DependencyTrack/dependency-track

Current Behavior For our system we authenticate all connections via oauth2-proxy before they reach the backed. This give us a simple pane of glass when it comes to IT health checks. All authentication for apps that support proxy authentication are done in the same way and we can apply rules to not allow any API traffic without authentication When is comes to application such a dependency track which support the own implementation of OIDC we need to do much more due dilligance to make sure the service complies with our security standards. We have to allow unauthenticated access to the dependency track apis which make our security team nervous. Proposed Behavior Allow Dependency track to support oauth2-proxy so that a user, once authenticate with the gateway, does not have to do any more actions to access the dashboard. Checklist I have read and understand the contributing guidelines I have checked the existing issues for whether this enhancement was already requested

Current Behavior During the work on #7076, it became clear that the VEX ecosystem is not converging on any one standard, but is instead fragmented. Many CLI tools, while offering CycloneDX VEX support, default or recommend OpenVEX. We're missing out on real interop-opportunities by not supporting OpenVEX. An eventual integration of CycloneDX Transparency Exchange API (TEA) will amplify this gap. Proposed Behavior Add the ability to import OpenVEX statements. Export is out of scope for this issue and may be requested separately. Checklist I have read and understand the contributing guidelines I have checked the existing issues for whether this enhancement was already requested

Current Behavior Currently, extracting analytics and performing automated actions in Dependency Track requires either: Manual navigation through the UI, or Writing custom scripts that hit multiple API endpoints and transform data This creates friction for teams wanting to: Generate portfolio-wide reports Perform ad-hoc actions on DT Query security posture using natural language Proposed Behavior Develop an MCP server that wraps Dependency Track's REST API, enabling: Natural language interactions with DT data via LLM tools (Claude, etc.): "Show me all critical vulnerabilities in projects" "Generate a summary of component license risks across the portfolio / particular project/component" "What's the current remediation status for CVE-2024-XXXX?" We already have a rich rest api documentation. Should we create this MCP wrapper? What are the community views? Are there API limitations or security concerns we should address? Model Context Protocol: https://modelcontextprotocol.io/ C