@borgresearch/odin-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Borg Research
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,206 @@
+# @borgresearch/odin-mcp
+
+[Model Context Protocol](https://modelcontextprotocol.io) server for the [Odin](https://odin.borghq.io) security platform by Borg. Lets coding agents query findings, pentests, and attack-surface assets — and transition findings between in-progress states — directly from your editor or chat tool.
+
+## Prerequisites
+
+- Node.js 22 or newer.
+- An Odin account with at least one organisation.
+- An Odin API key (see [Quick start](#quick-start)). `read` permission is enough for every tool except `update_finding_status`, which needs `write` plus the `member` role.
+
+## Quick start
+
+1. **Create an API key.** Sign in to <https://odin.borghq.io>, open **Management > API Keys**, click **Create key**, and pick the permissions you need (`read`, or `read` + `write` if you want the agent to update findings). Copy the full key — it is shown once.
+2. **Add the server to your client.** Pick your tool below and paste the JSON snippet. Replace `odin_...` with the key you just copied.
+3. **Verify.** Restart the client, list its connected MCP servers, and confirm `odin` appears with the seven tools listed in [Tools](#tools). A first prompt like _"List my critical findings from the latest pentest"_ should return real data.
+
+```sh
+ODIN_API_KEY=odin_... npx @borgresearch/odin-mcp
+```
+
+You can also install globally:
+
+```sh
+npm install -g @borgresearch/odin-mcp
+ODIN_API_KEY=odin_... odin-mcp
+```
+
+## Configuration
+
+| Variable | Required | Notes |
+|----------|----------|-------|
+| `ODIN_API_KEY` | yes | API key with at least `read` permission. `write` is required for `update_finding_status`. |
+
+Each call sends `Authorization: Bearer ${ODIN_API_KEY}`. Keys are organisation-scoped; if you belong to multiple organisations, create one key per organisation and run a separate MCP server entry for each.
+
+## Tools
+
+All tools accept a single JSON object and return both a markdown summary (for the agent to read) and a structured payload (for the agent to act on).
+
+| Name | Permission | Description |
+|------|------------|-------------|
+| `list_findings` | `read` | List findings, optionally filtered by pentest, asset, severity, status, or search term. Paginated. |
+| `get_finding` | `read` | Fetch a single finding with its latest revision (summary, description, impact, details, remediation, affected assets). |
+| `update_finding_status` | `write`, `member` role | Transition a finding to `MITIGATING` (you are working on the fix) or `OPEN_FOR_RETEST` (the fix is ready). |
+| `list_pentests` | `read` | List all pentests for the organisation, with status and scheduled window. |
+| `get_pentest` | `read` | Fetch a single pentest with status, schedule, and in-scope targets. |
+| `list_assets` | `read` | List attack-surface assets, optionally filtered by type, source, dynamic status, or search term. Paginated. |
+| `get_asset` | `read` | Fetch a single asset with the findings that reference it in their latest revision. |
+
+### Tool parameters and examples
+
+#### `list_findings`
+
+`pentestId?`, `assetId?`, `severity?` (`CRITICAL` \| `HIGH` \| `MEDIUM` \| `LOW` \| `INFORMATIONAL`), `status?`, `search?`, `sortBy?` (`severity` \| `createdAt`), `sortOrder?`, `limit?` (1–200, default 50), `offset?`.
+
+> _"Show me the open critical and high findings from pentest `p_abc123`."_
+> _"Search my findings for anything mentioning `S3`."_
+
+#### `get_finding`
+
+`findingId` (required).
+
+> _"What are the remediation steps for finding `f_abc123`?"_
+
+#### `update_finding_status`
+
+`findingId` (required), `status` (`MITIGATING` \| `OPEN_FOR_RETEST`).
+
+> _"I've started working on `f_abc123`, mark it as mitigating."_
+> _"I've fixed `f_abc123`, mark it ready for retest."_
+
+Other transitions (`RESOLVED`, `ACCEPTED_RISK`, etc.) are reserved for the operations team and are intentionally not writable from the API.
+
+#### `list_pentests` / `get_pentest`
+
+`list_pentests` takes no parameters. `get_pentest` requires `pentestId`.
+
+> _"What's in scope for pentest `p_xyz`?"_
+> _"List all my pentests scheduled this quarter."_
+
+#### `list_assets`
+
+`type?` (`DOMAIN` \| `SUBDOMAIN` \| `IP` \| `URL` \| `WILDCARD`), `source?` (`MANUAL` \| `RECON` \| `IMPORT` \| `AGENT`), `status?`, `search?`, `sortBy?`, `sortOrder?`, `limit?` (1–100, default 50), `offset?`.
+
+> _"List subdomains discovered by recon."_
+> _"Which manually added domains are currently down?"_
+
+#### `get_asset`
+
+`assetId` (required).
+
+> _"Summarise findings affecting `api.example.com` and group them by severity."_
+
+## Use with Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "odin": {
+      "command": "npx",
+      "args": ["-y", "@borgresearch/odin-mcp"],
+      "env": {
+        "ODIN_API_KEY": "odin_..."
+      }
+    }
+  }
+}
+```
+
+## Use with Claude Code
+
+```sh
+claude mcp add odin --env ODIN_API_KEY=odin_... -- npx -y @borgresearch/odin-mcp
+```
+
+## Use with Cursor
+
+Open **Settings > MCP** and add a new server, or add the following to your project's `.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "odin": {
+      "command": "npx",
+      "args": ["-y", "@borgresearch/odin-mcp"],
+      "env": {
+        "ODIN_API_KEY": "odin_..."
+      }
+    }
+  }
+}
+```
+
+## Use with Windsurf
+
+Add the following to `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "odin": {
+      "command": "npx",
+      "args": ["-y", "@borgresearch/odin-mcp"],
+      "env": {
+        "ODIN_API_KEY": "odin_..."
+      }
+    }
+  }
+}
+```
+
+## Use with VS Code (GitHub Copilot)
+
+Add the following to your project's `.vscode/mcp.json`:
+
+```json
+{
+  "servers": {
+    "odin": {
+      "command": "npx",
+      "args": ["-y", "@borgresearch/odin-mcp"],
+      "env": {
+        "ODIN_API_KEY": "odin_..."
+      }
+    }
+  }
+}
+```
+
+## Use with Cline
+
+Open **Settings > MCP Servers > Edit MCP Settings** and add:
+
+```json
+{
+  "mcpServers": {
+    "odin": {
+      "command": "npx",
+      "args": ["-y", "@borgresearch/odin-mcp"],
+      "env": {
+        "ODIN_API_KEY": "odin_..."
+      }
+    }
+  }
+}
+```
+
+## Troubleshooting
+
+**`ODIN_API_KEY is not set or invalid`** — the environment variable is missing or the key has been revoked. Confirm the key still exists at **Management > API Keys** and that your client config sets `env.ODIN_API_KEY`. Most clients require a full restart after editing config files.
+
+**`API key does not have write permission`** — the call was `update_finding_status` but the key only has `read`. Create a new key with both `read` and `write`, or ask an admin to do it for you.
+
+**`Finding not found`** — the finding ID does not belong to the organisation the API key is scoped to. Keys are organisation-scoped; if you have multiple organisations, create one key per organisation and configure them as separate MCP servers (e.g. `odin-acme`, `odin-personal`).
+
+**`Rate limit exceeded. Try again in N seconds`** — the API allows 100 requests per minute per key. The error message includes the wait time. If you hit this often, batch your queries (use `list_findings` with filters instead of many `get_finding` calls).
+
+**The server starts but no tools appear in the client** — check the client's MCP logs. Most clients require Node.js 22+ on `PATH`; verify with `node --version`. If you use `nvm` or `fnm`, your client may not pick up the active version — point `command` at an absolute path to a Node 22 binary.
+
+**Inspecting tool calls locally** — clone the [borg-platform repo](https://github.com/BorgDevelopment/borg-platform), run `pnpm build` then `pnpm inspect` from `frontend/packages/odin-mcp` to launch the MCP Inspector against your local build.
+
+## License
+
+UNLICENSED. This package is published for use with the Odin platform; redistribution is not permitted.

