Epic: Bidirectional OWASP Agent with Nest (REST first, MCP second)

What

Ship one OWASP-facing Agent story without two competing chatbots.

Nest already is the community OS (projects, chapters, events, contribute, GSoC, NestBot /ai).
OpenCRE is the knowledge OS (CRE graph, standards, grounded chat).

The split:

Question class	Example	Owner
Community / procedural	“Nearest chapter to Amsterdam?”, “How do I contribute to ZAP?”	Nest /api/v0 (+ later Nest MCP)
Normative / security knowledge	“How should I store passwords?”, “What is in ASVS 2.x?”	OpenCRE REST / MCP, with citations

cc @arkid15r (OWASP Nest) — we want this tightly integrated with Nest, not a second OWASP chatbot.

Why now

• OpenCRE already has MCP v1 (stdio, public GET allowlist) — #1003 / docs/api/mcp.md. Chat (/rest/v1/completion) is still login-gated and not on MCP.
• NestBot /ai RAG indexes project/chapter/event metadata (descriptions, tags, stats), not ASVS/Top 10/Cheat Sheet body text. Its own examples include “What are the OWASP Top 10 vulnerabilities?”
• Rebuilding chapters/events inside OpenCRE would duplicate Nest. Asking NestBot to answer control questions from project cards will hallucinate.

Phasing

Phase 1 — REST (unblocks both bots, no new protocol)

1. OpenCRE chat/agent routes community intents to Nest https://nest.owasp.org/api/v0/ (chapters, events, projects, issues).
2. NestBot /ai routes normative intents to OpenCRE (text_search, CRE lookup, then a cited ask API).

Phase 2 — MCP
3. Nest exposes an MCP over the same /api/v0 tools (stdio and/or HTTP).
4. OpenCRE MCP adds ask (cited completion) + HTTP transport so NestBot/IDEs do not have to spawn our stdio process.

Child tickets

OpenCRE:

• Chat/agent router → Nest APIs
• Cited ask API / MCP tools for NestBot

Nest (opened on OWASP/Nest, same epic):

• Nest MCP wrapping /api/v0
• NestBot /ai calls OpenCRE for security questions

Success

• “I’m in Amsterdam, when is the nearest OWASP meeting?” is answered from Nest data, not CRE.
• “How should I store passwords?” is answered from OpenCRE with CRE + standard citations, not Nest project blurbs.
• November OWASP Agent demo can show both in one shell without pretending either project owns the other’s corpus.

Out of scope

• Merging codebases or auth.
• Dumping the OIE librarian queue into Nest.
• Harvesting Nest GitHub issues into CRE.
• Weakening /rest/v1/completion login (Nest gets a service contract, not an anon spend bypass).

Context

• Nest: https://github.com/OWASP/Nest · https://nest.owasp.org · REST /api/v0/ (API key, OpenAPI)
• OpenCRE MCP v1: application/mcp/, #1003
• Related internal note: Nest RAG entity types are chapter | committee | event | message | project only

Start with docs/api/mcp.md and the application/mcp/ directory to understand the existing MCP v1 surface. Then inspect the /rest/v1/completion entry point and Nest's /api/v0 contract. Done means the child tickets can be implemented and the stated community-routing, cited security answers, and two-bot demo scenarios work without weakening authentication.