Connect your security and ticket tools

You will send MainSDK's evidence to the tools your security team uses: control results to ServiceNow IRM, one GitHub issue per failure, and the SBOM and VEX to Dependency-Track. It takes about 30 minutes.

You need

• A MainSDK app with secrets, and an assure run to push (a standard and a list of control results).
• A token for each tool, stored as a secret.

1. Declare the connectors

connectors:
  grc:     { driver: servicenow-irm, instance: https://acme.service-now.com, auth: secret:SN_TOKEN }
  vulns:   { driver: dependency-track, url: https://dt.acme.internal, auth: secret:DT_KEY }
  tickets: { driver: github, repo: acme/web, auth: secret:GH_TOKEN }

Always write auth: secret:NAME. A literal token fails mainsdk check.

2. Test them without writing

mainsdk connectors test

Each connector is pinged and nothing is written.

3. Push a run

import { app } from "mainsdk";
import {
  type AssureRun,
  type ConnectorsConfig,
  connectorsFrom,
  httpOver,
  pushAssure,
  syncTickets,
} from "mainsdk/connectors";

const a = app();
const c = connectorsFrom(a.config.connectors as ConnectorsConfig, {
  http: httpOver(fetch),
  secrets: (name) => a.secrets.get(name),
  log: (entry) => a.log.info("connector call", { ...entry }),
});

export async function push(run: AssureRun) {
  if (c.grc) await pushAssure(c.grc, run);
  if (c.tickets) await syncTickets(c.tickets, run, { owner: "web-team" });
}

Running it twice opens each issue once. Pass previous (the controls that failed last time) so a fixed control closes its issue.

4. Send a release

import type { Connector, VexStatement } from "mainsdk/connectors";
import { importFindings, pushRelease } from "mainsdk/connectors";

export async function send(vulns: Connector, sbom: Record<string, unknown>, vex: VexStatement[]) {
  await pushRelease(vulns, { app: "web", release: "1.4.0", sbom, vex });
  return importFindings(vulns, "1.4.0");
}

A CVE the VEX marks not_affected comes back suppressed, with its justification.

Check it worked

• pnpm mainsdk check passes with no MAIN-SECRET-0002 or MAIN-CONNECTOR-0001 finding.
• mainsdk connectors test reports each connector ok.
• The audit log has one line per call, and none holds a token.

If it fails

• MAIN-SECRET-0002: auth is a literal. Move the token to secrets and write secret:NAME.
• MAIN-CONNECTOR-0001: the driver is not one of the listed ones, or the address is not https.
• MAIN-CONNECTOR-0002: the tool refused a call. The audit line names the operation and status.

Prompt for your coding agent

Wire my app's assure results into our tools with MainSDK's connectors interface. Push control results to ServiceNow IRM, open one GitHub issue per failure that closes when fixed, send the SBOM and VEX to Dependency-Track, and keep every token in secrets.