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/index.js

@@ -0,0 +1,561 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/client.ts
+var OdinApiError = class extends Error {
+  status;
+  path;
+  method;
+  retryAfterSeconds;
+  body;
+  constructor(params) {
+    super(params.message);
+    this.name = "OdinApiError";
+    this.status = params.status;
+    this.path = params.path;
+    this.method = params.method;
+    this.retryAfterSeconds = params.retryAfterSeconds;
+    this.body = params.body;
+  }
+};
+var DEFAULT_ODIN_BASE_URL = "https://odin.borghq.io";
+var WRITE_METHODS = /* @__PURE__ */ new Set(["PATCH", "POST", "PUT", "DELETE"]);
+var OdinClient = class {
+  baseUrl;
+  apiKey;
+  fetchImpl;
+  constructor(options) {
+    if (!options.apiKey) {
+      throw new Error("OdinClient requires an apiKey");
+    }
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_ODIN_BASE_URL).replace(
+      /\/+$/,
+      ""
+    );
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async get(path, searchParams) {
+    const url = this.buildUrl(path, searchParams);
+    return this.request("GET", url, path);
+  }
+  async patch(path, body) {
+    const url = this.buildUrl(path);
+    return this.request("PATCH", url, path, body);
+  }
+  async post(path, body) {
+    const url = this.buildUrl(path);
+    return this.request("POST", url, path, body);
+  }
+  buildUrl(path, searchParams) {
+    const url = new URL(path.startsWith("/") ? path : `/${path}`, this.baseUrl);
+    if (searchParams) {
+      for (const [key, value] of Object.entries(searchParams)) {
+        if (value === void 0 || value === "") continue;
+        url.searchParams.set(key, String(value));
+      }
+    }
+    return url.toString();
+  }
+  async request(method, url, path, body) {
+    const response = await this.fetchImpl(url, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    const rawText = await response.text();
+    const parsed = rawText ? safeJsonParse(rawText) : null;
+    if (!response.ok) {
+      const retryAfterSeconds = parseRetryAfter(
+        response.headers.get("Retry-After")
+      );
+      throw new OdinApiError({
+        status: response.status,
+        path,
+        method,
+        retryAfterSeconds,
+        body: parsed ?? rawText,
+        message: formatErrorMessage({
+          status: response.status,
+          method,
+          path,
+          retryAfterSeconds,
+          parsed,
+          rawText
+        })
+      });
+    }
+    return parsed;
+  }
+};
+function safeJsonParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function parseRetryAfter(header) {
+  if (!header) return null;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);
+  const dateMs = Date.parse(trimmed);
+  if (Number.isNaN(dateMs)) return null;
+  const seconds = Math.ceil((dateMs - Date.now()) / 1e3);
+  return seconds > 0 ? seconds : null;
+}
+function formatErrorMessage(input) {
+  const serverMessage = extractServerMessage(input.parsed);
+  const actionable = actionableMessage(input);
+  if (actionable) {
+    return serverMessage ? `${actionable} (server: ${serverMessage})` : actionable;
+  }
+  const suffix = serverMessage ? ` \u2014 ${serverMessage}` : input.rawText ? ` \u2014 ${input.rawText.slice(0, 200)}` : "";
+  return `Odin API ${input.status} on ${input.path}${suffix}.`;
+}
+function actionableMessage(input) {
+  switch (input.status) {
+    case 401:
+      return "ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard.";
+    case 403:
+      if (WRITE_METHODS.has(input.method)) {
+        return "API key does not have write permission. Create a new key with 'Read & Write' permissions.";
+      }
+      return null;
+    case 404:
+      if (isFindingDetailPath(input.path)) {
+        return "Finding not found. Check the finding ID is correct.";
+      }
+      return null;
+    case 429: {
+      const n = input.retryAfterSeconds;
+      return n ? `Rate limit exceeded. Try again in ${n} seconds.` : "Rate limit exceeded. Try again shortly.";
+    }
+    default:
+      return null;
+  }
+}
+function isFindingDetailPath(path) {
+  return /^\/api\/findings\/[^/]+(\/.*)?$/.test(path);
+}
+function extractServerMessage(parsed) {
+  if (parsed && typeof parsed === "object" && "error" in parsed) {
+    const err = parsed.error;
+    if (typeof err === "string") return err;
+  }
+  return null;
+}
+
+// src/tools/get-asset.ts
+import { z } from "zod";
+
+// src/formatters/markdown.ts
+function formatFindingsList(data) {
+  const { findings, stats, pagination } = data;
+  if (findings.length === 0) {
+    return "No findings match the supplied filters.";
+  }
+  const rows = findings.map((f) => {
+    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;
+    return `| ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${f.status} | ${formatDate(f.createdAt)} |`;
+  });
+  return [
+    `Showing ${findings.length} of ${stats.total} finding(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
+    "",
+    "| Finding ID | Title | Severity | Status | Created |",
+    "| --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatFindingDetail(data) {
+  const { finding, revision } = data;
+  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;
+  const header = [
+    `# ${finding.title}`,
+    "",
+    `- **ID:** ${finding.findingId}`,
+    `- **Severity:** ${severity}`,
+    `- **Status:** ${finding.status}`,
+    `- **Pentest:** ${finding.context?.pentestId ?? "standalone"}`,
+    `- **Created:** ${formatDate(finding.createdAt)}`,
+    `- **Updated:** ${formatDate(finding.updatedAt)}`
+  ];
+  if (!revision) {
+    return [...header, "", "_No revision content available._"].join("\n");
+  }
+  const c = revision.content;
+  const sections = [];
+  if (c.summaryMd) sections.push("## Summary", c.summaryMd);
+  if (c.descriptionMd) sections.push("## Description", c.descriptionMd);
+  if (c.businessImpactMd)
+    sections.push("## Business Impact", c.businessImpactMd);
+  if (c.detailsMd) sections.push("## Details", c.detailsMd);
+  if (c.remediationMd) sections.push("## Remediation", c.remediationMd);
+  if (c.affectedAssets?.length) {
+    sections.push(
+      "## Affected Assets",
+      c.affectedAssets.map((a) => `- ${a.display} (${a.assetId})`).join("\n")
+    );
+  }
+  return [
+    ...header,
+    "",
+    `_Revision ${revision.revisionNumber}_`,
+    "",
+    ...sections
+  ].join("\n");
+}
+function formatFindingStatusUpdate(finding) {
+  return [
+    `Updated finding **${finding.findingId}** status to **${finding.status}**.`,
+    `Title: ${finding.title}`
+  ].join("\n");
+}
+function formatPentestsList(data) {
+  if (data.pentests.length === 0) return "No pentests found.";
+  const rows = data.pentests.map(formatPentestRow);
+  return [
+    "| Pentest ID | Name | Status | Start | End | Scope |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatPentestDetail(data) {
+  const p = data.pentest;
+  const end = p.endAt ? formatDate(p.endAt) : "open";
+  const scope = p.scope.length ? p.scope.map((s) => `- ${s}`).join("\n") : "_No scope defined._";
+  return [
+    `# ${p.name}`,
+    "",
+    `- **ID:** ${p.pentestId}`,
+    `- **Status:** ${p.status}`,
+    `- **Start:** ${formatDate(p.startAt)}`,
+    `- **End:** ${end}`,
+    `- **Created:** ${formatDate(p.createdAt)}`,
+    "",
+    "## Scope",
+    "",
+    scope
+  ].join("\n");
+}
+function formatPentestRow(p) {
+  const end = p.endAt ? formatDate(p.endAt) : "open";
+  const scope = p.scope.slice(0, 3).join(", ") + (p.scope.length > 3 ? ", \u2026" : "");
+  return `| ${p.pentestId} | ${escapePipes(p.name)} | ${p.status} | ${formatDate(p.startAt)} | ${end} | ${escapePipes(scope)} |`;
+}
+function formatAssetsList(data) {
+  const { assets, stats, pagination } = data;
+  if (assets.length === 0) return "No assets match the supplied filters.";
+  const rows = assets.map(formatAssetRow);
