@borgresearch/odin-mcp 0.2.0 → 0.3.0

package/dist/chunk-D5FYYTYV.js

@@ -0,0 +1,1211 @@
+#!/usr/bin/env node
+import {
+  OdinApiError
+} from "./chunk-XHJYVUHG.js";
+
+// src/tools/finding-actions.ts
+import { z as z3 } from "zod";
+
+// src/tools/finding-reference.ts
+import { z } from "zod";
+var findingReferenceFields = {
+  identifier: z.string().trim().min(1).optional().describe(
+    'Human-readable finding identifier such as "ODI-12". Preferred input.'
+  ),
+  findingId: z.string().trim().min(1).optional().describe(
+    "Raw internal finding ID, useful when chaining from another tool."
+  )
+};
+var findingReferenceInput = z.object(findingReferenceFields).refine((value) => Boolean(value.identifier || value.findingId), {
+  message: "Provide either identifier or findingId."
+});
+function findingReferenceValue(reference) {
+  const value = reference.identifier ?? reference.findingId;
+  if (!value) {
+    throw new Error("A finding identifier or findingId is required.");
+  }
+  return value;
+}
+function findingReferencePath(reference, suffix = "") {
+  return `/api/findings/${encodeURIComponent(findingReferenceValue(reference))}${suffix}`;
+}
+async function resolveFindingId(client, reference) {
+  if (reference.findingId) return reference.findingId;
+  const data = await client.get(
+    findingReferencePath(reference)
+  );
+  return data.remediationContext?.findingId ?? data.finding.findingId;
+}
+
+// src/tools/finding-tool.ts
+import { z as z2 } from "zod";
+function findingToolInput(fields) {
+  return z2.object({ ...findingReferenceFields, ...fields }).refine(
+    (value) => {
+      const reference = value;
+      return Boolean(reference.identifier || reference.findingId);
+    },
+    { message: "Provide either identifier or findingId." }
+  );
+}
+var readAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var writeAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+
+// src/tools/finding-actions.ts
+var followFindingInput = findingToolInput({
+  follow: z3.boolean().describe("True to follow the finding, false to stop following it.")
+});
+var followFindingTool = {
+  name: "follow_finding",
+  title: "Follow or unfollow a finding",
+  description: "Follow a finding to get its notifications, or stop following it. Requires write permission and acts as the API key creator. The assignee always follows their finding and can't unfollow it.",
+  annotations: { ...writeAnnotations, idempotentHint: true },
+  inputSchema: followFindingInput,
+  handler: (client) => async (params) => {
+    const data = await client.put(
+      findingReferencePath(params, "/subscription"),
+      { subscribed: params.follow }
+    );
+    const label = findingReferenceValue(params);
+    return {
+      markdown: data.subscribed ? `Following ${label}.` : `Stopped following ${label}.`,
+      structured: data
+    };
+  }
+};
+var requestFindingRetestInput = findingToolInput({});
+var requestFindingRetestTool = {
+  name: "request_finding_retest",
+  title: "Request a finding retest",
+  description: "Queue a manual retest that checks whether a finding is still exploitable. Spends credits, so confirm with the user first. Works for findings in REPORTED, ACKNOWLEDGED, MITIGATING or OPEN_FOR_RETEST status with no retest already queued or running. Requires write permission and acts as the API key creator. Read the result later with get_finding_retests.",
+  annotations: writeAnnotations,
+  inputSchema: requestFindingRetestInput,
+  handler: (client) => async (params) => {
+    try {
+      const data = await client.post(
+        findingReferencePath(params, "/retest"),
+        {}
+      );
+      return {
+        markdown: `Queued retest ${data.retestId} for ${findingReferenceValue(params)}.`,
+        structured: data
+      };
+    } catch (error) {
+      if (error instanceof OdinApiError && isRetestUnavailable(error.body)) {
+        const reason = "Retests aren't available for this organisation.";
+        return {
+          markdown: reason,
+          structured: { state: "unavailable", reason }
+        };
+      }
+      throw error;
+    }
+  }
+};
+function isRetestUnavailable(body) {
+  return typeof body === "object" && body !== null && body.code === "RETEST_UNAVAILABLE";
+}
+
+// src/tools/finding-attachments.ts
+import { z as z4 } from "zod";
