investigate-package
Investigate package origin
What this does
Answers why a package exists on an image and whether "installed" means "reachable." The workflow ties SubImage's vulnerability/package tools to graph evidence: package node, affected image, exact image layer, layer history, and source repo or lockfile clues.
When to use
✅ User asks where a package came from after a CVE or Issue triage. ✅ User asks whether a vulnerable package is from the base image, parent image, runtime tooling, or app dependencies. ✅ User asks whether software being present on an image makes it exploitable. ✅ User gives a package name/version, image digest/tag, CVE id, or SubImage Issue URL and wants to identify where the package came from.
❌ User only wants a CVE impact summary: use subimage-mcp:investigate-cve.
❌ User only wants where an image runs: use subimage-mcp:investigate-container.
❌ User wants a free-form graph query unrelated to packages or layers: use subimage-mcp:build-cypher-query.