+  return [
+    `Showing ${assets.length} of ${stats.total} asset(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
+    "",
+    "| Asset ID | Type | Value | Source | Status | Last seen |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatAssetDetail(data) {
+  const { asset, findings } = data;
+  const header = [
+    `# ${asset.value}`,
+    "",
+    `- **ID:** ${asset.assetId}`,
+    `- **Type:** ${asset.type}`,
+    `- **Source:** ${asset.source}`,
+    `- **Status:** ${asset.status}`,
+    `- **Last seen:** ${formatDate(asset.lastSeenAt)}`,
+    `- **Created:** ${formatDate(asset.createdAt)}`
+  ];
+  if (findings.length === 0) {
+    return [...header, "", "_No findings reference this asset._"].join("\n");
+  }
+  const rows = findings.map((f) => {
+    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;
+    return `| ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${f.status} | ${formatDate(f.createdAt)} |`;
+  });
+  return [
+    ...header,
+    "",
+    `## Findings (${findings.length})`,
+    "",
+    "| Finding ID | Title | Severity | Status | Created |",
+    "| --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatAssetRow(a) {
+  return `| ${a.assetId} | ${a.type} | ${escapePipes(a.value)} | ${a.source} | ${a.status} | ${formatDate(a.lastSeenAt)} |`;
+}
+function escapePipes(value) {
+  return value.replace(/\|/g, "\\|");
+}
+function formatDate(epoch) {
+  if (!epoch) return "\u2014";
+  const ms = epoch < 1e12 ? epoch * 1e3 : epoch;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+// src/tools/get-asset.ts
+var getAssetInput = z.object({
+  assetId: z.string().min(1)
+});
+var getAssetTool = {
+  name: "get_asset",
+  title: "Get asset",
+  description: "Fetch a single attack-surface asset by ID, including the findings that reference it in their latest revision.",
+  inputSchema: getAssetInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      `/api/assets/${encodeURIComponent(params.assetId)}`
+    );
+    return {
+      markdown: formatAssetDetail(data),
+      structured: { asset: data.asset, findings: data.findings }
+    };
+  }
+};
+
+// src/tools/get-finding.ts
+import { z as z2 } from "zod";
+var getFindingInput = z2.object({
+  findingId: z2.string().min(1)
+});
+var getFindingTool = {
+  name: "get_finding",
+  title: "Get finding",
+  description: "Fetch a single finding by ID, including the latest revision content (description, impact, details, remediation).",
+  inputSchema: getFindingInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      `/api/findings/${encodeURIComponent(params.findingId)}`
+    );
+    return {
+      markdown: formatFindingDetail(data),
+      structured: {
+        finding: data.finding,
+        revision: data.revision
+      }
+    };
+  }
+};
+
+// src/tools/get-pentest.ts
+import { z as z3 } from "zod";
+var getPentestInput = z3.object({
+  pentestId: z3.string().min(1)
+});
+var getPentestTool = {
+  name: "get_pentest",
+  title: "Get pentest",
+  description: "Fetch a single pentest by ID, including status, scheduled window, and in-scope targets.",
+  inputSchema: getPentestInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      `/api/pentests/${encodeURIComponent(params.pentestId)}`
+    );
+    return {
+      markdown: formatPentestDetail(data),
+      structured: { pentest: data.pentest }
+    };
+  }
+};
+
+// src/tools/list-assets.ts
+import { z as z4 } from "zod";
+var listAssetsInput = z4.object({
+  type: z4.enum(["DOMAIN", "SUBDOMAIN", "IP", "URL", "WILDCARD"]).optional(),
+  source: z4.enum(["MANUAL", "RECON", "IMPORT", "AGENT"]).optional(),
+  status: z4.string().optional().describe(
+    "Dynamic asset status set by recon (e.g. ACTIVE, INACTIVE, TLS_ERROR)."
+  ),
+  search: z4.string().optional(),
+  sortBy: z4.enum(["lastSeenAt", "createdAt", "value"]).optional(),
+  sortOrder: z4.enum(["asc", "desc"]).optional(),
+  limit: z4.number().int().min(1).max(100).optional().default(50),
+  offset: z4.number().int().min(0).optional().default(0)
+});
+var listAssetsTool = {
+  name: "list_assets",
+  title: "List assets",
+  description: "List attack-surface assets for the organisation. Supports filtering by type, source, status, and free-text search.",
+  inputSchema: listAssetsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get("/api/assets", params);
+    return {
+      markdown: formatAssetsList(data),
+      structured: {
+        assets: data.assets,
+        stats: data.stats,
+        pagination: data.pagination
+      }
+    };
+  }
+};
+
+// src/tools/list-findings.ts
+import { z as z5 } from "zod";
+var listFindingsInput = z5.object({
+  pentestId: z5.string().optional().describe("Filter to a single pentest."),
+  assetId: z5.string().optional().describe(
+    "Filter to findings whose latest revision references this asset."
+  ),
+  severity: z5.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFORMATIONAL"]).optional(),
+  status: z5.enum([
+    "DRAFT",
+    "IN_REVIEW",
+    "REPORTED",
+    "MITIGATING",
+    "OPEN_FOR_RETEST",
+    "RESOLVED",
+    "NOT_REPRODUCIBLE",
+    "ACCEPTED_RISK"
+  ]).optional(),
+  search: z5.string().optional().describe("Free-text search on finding titles."),
+  sortBy: z5.enum(["severity", "createdAt"]).optional(),
+  sortOrder: z5.enum(["asc", "desc"]).optional(),
+  limit: z5.number().int().min(1).max(200).optional().default(50),
+  offset: z5.number().int().min(0).optional().default(0)
+});
+var listFindingsTool = {
+  name: "list_findings",
+  title: "List findings",
+  description: "List security findings for the organisation. Supports filtering by pentest, severity, status, and free-text search.",
+  inputSchema: listFindingsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      "/api/findings",
+      params
+    );
+    return {
+      markdown: formatFindingsList(data),
+      structured: {
+        findings: data.findings,
+        stats: data.stats,
+        pagination: data.pagination
+      }
+    };
+  }
+};
+
+// src/tools/list-pentests.ts
+import { z as z6 } from "zod";
+var listPentestsInput = z6.object({});
+var listPentestsTool = {
+  name: "list_pentests",
+  title: "List pentests",
+  description: "List all pentests for the organisation, including status, scheduled window, and in-scope targets.",
+  inputSchema: listPentestsInput,
+  handler: (client) => async () => {
+    const data = await client.get("/api/pentests");
+    return {
+      markdown: formatPentestsList(data),
+      structured: { pentests: data.pentests }
+    };
+  }
+};
+
+// src/tools/update-finding-status.ts
+import { z as z7 } from "zod";
+var updateFindingStatusInput = z7.object({
+  findingId: z7.string().min(1),
+  status: z7.enum(["MITIGATING", "OPEN_FOR_RETEST", "ACKNOWLEDGED"]).describe(
+    "Target status. Only MITIGATING, OPEN_FOR_RETEST, and ACKNOWLEDGED are client-writable; transitions are only allowed from REPORTED, MITIGATING, or OPEN_FOR_RETEST. ACKNOWLEDGED marks the finding as accepted-risk and is terminal."
+  )
+});
+var updateFindingStatusTool = {
+  name: "update_finding_status",
+  title: "Update finding status",
+  description: "Change a finding's status. Requires an API key with write permission and member role. Only MITIGATING, OPEN_FOR_RETEST, and ACKNOWLEDGED are accepted.",
+  inputSchema: updateFindingStatusInput,
+  handler: (client) => async (params) => {
+    const data = await client.patch(
+      `/api/findings/${encodeURIComponent(params.findingId)}/status`,
+      { status: params.status }
+    );
+    return {
+      markdown: formatFindingStatusUpdate(data.finding),
+      structured: { finding: data.finding }
+    };
+  }
+};
+
+// src/index.ts
+var PACKAGE_VERSION = "0.1.0";
+async function main() {
+  const apiKey = process.env.ODIN_API_KEY;
+  if (!apiKey) {
+    console.error(
+      "ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard."
