dashboard was NOT successful**: Create organized output. **Read [references/03-output-templates.md](references/03-output-templates.md)** for report format (Overview, RHEL/Environment breakdown, System Details, Stale Systems).
 
-### Step 5: Offer Remediation Transition
+### Step 5: Follow-up
 
 When appropriate, suggest transitioning to the `/remediation` skill:
 
@@ -224,6 +228,11 @@ Examples:
   - Parameters: `cve` (string, format: CVE-YYYY-NNNNN), `limit`, `offset`
   - Returns: Paginated list of affected systems with vulnerability and remediation status
 
+- `inventory__load_inventory_dashboard` (from lightspeed-mcp) - Open the interactive inventory dashboard
+  - Parameters: Query parameters matching the `list_hosts` call (hostname_or_id, display_name, per_page, etc.)
+  - Returns: Interactive dashboard with host browsing, staleness filters, and system profiles
+  - Falls back to text if unavailable or client does not support UI
+
 ### Related Skills
 - `mcp-lightspeed-validator` - **PREREQUISITE** - Validates Lightspeed MCP server configuration and connectivity
   - Use before: ALL fleet-inventory operations (Step 0 in workflow)