+var prepareFindingAttachmentUploadInput = findingToolInput({
+  filename: z4.string().min(1).max(500),
+  contentType: z4.enum([
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "application/pdf",
+    "application/zip",
+    "application/json",
+    "application/octet-stream",
+    "text/plain",
+    "text/markdown",
+    "text/csv",
+    "text/log"
+  ]),
+  sizeBytes: z4.number().int().min(1).max(25 * 1024 * 1024)
+});
+var prepareFindingAttachmentUploadTool = {
+  name: "prepare_finding_attachment_upload",
+  title: "Prepare a private discussion attachment upload",
+  description: "Create a five-minute signed upload URL for a file up to 25 MiB. Requires write permission. Does not upload bytes or post a message. The caller must PUT the exact file to uploadUrl using requiredHeaders, without the Odin API key, then pass publicUrl as the attachment URL to create_finding_message. publicUrl is a private gs:// object reference. Treat signed URLs as temporary secrets.",
+  annotations: writeAnnotations,
+  inputSchema: prepareFindingAttachmentUploadInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      findingReferencePath(params, "/thread/upload-url"),
+      {
+        filename: params.filename,
+        contentType: params.contentType,
+        sizeBytes: params.sizeBytes
+      }
+    );
+    return {
+      markdown: "Upload URL prepared; no bytes have been uploaded. PUT the file to uploadUrl with requiredHeaders, then attach publicUrl in a discussion message. Do not send the Odin API key to the upload URL.",
+      structured: data
+    };
+  }
+};
+var getFindingAttachmentUrlInput = findingToolInput({
+  messageId: z4.string().min(1),
+  url: z4.string().url().describe(
+    "Exact private attachment URL from this message's attachments array."
+  )
+});
+var getFindingAttachmentUrlTool = {
+  name: "get_finding_attachment_url",
+  title: "Get a temporary attachment download URL",
+  description: "Resolve a stored discussion attachment to a ten-minute signed download URL. Requires read permission and the attachment must belong to the selected finding and message. Does not download bytes or forward the Odin key to storage. Treat the returned signed URL as a temporary secret.",
+  annotations: { ...readAnnotations, openWorldHint: true },
+  inputSchema: getFindingAttachmentUrlInput,
+  handler: (client) => async (params) => {
+    const url = await client.getRedirectUrl(
+      findingReferencePath(
+        params,
+        `/thread/attachments/${encodeURIComponent(params.messageId)}`
+      ),
+      { url: params.url }
+    );
+    return {
+      markdown: "Temporary attachment download URL resolved. No bytes were downloaded; the URL is in the structured result.",
+      structured: { url }
+    };
+  }
+};
+var getFindingSlackUrlInput = findingToolInput({
+  messageId: z4.string().min(1).optional(),
+  threadId: z4.string().min(1).optional()
+}).refine((value) => Boolean(value.messageId || value.threadId), {
+  message: "Provide a messageId or threadId."
+});
+var getFindingSlackUrlTool = {
+  name: "get_finding_slack_url",
+  title: "Get a synced discussion's Slack permalink",
+  description: "Resolve a synced message or thread to its Slack permalink. Requires read permission. Does not navigate to Slack or forward the Odin API key.",
+  annotations: { ...readAnnotations, openWorldHint: true },
+  inputSchema: getFindingSlackUrlInput,
+  handler: (client) => async (params) => {
+    const url = await client.getRedirectUrl(
+      findingReferencePath(params, "/thread/slack-link"),
+      { messageId: params.messageId, threadId: params.threadId }
+    );
+    return { markdown: `Slack permalink: ${url}`, structured: { url } };
+  }
+};
+
+// src/tools/finding-collaboration.ts
+import { z as z5 } from "zod";
+var attachmentInput = z5.object({
+  type: z5.enum(["IMAGE", "FILE"]),
+  url: z5.string().url().describe(
+    "Private gs:// URL returned by prepare_finding_attachment_upload after uploading the file."
+  ),
+  name: z5.string().min(1).max(500),
+  sizeBytes: z5.number().int().nonnegative().optional(),
+  mimeType: z5.string().min(1).max(255).optional()
+});
+var assignFindingInput = findingToolInput({
+  assigneeUserId: z5.string().min(1).nullable().describe("Organisation member user ID, or null to clear assignment.")