+    );
+    process.exit(1);
+  }
+  const baseUrl = process.env.ODIN_BASE_URL ?? DEFAULT_ODIN_BASE_URL;
+  const client = new OdinClient({ apiKey, baseUrl });
+  const server = new McpServer({
+    name: "@borgresearch/odin-mcp",
+    version: PACKAGE_VERSION
+  });
+  const tools = [
+    listFindingsTool,
+    getFindingTool,
+    updateFindingStatusTool,
+    listPentestsTool,
+    getPentestTool,
+    listAssetsTool,
+    getAssetTool
+  ];
+  for (const tool of tools) {
+    const run = tool.handler(client);
+    server.registerTool(
+      tool.name,
+      {
+        title: tool.title,
+        description: tool.description,
+        inputSchema: tool.inputSchema.shape
+      },
+      async (params) => {
+        try {
+          const { markdown, structured } = await run(params);
+          return {
+            content: [{ type: "text", text: markdown }],
+            structuredContent: { markdown, ...toObject(structured) }
+          };
+        } catch (error) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: toErrorMessage(error) }]
+          };
+        }
+      }
+    );
+  }
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error(
+    `odin-mcp ${PACKAGE_VERSION} connected (baseUrl=${baseUrl}, tools=${tools.length}).`
+  );
+}
+function toObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return { data: value };
+}
+function toErrorMessage(error) {
+  if (error instanceof OdinApiError) return error.message;
+  if (error instanceof Error) return `Unexpected error: ${error.message}`;
+  return `Unexpected error: ${String(error)}`;
+}
+main().catch((error) => {
+  console.error("odin-mcp failed to start:", error);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/tools/get-asset.ts","../src/formatters/markdown.ts","../src/tools/get-finding.ts","../src/tools/get-pentest.ts","../src/tools/list-assets.ts","../src/tools/list-findings.ts","../src/tools/list-pentests.ts","../src/tools/update-finding-status.ts"],"sourcesContent":["import { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { DEFAULT_ODIN_BASE_URL, OdinApiError, OdinClient } from \"./client.js\";\nimport { getAssetTool } from \"./tools/get-asset.js\";\nimport { getFindingTool } from \"./tools/get-finding.js\";\nimport { getPentestTool } from \"./tools/get-pentest.js\";\nimport { listAssetsTool } from \"./tools/list-assets.js\";\nimport { listFindingsTool } from \"./tools/list-findings.js\";\nimport { listPentestsTool } from \"./tools/list-pentests.js\";\nimport { updateFindingStatusTool } from \"./tools/update-finding-status.js\";\n\nconst PACKAGE_VERSION = \"0.1.0\";\n\ninterface ToolResult {\n  markdown: string;\n  structured: unknown;\n}\n\nasync function main() {\n  const apiKey = process.env.ODIN_API_KEY;\n  if (!apiKey) {\n    console.error(\n      \"ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard.\",\n    );\n    process.exit(1);\n  }\n\n  const baseUrl = process.env.ODIN_BASE_URL ?? DEFAULT_ODIN_BASE_URL;\n  const client = new OdinClient({ apiKey, baseUrl });\n\n  const server = new McpServer({\n    name: \"@borgresearch/odin-mcp\",\n    version: PACKAGE_VERSION,\n  });\n\n  const tools = [\n    listFindingsTool,\n    getFindingTool,\n    updateFindingStatusTool,\n    listPentestsTool,\n    getPentestTool,\n    listAssetsTool,\n    getAssetTool,\n  ];\n\n  for (const tool of tools) {\n    const run = tool.handler(client) as (\n      params: unknown,\n    ) => Promise<ToolResult>;\n    server.registerTool(\n      tool.name,\n      {\n        title: tool.title,\n        description: tool.description,\n        inputSchema: tool.inputSchema.shape,\n      },\n      async (params: unknown) => {\n        try {\n          const { markdown, structured } = await run(params);\n          return {\n            content: [{ type: \"text\" as const, text: markdown }],\n            structuredContent: { markdown, ...toObject(structured) },\n          };\n        } catch (error) {\n          return {\n            isError: true,\n            content: [{ type: \"text\" as const, text: toErrorMessage(error) }],\n          };\n        }\n      },\n    );\n  }\n\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n  console.error(\n    `odin-mcp ${PACKAGE_VERSION} connected (baseUrl=${baseUrl}, tools=${tools.length}).`,\n  );\n}\n\nfunction toObject(value: unknown): Record<string, unknown> {\n  if (value && typeof value === \"object\" && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  return { data: value };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof OdinApiError) return error.message;\n  if (error instanceof Error) return `Unexpected error: ${error.message}`;\n  return `Unexpected error: ${String(error)}`;\n}\n\nmain().catch((error) => {\n  console.error(\"odin-mcp failed to start:\", error);\n  process.exit(1);\n});\n","export class OdinApiError extends Error {\n  readonly status: number;\n  readonly path: string;\n  readonly method: string;\n  readonly retryAfterSeconds: number | null;\n  readonly body: unknown;\n\n  constructor(params: {\n    status: number;\n    path: string;\n    method: string;\n    retryAfterSeconds: number | null;\n    body: unknown;\n    message: string;\n  }) {\n    super(params.message);\n    this.name = \"OdinApiError\";\n    this.status = params.status;\n    this.path = params.path;\n    this.method = params.method;\n    this.retryAfterSeconds = params.retryAfterSeconds;\n    this.body = params.body;\n  }\n}\n\nexport interface OdinClientOptions {\n  apiKey: string;\n  baseUrl?: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport const DEFAULT_ODIN_BASE_URL = \"https://odin.borghq.io\";\n\nconst WRITE_METHODS = new Set([\"PATCH\", \"POST\", \"PUT\", \"DELETE\"]);\n\nexport class OdinClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(options: OdinClientOptions) {\n    if (!options.apiKey) {\n      throw new Error(\"OdinClient requires an apiKey\");\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = (options.baseUrl ?? DEFAULT_ODIN_BASE_URL).replace(\n      /\\/+$/,\n      \"\",\n    );\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  async get<T>(\n    path: string,\n    searchParams?: Record<string, string | number | undefined>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, searchParams);\n    return this.request<T>(\"GET\", url, path);\n  }\n\n  async patch<T>(path: string, body: unknown): Promise<T> {\n    const url = this.buildUrl(path);\n    return this.request<T>(\"PATCH\", url, path, body);\n  }\n\n  async post<T>(path: string, body: unknown): Promise<T> {\n    const url = this.buildUrl(path);\n    return this.request<T>(\"POST\", url, path, body);\n  }\n\n  private buildUrl(\n    path: string,\n    searchParams?: Record<string, string | number | undefined>,\n  ): string {\n    const url = new URL(path.startsWith(\"/\") ? path : `/${path}`, this.baseUrl);\n    if (searchParams) {\n      for (const [key, value] of Object.entries(searchParams)) {\n        if (value === undefined || value === \"\") continue;\n        url.searchParams.set(key, String(value));\n      }\n    }\n    return url.toString();\n  }\n\n  private async request<T>(\n    method: string,\n    url: string,\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const response = await this.fetchImpl(url, {\n      method,\n      headers: {\n        Authorization: `Bearer ${this.