Endor Labs Direct API Access

Execute custom queries against the Endor Labs API.

API Endpoints

Base URL: https://api.endorlabs.com

Workflow

Step 1: Understand the Query

Parse the user's request for:

1. Resource type: findings, projects, packages, metrics, etc.
2. Filter: severity, category, package, date, etc.
3. Output: what data to return

Step 2: Execute Query

MCP Tools (preferred):

CLI (for operations not covered by MCP):

npx -y endorctl api list --resource {Resource} -n $ENDOR_NAMESPACE --filter "{filter}" 2>/dev/null
npx -y endorctl api get --resource {Resource} -n $ENDOR_NAMESPACE --uuid {uuid} 2>/dev/null
npx -y endorctl api create --resource {Resource} -n $ENDOR_NAMESPACE --data '{json}' 2>/dev/null

For CLI parsing gotchas, read references/cli-parsing.md.

Common Resource Types: Finding, Project, PackageVersion, DependencyMetadata, FindingPolicy, ExceptionPolicy, RepositoryScan

Step 3: Filter Syntax

field==value                          # Equality
field contains value                  # Contains
field not contains value              # Not contains
field1==value1 and field2==value2     # AND
field in [value1, value2]             # In list
field > value / field < value         # Comparison

Filter examples:

# Critical reachable vulnerabilities
--filter "spec.level==FINDING_LEVEL_CRITICAL and spec.finding_tags contains FINDING_TAGS_REACHABLE_FUNCTION"

# Findings for a project
--filter "spec.project_uuid=={project_uuid}"

# Projects by name
--filter "meta.name contains '{name}'"

# Package metrics (use oss namespace)
npx -y endorctl api list --resource Metric -n oss \
  --filter "meta.name==package_version_scorecard and meta.parent_uuid=={pkg_uuid}" 2>/dev/null

Step 4: Present Results

## API Query Results

**Resource:** {resource_type}
**Filter:** {filter}
**Results:** {count}

### Data

{Formatted table or structured output}

For Finding field paths, read references/cli-parsing.md.

For data source policy, read references/data-sources.md.

Error Handling

Safety

• Read operations (list/get) by default
• Create/update/delete require explicit user confirmation
• Never pass sensitive data in filter strings