+});
+var assignFindingTool = {
+  name: "assign_finding",
+  title: "Assign a finding",
+  description: "Assign a finding to an organisation member, or clear its assignment. Requires write permission. Assignment can notify the assignee by email and Slack and synchronise connected issue trackers.",
+  annotations: { ...writeAnnotations, idempotentHint: true },
+  inputSchema: assignFindingInput,
+  handler: (client) => async (params) => {
+    const data = await client.patch(
+      findingReferencePath(params, "/assignee"),
+      { assigneeUserId: params.assigneeUserId }
+    );
+    return {
+      markdown: `Updated assignment for ${data.finding.identifier ?? data.finding.findingId}: ${params.assigneeUserId ?? "unassigned"}.`,
+      structured: { finding: data.finding }
+    };
+  }
+};
+var getFindingDiscussionInput = findingToolInput({
+  limit: z5.number().int().min(1).max(100).optional(),
+  offset: z5.number().int().nonnegative().optional(),
+  before: z5.number().int().nonnegative().optional().describe(
+    "Only messages before this timestamp, in the API's stored timestamp units."
+  )
+});
+var getFindingDiscussionTool = {
+  name: "get_finding_discussion",
+  title: "Read finding discussions",
+  description: "Read native and Slack-synchronised conversation blocks for a finding. Each block paginates independently. API keys have no personal read or unread state.",
+  annotations: readAnnotations,
+  inputSchema: getFindingDiscussionInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      findingReferencePath(params, "/thread"),
+      { limit: params.limit, offset: params.offset, before: params.before }
+    );
+    const markdown = data.blocks.length ? data.blocks.map(
+      (block) => [
+        `## ${block.thread.type} discussion ${block.thread.threadId} (${block.thread.status})`,
+        `More messages: ${block.hasMore}.`,
+        ...block.messages.map(
+          (message) => `### ${message.author.displayName} (${message.messageId})
+${message.bodyMd}`
+        )
+      ].join("\n\n")
+    ).join("\n\n") : "No discussions exist for this finding.";
+    return { markdown, structured: data };
+  }
+};
+var createFindingMessageInput = findingToolInput({
+  bodyMd: z5.string().min(1).max(5e4).describe(
+    "Markdown body. Mention syntax: @[Label](USER:id), @[Label](OPERATOR:id), @[ODI-12](FINDING:id), or @[Pentest](PENTEST:id); use list_finding_mentionables to discover IDs."
+  ),
+  threadId: z5.string().min(1).optional().describe("Existing block to reply to; omit for the native discussion."),
+  attachments: z5.array(attachmentInput).max(20).optional()
+});
+var createFindingMessageTool = {
+  name: "create_finding_message",
+  title: "Post a finding discussion message",
+  description: "Post a Markdown discussion message. Requires write permission and acts as the API key creator. May send email, mention notifications and Slack messages. Repeating a call creates another message.",
+  annotations: writeAnnotations,
+  inputSchema: createFindingMessageInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      findingReferencePath(params, "/thread"),
+      {
+        bodyMd: params.bodyMd,
+        threadId: params.threadId,
+        attachments: params.attachments
+      }
+    );
+    return {
+      markdown: `Posted message ${data.message.messageId}.`,
+      structured: data
+    };
+  }
+};
+var editFindingMessageInput = findingToolInput({
+  messageId: z5.string().min(1),
+  bodyMd: z5.string().min(1).max(5e4)
+});
+var editFindingMessageTool = {
+  name: "edit_finding_message",
+  title: "Edit a finding discussion message",
+  description: "Edit a message authored by the API key creator. Requires write permission. New mentions can send notifications and the edit can synchronise to Slack.",
+  annotations: writeAnnotations,
+  inputSchema: editFindingMessageInput,
+  handler: (client) => async (params) => {
+    const data = await client.patch(
+      findingReferencePath(
+        params,
+        `/thread/${encodeURIComponent(params.messageId)}`
+      ),
+      { bodyMd: params.bodyMd }
+    );
+    return {
+      markdown: `Edited message ${data.message.messageId}.`,
+      structured: data
+    };
+  }
+};
+var deleteFindingMessageInput = findingToolInput({
+  messageId: z5.string().min(1)
+});
+var deleteFindingMessageTool = {
+  name: "delete_finding_message",
+  title: "Delete a finding discussion message",