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n    });\n\n    const rawText = await response.text();\n    const parsed = rawText ? safeJsonParse(rawText) : null;\n\n    if (!response.ok) {\n      const retryAfterSeconds = parseRetryAfter(\n        response.headers.get(\"Retry-After\"),\n      );\n      throw new OdinApiError({\n        status: response.status,\n        path,\n        method,\n        retryAfterSeconds,\n        body: parsed ?? rawText,\n        message: formatErrorMessage({\n          status: response.status,\n          method,\n          path,\n          retryAfterSeconds,\n          parsed,\n          rawText,\n        }),\n      });\n    }\n\n    return parsed as T;\n  }\n}\n\nfunction safeJsonParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction parseRetryAfter(header: string | null): number | null {\n  if (!header) return null;\n  const trimmed = header.trim();\n  if (/^\\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);\n  const dateMs = Date.parse(trimmed);\n  if (Number.isNaN(dateMs)) return null;\n  const seconds = Math.ceil((dateMs - Date.now()) / 1000);\n  return seconds > 0 ? seconds : null;\n}\n\ninterface FormatErrorInput {\n  status: number;\n  method: string;\n  path: string;\n  retryAfterSeconds: number | null;\n  parsed: unknown;\n  rawText: string;\n}\n\nfunction formatErrorMessage(input: FormatErrorInput): string {\n  const serverMessage = extractServerMessage(input.parsed);\n  const actionable = actionableMessage(input);\n  if (actionable) {\n    return serverMessage\n      ? `${actionable} (server: ${serverMessage})`\n      : actionable;\n  }\n  const suffix = serverMessage\n    ? ` — ${serverMessage}`\n    : input.rawText\n      ? ` — ${input.rawText.slice(0, 200)}`\n      : \"\";\n  return `Odin API ${input.status} on ${input.path}${suffix}.`;\n}\n\nfunction actionableMessage(input: FormatErrorInput): string | null {\n  switch (input.status) {\n    case 401:\n      return \"ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard.\";\n    case 403:\n      if (WRITE_METHODS.has(input.method)) {\n        return \"API key does not have write permission. Create a new key with 'Read & Write' permissions.\";\n      }\n      return null;\n    case 404:\n      if (isFindingDetailPath(input.path)) {\n        return \"Finding not found. Check the finding ID is correct.\";\n      }\n      return null;\n    case 429: {\n      const n = input.retryAfterSeconds;\n      return n\n        ? `Rate limit exceeded. Try again in ${n} seconds.`\n        : \"Rate limit exceeded. Try again shortly.\";\n    }\n    default:\n      return null;\n  }\n}\n\nfunction isFindingDetailPath(path: string): boolean {\n  // /api/findings/{id} or /api/findings/{id}/status\n  return /^\\/api\\/findings\\/[^/]+(\\/.*)?$/.test(path);\n}\n\nfunction extractServerMessage(parsed: unknown): string | null {\n  if (parsed && typeof parsed === \"object\" && \"error\" in parsed) {\n    const err = (parsed as { error: unknown }).error;\n    if (typeof err === \"string\") return err;\n  }\n  return null;\n}\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatAssetDetail } from \"../formatters/markdown.js\";\nimport type { AssetDetailResponse } from \"../types.js\";\n\nexport const getAssetInput = z.object({\n  assetId: z.string().min(1),\n});\n\nexport const getAssetTool = {\n  name: \"get_asset\",\n  title: \"Get asset\",\n  description:\n    \"Fetch a single attack-surface asset by ID, including the findings that reference it in their latest revision.\",\n  inputSchema: getAssetInput,\n  handler:\n    (client: OdinClient) => async (params: z.infer<typeof getAssetInput>) => {\n      const data = await client.get<AssetDetailResponse>(\n        `/api/assets/${encodeURIComponent(params.assetId)}`,\n      );\n      return {\n        markdown: formatAssetDetail(data),\n        structured: { asset: data.asset, findings: data.findings },\n      };\n    },\n};\n","import type {\n  Asset,\n  AssetDetailResponse,\n  AssetsListResponse,\n  FindingDetailResponse,\n  FindingSummary,\n  FindingsListResponse,\n  Pentest,\n  PentestDetailResponse,\n  PentestListResponse,\n} from \"../types.js\";\n\nexport function formatFindingsList(data: FindingsListResponse): string {\n  const { findings, stats, pagination } = data;\n  if (findings.length === 0) {\n    return \"No findings match the supplied filters.\";\n  }\n\n  const rows = findings.map((f) => {\n    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;\n    return `| ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${f.status} | ${formatDate(f.createdAt)} |`;\n  });\n\n  return [\n    `Showing ${findings.length} of ${stats.total} finding(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,\n    \"\",\n    \"| Finding ID | Title | Severity | Status | Created |\",\n    \"| --- | --- | --- | --- | --- |\",\n    ...rows,\n  ].join(\"\\n\");\n}\n\nexport function formatFindingDetail(data: FindingDetailResponse): string {\n  const { finding, revision } = data;\n  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;\n  const header = [\n    `# ${finding.title}`,\n    \"\",\n    `- **ID:** ${finding.findingId}`,\n    `- **Severity:** ${severity}`,\n    `- **Status:** ${finding.status}`,\n    `- **Pentest:** ${finding.context?.pentestId ?? \"standalone\"}`,\n    `- **Created:** ${formatDate(finding.createdAt)}`,\n    `- **Updated:** ${formatDate(finding.updatedAt)}`,\n  ];\n\n  if (!revision) {\n    return [...header, \"\", \"_No revision content available._\"].join(\"\\n\");\n  }\n\n  const c = revision.content;\n  const sections: string[] = [];\n  if (c.summaryMd) sections.push(\"## Summary\", c.summaryMd);\n  if (c.descriptionMd) sections.push(\"## Description\", c.descriptionMd);\n  if (c.businessImpactMd)\n    sections.push(\"## Business Impact\", c.businessImpactMd);\n  if (c.detailsMd) sections.push(\"## Details\", c.detailsMd);\n  if (c.remediationMd) sections.push(\"## Remediation\", c.remediationMd);\n  if (c.affectedAssets?.length) {\n    sections.push(\n      \"## Affected Assets\",\n      c.affectedAssets.map((a) => `- ${a.display} (${a.assetId})`).join(\"\\n\"),\n    );\n  }\n\n  return [\n    ...header,\n    \"\",\n    `_Revision ${revision.revisionNumber}_`,\n    \"\",\n    ...sections,\n  ].join(\"\\n\");\n}\n\nexport function formatFindingStatusUpdate(finding: FindingSummary): string {\n  return [\n    `Updated finding **${finding.findingId}** status to **${finding.status}**.`,\n    `Title: ${finding.title}`,\n  ].join(\"\\n\");\n}\n\nexport function formatPentestsList(data: PentestListResponse): string {\n  if (data.pentests.length === 0) return \"No pentests found.\";\n  const rows = data.pentests.map(formatPentestRow);\n  return [\n    \"| Pentest ID | Name | Status | Start | End | Scope |\",\n    \"| --- | --- | --- | --- | --- | --- |\",\n    ...rows,\n  ].join(\"\\n\");\n}\n\nexport function formatPentestDetail(data: PentestDetailResponse): string {\n  const p = data.pentest;\n  const end = p.endAt ? formatDate(p.endAt) : \"open\";\n  const scope = p.scope.length\n    ? p.scope.map((s) => `- ${s}`).join(\"\\n\")\n    : \"_No scope defined._\";\n  return [\n    `# ${p.name}`,\n    \"\",\n    `- **ID:** ${p.pentestId}`,\n    `- **Status:** ${p.status}`,\n    `- **Start:** ${formatDate(p.startAt)}`,\n    `- **End:** ${end}`,\n    `- **Created:** ${formatDate(p.createdAt)}`,\n    \"\",\n    \"## Scope\",\n    \"\",\n    scope,\n  ].join(\"\\n\");\n}\n\nfunction formatPentestRow(p: Pentest): string {\n  const end = p.endAt ? formatDate(p.endAt) : \"open\";\n  const scope =\n    p.scope.slice(0, 3).join(\", \") + (p.scope.length > 3 ? \", …\" : \"\");\n  return `| ${p.pentestId} | ${escapePipes(p.name)} | ${p.status} | ${formatDate(p.startAt)} | ${end} | ${escapePipes(scope)} |`;\n}\n\nexport function formatAssetsList(data: AssetsListResponse): string {\n  const { assets, stats, pagination } = data;\n  if (assets.length === 0) return \"No assets match the supplied filters.\";\n  const rows = assets.map(formatAssetRow);\n  return [\n    `Showing ${assets.length} of ${stats.total} asset(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,\n    \"\",\n    \"| Asset ID | Type | Value | Source | Status | Last seen |\",\n    \"| --- | --- | --- | --- | --- | --- |\",\n    ...rows,\n  ].join(\"\\n\");\n}\n\nexport function formatAssetDetail(data: AssetDetailResponse): string {\n  const { asset, findings } = data;\n  const header = [\n    `# ${asset.value}`,\n    \"\",\n    `- **ID:** ${asset.assetId}`,\n    `- **Type:** ${asset.type}`,\n    `- **Source:** ${asset.source}`,\n    `- **Status:** ${asset.status}`,\n    `- **Last seen:** ${formatDate(asset.lastSeenAt)}`,\n    `- **Created:** ${formatDate(asset.createdAt)}`,\n  ];\n\n  if (findings.length === 0) {\n    return [...header, \"\", \"_No findings reference this asset._\"].join(\"\\n\");\n  }\n\n  const rows = findings.map((f) => {\n    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;\n    return `| ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${f.status} | ${formatDate(f.createdAt)} |`;\n  });\n\n  return [\n    ...header,\n    \"\",\n    `## Findings (${findings.length})`,\n    \"\",\n    \"| Finding ID | Title | Severity | Status | Created |\",\n    \"| --- | --- | --- | --- | --- |\",\n    ...rows,\n  ].join(\"\\n\");\n}\n\nfunction formatAssetRow(a: Asset): string {\n  return `| ${a.assetId} | ${a.type} | ${escapePipes(a.value)} | ${a.source} | ${a.status} | ${formatDate(a.lastSeenAt)} |`;\n}\n\nfunction escapePipes(value: string): string {\n  return value.replace(/\\|/g, \"\\\\|\");\n}\n\nfunction formatDate(epoch: number): string {\n  if (!epoch) return \"—\";\n  // Odin stores timestamps as milliseconds for documents and seconds for some fields\n  // (pentest startAt/endAt are seconds). Heuristic: values < 10^12 are seconds.\n  const ms = epoch < 1e12 ? epoch * 1000 : epoch;\n  return new Date(ms).toISOString().slice(0, 10);\n}\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatFindingDetail } from \"../formatters/markdown.js\";\nimport type { FindingDetailResponse } from \"../types.js\";\n\nexport const getFindingInput = z.object({\n  findingId: z.string().min(1),\n});\n\nexport const getFindingTool = {\n  name: \"get_finding\",\n  title: \"Get finding\",\n  description:\n    \"Fetch a single finding by ID, including the latest revision content (description, impact, details, remediation).\",\n  inputSchema: getFindingInput,\n  handler:\n    (client: OdinClient) => async (params: z.infer<typeof getFindingInput>) => {\n      const data = await client.get<FindingDetailResponse>(\n        `/api/findings/${encodeURIComponent(params.findingId)}`,\n      );\n      return {\n        markdown: formatFindingDetail(data),\n        structured: {\n          finding: data.finding,\n          revision: data.revision,\n        },\n      };\n    },\n};\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatPentestDetail } from \"../formatters/markdown.js\";\nimport type { PentestDetailResponse } from \"../types.js\";\n\nexport const getPentestInput = z.object({\n  pentestId: z.string().min(1),\n});\n\nexport const getPentestTool = {\n  name: \"get_pentest\",\n  title: \"Get pentest\",\n  description:\n    \"Fetch a single pentest by ID, including status, scheduled window, and in-scope targets.\",\n  inputSchema: getPentestInput,\n  handler:\n    (client: OdinClient) => async (params: z.infer<typeof getPentestInput>) => {\n      const data = await client.get<PentestDetailResponse>(\n        `/api/pentests/${encodeURIComponent(params.pentestId)}`,\n      );\n      return {\n        markdown: formatPentestDetail(data),\n        structured: { pentest: data.pentest },\n      };\n    },\n};\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatAssetsList } from \"../formatters/markdown.js\";\nimport type { AssetsListResponse } from \"../types.js\";\n\nexport const listAssetsInput = z.object({\n  type: z.enum([\"DOMAIN\", \"SUBDOMAIN\", \"IP\", \"URL\", \"WILDCARD\"]).optional(),\n  source: z.enum([\"MANUAL\", \"RECON\", \"IMPORT\", \"AGENT\"]).optional(),\n  status: z\n    .string()\n    .optional()\n    .describe(\n      \"Dynamic asset status set by recon (e.g. ACTIVE, INACTIVE, TLS_ERROR).\",\n    ),\n  search: z.string().optional(),\n  sortBy: z.enum([\"lastSeenAt\", \"createdAt\", \"value\"]).optional(),\n  sortOrder: z.enum([\"asc\", \"desc\"]).optional(),\n  limit: z.number().int().min(1).max(100).optional().default(50),\n  offset: z.number().int().min(0).optional().default(0),\n});\n\nexport const listAssetsTool = {\n  name: \"list_assets\",\n  title: \"List assets\",\n  description:\n    \"List attack-surface assets for the organisation. Supports filtering by type, source, status, and free-text search.\",\n  inputSchema: listAssetsInput,\n  handler:\n    (client: OdinClient) => async (params: z.infer<typeof listAssetsInput>) => {\n      const data = await client.get<AssetsListResponse>(\"/api/assets\", params);\n      return {\n        markdown: formatAssetsList(data),\n        structured: {\n          assets: data.assets,\n          stats: data.stats,\n          pagination: data.pagination,\n        },\n      };\n    },\n};\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatFindingsList } from \"../formatters/markdown.js\";\nimport type { FindingsListResponse } from \"../types.js\";\n\nexport const listFindingsInput = z.object({\n  pentestId: z.string().optional().describe(\"Filter to a single pentest.\"),\n  assetId: z\n    .string()\n    .optional()\n    .describe(\n      \"Filter to findings whose latest revision references this asset.\",\n    ),\n  severity: z\n    .enum([\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\", \"INFORMATIONAL\"])\n    .optional(),\n  status: z\n    .enum([\n      \"DRAFT\",\n      \"IN_REVIEW\",\n      \"REPORTED\",\n      \"MITIGATING\",\n      \"OPEN_FOR_RETEST\",\n      \"RESOLVED\",\n      \"NOT_REPRODUCIBLE\",\n      \"ACCEPTED_RISK\",\n    ])\n    .optional(),\n  search: z.string().optional().describe(\"Free-text search on finding titles.\"),\n  sortBy: z.enum([\"severity\", \"createdAt\"]).optional(),\n  sortOrder: z.enum([\"asc\", \"desc\"]).optional(),\n  limit: z.number().int().min(1).max(200).optional().default(50),\n  offset: z.number().int().min(0).optional().default(0),\n});\n\nexport const listFindingsTool = {\n  name: \"list_findings\",\n  title: \"List findings\",\n  description:\n    \"List security findings for the organisation. Supports filtering by pentest, severity, status, and free-text search.\",\n  inputSchema: listFindingsInput,\n  handler:\n    (client: OdinClient) =>\n    async (params: z.infer<typeof listFindingsInput>) => {\n      const data = await client.get<FindingsListResponse>(\n        \"/api/findings\",\n        params,\n      );\n      return {\n        markdown: formatFindingsList(data),\n        structured: {\n          findings: data.findings,\n          stats: data.stats,\n          pagination: data.pagination,\n        },\n      };\n    },\n};\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatPentestsList } from \"../formatters/markdown.js\";\nimport type { PentestListResponse } from \"../types.js\";\n\nexport const listPentestsInput = z.object({});\n\nexport const listPentestsTool = {\n  name: \"list_pentests\",\n  title: \"List pentests\",\n  description:\n    \"List all pentests for the organisation, including status, scheduled window, and in-scope targets.