+  description: "Delete a message authored by the API key creator. Requires write permission and may delete its Slack mirror. Confirm the user's intent before deleting.",
+  annotations: writeAnnotations,
+  inputSchema: deleteFindingMessageInput,
+  handler: (client) => async (params) => {
+    const data = await client.delete(
+      findingReferencePath(
+        params,
+        `/thread/${encodeURIComponent(params.messageId)}`
+      )
+    );
+    return {
+      markdown: `Deleted message ${params.messageId}.`,
+      structured: data
+    };
+  }
+};
+var updateFindingDiscussionInput = findingToolInput({
+  action: z5.enum(["resolve", "reopen"])
+});
+var updateFindingDiscussionTool = {
+  name: "update_finding_discussion",
+  title: "Resolve or reopen the native discussion",
+  description: "Resolve or reopen a finding's native discussion. Requires write permission and may synchronise the status to Slack. This does not change the finding's security status.",
+  annotations: writeAnnotations,
+  inputSchema: updateFindingDiscussionInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      findingReferencePath(params, "/thread/resolve"),
+      { action: params.action }
+    );
+    return {
+      markdown: `Discussion status: ${data.thread?.status ?? params.action}.`,
+      structured: data
+    };
+  }
+};
+var listFindingMentionablesInput = findingToolInput({
+  q: z5.string().trim().max(100).optional()
+});
+var listFindingMentionablesTool = {
+  name: "list_finding_mentionables",
+  title: "Find people and entities to mention",
+  description: "Find authorised people, findings and pentests that can be mentioned in a finding discussion. Returns up to eight people, eight findings and eight pentests matching q.",
+  annotations: readAnnotations,
+  inputSchema: listFindingMentionablesInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      findingReferencePath(params, "/thread/mentionables"),
+      { q: params.q }
+    );
+    return {
+      markdown: data.mentionables.map((item) => `- ${item.label}: ${item.id}`).join("\n") || "No matching mentionables.",
+      structured: data
+    };
+  }
+};
+var disconnectFindingDiscussionInput = findingToolInput({
+  threadId: z5.string().min(1)
+});
+var disconnectFindingDiscussionTool = {
+  name: "disconnect_finding_slack_thread",
+  title: "Disconnect a synced Slack thread",
+  description: "Disconnect a finding's SLACK_SYNC discussion block while preserving imported messages. Stops future synchronisation and may post a confirmation to Slack. Requires write permission. Confirm the user's intent before disconnecting.",
+  annotations: writeAnnotations,
+  inputSchema: disconnectFindingDiscussionInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      findingReferencePath(params, "/thread/disconnect"),
+      { threadId: params.threadId }
+    );
+    return {
+      markdown: `Disconnected Slack discussion ${params.threadId}. Existing messages are preserved.`,
+      structured: data
+    };
+  }
+};
+
+// src/tools/finding-pull-requests.ts
+import { z as z6 } from "zod";
+var listFindingPullRequestsInput = findingToolInput({
+  query: z6.string().optional().describe("PR number, title search, owner/repo#123, or GitHub PR URL."),
+  page: z6.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+});
+var listFindingPullRequestsTool = {
+  name: "list_finding_pull_requests",
+  title: "Find accessible pull requests to link",
+  description: "Search accessible GitHub pull requests for this finding. Defaults to the finding's repository, otherwise its connected GitHub organisation. Results are advisory; link_finding_pull_request verifies the chosen PR. Requires read permission and a configured GitHub integration.",
+  annotations: { ...readAnnotations, openWorldHint: true },
+  inputSchema: listFindingPullRequestsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      findingReferencePath(params, "/link-pr"),
+      { query: params.query, page: params.page }
+    );
+    return {
+      markdown: [
+        `Accessible pull requests (${data.repository ?? "connected organisation"}); more pages: ${data.pagination.hasMore}.`,
+        ...data.pullRequests.map(
+          (pr) => `- ${pr.repo}#${pr.number}: ${pr.title} (${pr.state}) ${pr.url}`
+        )
+      ].join("\n"),
+      structured: data
+    };
+  }
+};
+var unlinkFindingPullRequestInput = findingToolInput({
+  prNodeId: z6.string().min(1).describe(
+    "Stored prNodeId of a manually linked pull request from get_finding."