\",\n  inputSchema: listPentestsInput,\n  handler: (client: OdinClient) => async () => {\n    const data = await client.get<PentestListResponse>(\"/api/pentests\");\n    return {\n      markdown: formatPentestsList(data),\n      structured: { pentests: data.pentests },\n    };\n  },\n};\n","import { z } from \"zod\";\nimport type { OdinClient } from \"../client.js\";\nimport { formatFindingStatusUpdate } from \"../formatters/markdown.js\";\nimport type { FindingStatusUpdateResponse } from \"../types.js\";\n\nexport const updateFindingStatusInput = z.object({\n  findingId: z.string().min(1),\n  status: z\n    .enum([\"MITIGATING\", \"OPEN_FOR_RETEST\", \"ACKNOWLEDGED\"])\n    .describe(\n      \"Target status. Only MITIGATING, OPEN_FOR_RETEST, and ACKNOWLEDGED are client-writable; transitions are only allowed from REPORTED, MITIGATING, or OPEN_FOR_RETEST. ACKNOWLEDGED marks the finding as accepted-risk and is terminal.\",\n    ),\n});\n\nexport const updateFindingStatusTool = {\n  name: \"update_finding_status\",\n  title: \"Update finding status\",\n  description:\n    \"Change a finding's status. Requires an API key with write permission and member role. Only MITIGATING, OPEN_FOR_RETEST, and ACKNOWLEDGED are accepted.\",\n  inputSchema: updateFindingStatusInput,\n  handler:\n    (client: OdinClient) =>\n    async (params: z.infer<typeof updateFindingStatusInput>) => {\n      const data = await client.patch<FindingStatusUpdateResponse>(\n        `/api/findings/${encodeURIComponent(params.findingId)}/status`,\n        { status: params.status },\n      );\n      return {\n        markdown: formatFindingStatusUpdate(data.finding),\n        structured: { finding: data.finding },\n      };\n    },\n};\n"],"mappings":";;;AAAA,SAAS,iBAAiB;AAC1B,SAAS,4BAA4B;;;ACD9B,IAAM,eAAN,cAA2B,MAAM;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,SAAS,OAAO;AACrB,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,oBAAoB,OAAO;AAChC,SAAK,OAAO,OAAO;AAAA,EACrB;AACF;AAQO,IAAM,wBAAwB;AAErC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,SAAS,QAAQ,OAAO,QAAQ,CAAC;AAEzD,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACtC,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,SAAK,SAAS,QAAQ;AACtB,SAAK,WAAW,QAAQ,WAAW,uBAAuB;AAAA,MACxD;AAAA,MACA;AAAA,IACF;AACA,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAEA,MAAM,IACJ,MACA,cACY;AACZ,UAAM,MAAM,KAAK,SAAS,MAAM,YAAY;AAC5C,WAAO,KAAK,QAAW,OAAO,KAAK,IAAI;AAAA,EACzC;AAAA,EAEA,MAAM,MAAS,MAAc,MAA2B;AACtD,UAAM,MAAM,KAAK,SAAS,IAAI;AAC9B,WAAO,KAAK,QAAW,SAAS,KAAK,MAAM,IAAI;AAAA,EACjD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAA2B;AACrD,UAAM,MAAM,KAAK,SAAS,IAAI;AAC9B,WAAO,KAAK,QAAW,QAAQ,KAAK,MAAM,IAAI;AAAA,EAChD;AAAA,EAEQ,SACN,MACA,cACQ;AACR,UAAM,MAAM,IAAI,IAAI,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO;AAC1E,QAAI,cAAc;AAChB,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACvD,YAAI,UAAU,UAAa,UAAU,GAAI;AACzC,YAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MACzC;AAAA,IACF;AACA,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA,EAEA,MAAc,QACZ,QACA,KACA,MACA,MACY;AACZ,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,MAAM;AAAA,QACpC,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AAED,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,UAAM,SAAS,UAAU,cAAc,OAAO,IAAI;AAElD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,oBAAoB;AAAA,QACxB,SAAS,QAAQ,IAAI,aAAa;AAAA,MACpC;AACA,YAAM,IAAI,aAAa;AAAA,QACrB,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,UAAU;AAAA,QAChB,SAAS,mBAAmB;AAAA,UAC1B,QAAQ,SAAS;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,MAAuB;AAC5C,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,QAAsC;AAC7D,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,QAAQ,KAAK,OAAO,EAAG,QAAO,OAAO,SAAS,SAAS,EAAE;AAC7D,QAAM,SAAS,KAAK,MAAM,OAAO;AACjC,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AACjC,QAAM,UAAU,KAAK,MAAM,SAAS,KAAK,IAAI,KAAK,GAAI;AACtD,SAAO,UAAU,IAAI,UAAU;AACjC;AAWA,SAAS,mBAAmB,OAAiC;AAC3D,QAAM,gBAAgB,qBAAqB,MAAM,MAAM;AACvD,QAAM,aAAa,kBAAkB,KAAK;AAC1C,MAAI,YAAY;AACd,WAAO,gBACH,GAAG,UAAU,aAAa,aAAa,MACvC;AAAA,EACN;AACA,QAAM,SAAS,gBACX,WAAM,aAAa,KACnB,MAAM,UACJ,WAAM,MAAM,QAAQ,MAAM,GAAG,GAAG,CAAC,KACjC;AACN,SAAO,YAAY,MAAM,MAAM,OAAO,MAAM,IAAI,GAAG,MAAM;AAC3D;AAEA,SAAS,kBAAkB,OAAwC;AACjE,UAAQ,MAAM,QAAQ;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,cAAc,IAAI,MAAM,MAAM,GAAG;AACnC,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT,KAAK;AACH,UAAI,oBAAoB,MAAM,IAAI,GAAG;AACnC,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT,KAAK,KAAK;AACR,YAAM,IAAI,MAAM;AAChB,aAAO,IACH,qCAAqC,CAAC,cACtC;AAAA,IACN;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,oBAAoB,MAAuB;AAElD,SAAO,kCAAkC,KAAK,IAAI;AACpD;AAEA,SAAS,qBAAqB,QAAgC;AAC5D,MAAI,UAAU,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC7D,UAAM,MAAO,OAA8B;AAC3C,QAAI,OAAO,QAAQ,SAAU,QAAO;AAAA,EACtC;AACA,SAAO;AACT;;;AC/MA,SAAS,SAAS;;;ACYX,SAAS,mBAAmB,MAAoC;AACrE,QAAM,EAAE,UAAU,OAAO,WAAW,IAAI;AACxC,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,SAAS,IAAI,CAAC,MAAM;AAC/B,UAAM,WAAW,GAAG,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC;AACxE,WAAO,KAAK,EAAE,SAAS,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,WAAW,EAAE,SAAS,CAAC;AAAA,EAC5G,CAAC;AAED,SAAO;AAAA,IACL,WAAW,SAAS,MAAM,OAAO,MAAM,KAAK,uBAAuB,WAAW,MAAM,WAAW,WAAW,KAAK,aAAa,WAAW,OAAO;AAAA,IAC9I;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,oBAAoB,MAAqC;AACvE,QAAM,EAAE,SAAS,SAAS,IAAI;AAC9B,QAAM,WAAW,GAAG,QAAQ,SAAS,KAAK,UAAU,QAAQ,SAAS,KAAK,QAAQ,CAAC,CAAC;AACpF,QAAM,SAAS;AAAA,IACb,KAAK,QAAQ,KAAK;AAAA,IAClB;AAAA,IACA,aAAa,QAAQ,SAAS;AAAA,IAC9B,mBAAmB,QAAQ;AAAA,IAC3B,iBAAiB,QAAQ,MAAM;AAAA,IAC/B,kBAAkB,QAAQ,SAAS,aAAa,YAAY;AAAA,IAC5D,kBAAkB,WAAW,QAAQ,SAAS,CAAC;AAAA,IAC/C,kBAAkB,WAAW,QAAQ,SAAS,CAAC;AAAA,EACjD;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC,GAAG,QAAQ,IAAI,kCAAkC,EAAE,KAAK,IAAI;AAAA,EACtE;AAEA,QAAM,IAAI,SAAS;AACnB,QAAM,WAAqB,CAAC;AAC5B,MAAI,EAAE,UAAW,UAAS,KAAK,cAAc,EAAE,SAAS;AACxD,MAAI,EAAE,cAAe,UAAS,KAAK,kBAAkB,EAAE,aAAa;AACpE,MAAI,EAAE;AACJ,aAAS,KAAK,sBAAsB,EAAE,gBAAgB;AACxD,MAAI,EAAE,UAAW,UAAS,KAAK,cAAc,EAAE,SAAS;AACxD,MAAI,EAAE,cAAe,UAAS,KAAK,kBAAkB,EAAE,aAAa;AACpE,MAAI,EAAE,gBAAgB,QAAQ;AAC5B,aAAS;AAAA,MACP;AAAA,MACA,EAAE,eAAe,IAAI,CAAC,MAAM,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IACxE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,aAAa,SAAS,cAAc;AAAA,IACpC;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,0BAA0B,SAAiC;AACzE,SAAO;AAAA,IACL,qBAAqB,QAAQ,SAAS,kBAAkB,QAAQ,MAAM;AAAA,IACtE,UAAU,QAAQ,KAAK;AAAA,EACzB,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,mBAAmB,MAAmC;AACpE,MAAI,KAAK,SAAS,WAAW,EAAG,QAAO;AACvC,QAAM,OAAO,KAAK,SAAS,IAAI,gBAAgB;AAC/C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,oBAAoB,MAAqC;AACvE,QAAM,IAAI,KAAK;AACf,QAAM,MAAM,EAAE,QAAQ,WAAW,EAAE,KAAK,IAAI;AAC5C,QAAM,QAAQ,EAAE,MAAM,SAClB,EAAE,MAAM,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI,IACtC;AACJ,SAAO;AAAA,IACL,KAAK,EAAE,IAAI;AAAA,IACX;AAAA,IACA,aAAa,EAAE,SAAS;AAAA,IACxB,iBAAiB,EAAE,MAAM;AAAA,IACzB,gBAAgB,WAAW,EAAE,OAAO,CAAC;AAAA,IACrC,cAAc,GAAG;AAAA,IACjB,kBAAkB,WAAW,EAAE,SAAS,CAAC;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,iBAAiB,GAAoB;AAC5C,QAAM,MAAM,EAAE,QAAQ,WAAW,EAAE,KAAK,IAAI;AAC5C,QAAM,QACJ,EAAE,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,SAAS,IAAI,aAAQ;AACjE,SAAO,KAAK,EAAE,SAAS,MAAM,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM,YAAY,KAAK,CAAC;AAC5H;AAEO,SAAS,iBAAiB,MAAkC;AACjE,QAAM,EAAE,QAAQ,OAAO,WAAW,IAAI;AACtC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,OAAO,OAAO,IAAI,cAAc;AACtC,SAAO;AAAA,IACL,WAAW,OAAO,MAAM,OAAO,MAAM,KAAK,qBAAqB,WAAW,MAAM,WAAW,WAAW,KAAK,aAAa,WAAW,OAAO;AAAA,IAC1I;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,kBAAkB,MAAmC;AACnE,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,QAAM,SAAS;AAAA,IACb,KAAK,MAAM,KAAK;AAAA,IAChB;AAAA,IACA,aAAa,MAAM,OAAO;AAAA,IAC1B,eAAe,MAAM,IAAI;AAAA,IACzB,iBAAiB,MAAM,MAAM;AAAA,IAC7B,iBAAiB,MAAM,MAAM;AAAA,IAC7B,oBAAoB,WAAW,MAAM,UAAU,CAAC;AAAA,IAChD,kBAAkB,WAAW,MAAM,SAAS,CAAC;AAAA,EAC/C;AAEA,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,CAAC,GAAG,QAAQ,IAAI,qCAAqC,EAAE,KAAK,IAAI;AAAA,EACzE;AAEA,QAAM,OAAO,SAAS,IAAI,CAAC,MAAM;AAC/B,UAAM,WAAW,GAAG,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC;AACxE,WAAO,KAAK,EAAE,SAAS,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,WAAW,EAAE,SAAS,CAAC;AAAA,EAC5G,CAAC;AAED,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,gBAAgB,SAAS,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,eAAe,GAAkB;AACxC,SAAO,KAAK,EAAE,OAAO,MAAM,EAAE,IAAI,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,WAAW,EAAE,UAAU,CAAC;AACvH;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,QAAQ,OAAO,KAAK;AACnC;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,CAAC,MAAO,QAAO;AAGnB,QAAM,KAAK,QAAQ,OAAO,QAAQ,MAAO;AACzC,SAAO,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC/C;;;AD9KO,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC;AAEM,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WAAuB,OAAO,WAA0C;AACvE,UAAM,OAAO,MAAM,OAAO;AAAA,MACxB,eAAe,mBAAmB,OAAO,OAAO,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,MACL,UAAU,kBAAkB,IAAI;AAAA,MAChC,YAAY,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,SAAS;AAAA,IAC3D;AAAA,EACF;AACJ;;;AEzBA,SAAS,KAAAA,UAAS;AAKX,IAAM,kBAAkBC,GAAE,OAAO;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAEM,IAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WAAuB,OAAO,WAA4C;AACzE,UAAM,OAAO,MAAM,OAAO;AAAA,MACxB,iBAAiB,mBAAmB,OAAO,SAAS,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,MACL,UAAU,oBAAoB,IAAI;AAAA,MAClC,YAAY;AAAA,QACV,SAAS,KAAK;AAAA,QACd,UAAU,KAAK;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACJ;;;AC5BA,SAAS,KAAAC,UAAS;AAKX,IAAM,kBAAkBC,GAAE,OAAO;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAEM,IAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WAAuB,OAAO,WAA4C;AACzE,UAAM,OAAO,MAAM,OAAO;AAAA,MACxB,iBAAiB,mBAAmB,OAAO,SAAS,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,MACL,UAAU,oBAAoB,IAAI;AAAA,MAClC,YAAY,EAAE,SAAS,KAAK,QAAQ;AAAA,IACtC;AAAA,EACF;AACJ;;;ACzBA,SAAS,KAAAC,UAAS;AAKX,IAAM,kBAAkBC,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,KAAK,CAAC,UAAU,aAAa,MAAM,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA,EACxE,QAAQA,GAAE,KAAK,CAAC,UAAU,SAAS,UAAU,OAAO,CAAC,EAAE,SAAS;AAAA,EAChE,QAAQA,GACL,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,KAAK,CAAC,cAAc,aAAa,OAAO,CAAC,EAAE,SAAS;AAAA,EAC9D,WAAWA,GAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7D,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC;AACtD,CAAC;AAEM,IAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WAAuB,OAAO,WAA4C;AACzE,UAAM,OAAO,MAAM,OAAO,IAAwB,eAAe,MAAM;AACvE,WAAO;AAAA,MACL,UAAU,iBAAiB,IAAI;AAAA,MAC/B,YAAY;AAAA,QACV,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACJ;;;ACvCA,SAAS,KAAAC,UAAS;AAKX,IAAM,oBAAoBC,GAAE,OAAO;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6BAA6B;AAAA,EACvE,SAASA,GACN,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,UAAUA,GACP,KAAK,CAAC,YAAY,QAAQ,UAAU,OAAO,eAAe,CAAC,EAC3D,SAAS;AAAA,EACZ,QAAQA,GACL,KAAK;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,SAAS;AAAA,EACZ,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EAC5E,QAAQA,GAAE,KAAK,CAAC,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,EACnD,WAAWA,GAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7D,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC;AACtD,CAAC;AAEM,IAAM,mBAAmB;AAAA,EAC9B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WACD,OAAO,WAA8C;AACnD,UAAM,OAAO,MAAM,OAAO;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,MACL,UAAU,mBAAmB,IAAI;AAAA,MACjC,YAAY;AAAA,QACV,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACJ;;;ACzDA,SAAS,KAAAC,UAAS;AAKX,IAAM,oBAAoBC,GAAE,OAAO,CAAC,CAAC;AAErC,IAAM,mBAAmB;AAAA,EAC9B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SAAS,CAAC,WAAuB,YAAY;AAC3C,UAAM,OAAO,MAAM,OAAO,IAAyB,eAAe;AAClE,WAAO;AAAA,MACL,UAAU,mBAAmB,IAAI;AAAA,MACjC,YAAY,EAAE,UAAU,KAAK,SAAS;AAAA,IACxC;AAAA,EACF;AACF;;;ACpBA,SAAS,KAAAC,UAAS;AAKX,IAAM,2BAA2BC,GAAE,OAAO;AAAA,EAC/C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,QAAQA,GACL,KAAK,CAAC,cAAc,mBAAmB,cAAc,CAAC,EACtD;AAAA,IACC;AAAA,EACF;AACJ,CAAC;AAEM,IAAM,0BAA0B;AAAA,EACrC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aACE;AAAA,EACF,aAAa;AAAA,EACb,SACE,CAAC,WACD,OAAO,WAAqD;AAC1D,UAAM,OAAO,MAAM,OAAO;AAAA,MACxB,iBAAiB,mBAAmB,OAAO,SAAS,CAAC;AAAA,MACrD,EAAE,QAAQ,OAAO,OAAO;AAAA,IAC1B;AACA,WAAO;AAAA,MACL,UAAU,0BAA0B,KAAK,OAAO;AAAA,MAChD,YAAY,EAAE,SAAS,KAAK,QAAQ;AAAA,IACtC;AAAA,EACF;AACJ;;;ATrBA,IAAM,kBAAkB;AAOxB,eAAe,OAAO;AACpB,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,UAAU,QAAQ,IAAI,iBAAiB;AAC7C,QAAM,SAAS,IAAI,WAAW,EAAE,QAAQ,QAAQ,CAAC;AAEjD,QAAM,SAAS,IAAI,UAAU;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AAED,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,KAAK,QAAQ,MAAM;AAG/B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK,YAAY;AAAA,MAChC;AAAA,MACA,OAAO,WAAoB;AACzB,YAAI;AACF,gBAAM,EAAE,UAAU,WAAW,IAAI,MAAM,IAAI,MAAM;AACjD,iBAAO;AAAA,YACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,SAAS,CAAC;AAAA,YACnD,mBAAmB,EAAE,UAAU,GAAG,SAAS,UAAU,EAAE;AAAA,UACzD;AAAA,QACF,SAAS,OAAO;AACd,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,eAAe,KAAK,EAAE,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,OAAO,QAAQ,SAAS;AAC9B,UAAQ;AAAA,IACN,YAAY,eAAe,uBAAuB,OAAO,WAAW,MAAM,MAAM;AAAA,EAClF;AACF;AAEA,SAAS,SAAS,OAAyC;AACzD,MAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,MAAM;AACvB;AAEA,SAAS,eAAe,OAAwB;AAC9C,MAAI,iBAAiB,aAAc,QAAO,MAAM;AAChD,MAAI,iBAAiB,MAAO,QAAO,qBAAqB,MAAM,OAAO;AACrE,SAAO,qBAAqB,OAAO,KAAK,CAAC;AAC3C;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,6BAA6B,KAAK;AAChD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":["z","z","z","z","z","z","z","z","z","z","z","z"]}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@borgresearch/odin-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for the Odin security API",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "odin",
+    "security"
+  ],
+  "homepage": "https://github.com/BorgDevelopment/borg-platform/tree/develop/frontend/packages/odin-mcp",
+  "bugs": {
+    "url": "https://github.com/BorgDevelopment/borg-platform/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BorgDevelopment/borg-platform.git",
+    "directory": "frontend/packages/odin-mcp"
+  },
+  "license": "MIT",
+  "author": "Borg Research",
+  "type": "module",
+  "bin": {
+    "odin-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:run": "vitest run",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "inspect": "mcp-inspector node dist/index.js",
+    "inspect:dev": "pnpm build && pnpm inspect"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.3.14",
+    "@modelcontextprotocol/inspector": "^0.21.2",
+    "@types/node": "^22.19.8",
+    "tsup": "^8.3.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  }
+}