+  )
+});
+var unlinkFindingPullRequestTool = {
+  name: "unlink_finding_pull_request",
+  title: "Unlink a manually linked pull request",
+  description: "Remove a manual finding-to-PR link. Requires write permission. Automatic links cannot be removed with this operation. Does not modify, close, merge or delete the GitHub PR. Confirm the user's intent before removing the link.",
+  annotations: { ...writeAnnotations, openWorldHint: false },
+  inputSchema: unlinkFindingPullRequestInput,
+  handler: (client) => async (params) => {
+    const data = await client.delete(
+      findingReferencePath(params, "/link-pr"),
+      { prNodeId: params.prNodeId }
+    );
+    return {
+      markdown: `Removed manual pull request link ${params.prNodeId} from ${data.finding.identifier ?? data.finding.findingId}.`,
+      structured: data
+    };
+  }
+};
+
+// src/tools/findings-overview.ts
+import { z as z8 } from "zod";
+
+// src/tools/list-findings.ts
+import { z as z7 } from "zod";
+
+// src/formatters/markdown.ts
+var STATUS_LABELS = {
+  REPORTED: "Reported",
+  ACKNOWLEDGED: "Risk accepted",
+  MITIGATING: "Fixing",
+  OPEN_FOR_RETEST: "Open for Retest",
+  NEEDS_REVISION: "Needs Revision",
+  FIXED_AND_RETESTED: "Fixed & Retested"
+};
+var RETEST_STATUS_LABELS = {
+  QUEUED: "Queued",
+  RUNNING: "Running",
+  COMPLETED: "Completed",
+  FAILED: "Failed",
+  SKIPPED: "Skipped"
+};
+function formatFindingsList(data) {
+  const { findings, pagination } = data;
+  if (findings.length === 0) {
+    return "No findings match the supplied filters.";
+  }
+  const rows = findings.map((f) => {
+    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;
+    return `| ${f.identifier ?? "\u2014"} | ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${formatStatus(f.status)} | ${formatDate(f.createdAt)} |`;
+  });
+  return [
+    `Showing ${findings.length} of ${pagination.total} finding(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
+    "",
+    "| Identifier | Internal ID | Title | Severity | Status | Created |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatFindingDetail(data) {
+  const { finding, revision } = data;
+  const context = data.remediationContext;
+  const identifier = context?.identifier ?? finding.identifier ?? null;
+  const displayIdentifier = identifier ?? finding.findingId;
+  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;
+  const header = [
+    `# ${escapePipes(displayIdentifier)} \u2014 ${escapePipes(finding.title)}`,
+    "",
+    `- **Finding:** ${displayIdentifier}`,
+    `- **Internal ID:** ${finding.findingId}`,
+    `- **Severity:** ${severity}`,
+    `- **Status:** ${formatStatus(finding.status)}`,
+    `- **Repository:** ${context?.repository ?? finding.repository ?? "Not recorded"}`,
+    `- **Pentest:** ${finding.context?.pentestId ?? "standalone"}`,
+    `- **Created:** ${formatDate(finding.createdAt)}`,
+    `- **Updated:** ${formatDate(finding.updatedAt)}`
+  ];
+  const content = context ? {
+    revisionNumber: context.revision.revisionNumber,
+    summary: context.revision.summary,
+    description: context.revision.description,
+    impact: context.revision.impact,
+    details: context.revision.details,
+    remediation: context.revision.remediation,
+    affectedAssets: context.revision.affectedAssets,
+    codeReference: context.revision.codeReference
+  } : revision ? {
+    revisionNumber: revision.revisionNumber,
+    summary: revision.content.summaryMd,
+    description: revision.content.descriptionMd,
+    impact: revision.content.businessImpactMd,
+    details: revision.content.detailsMd,
+    remediation: revision.content.remediationMd,
+    affectedAssets: revision.content.affectedAssets ?? [],
+    codeReference: null
+  } : null;
+  const sections = [];
+  if (!content) {
+    sections.push("_No revision content available._");
+  } else {
+    sections.push(`_Revision ${content.revisionNumber ?? "unknown"}_`);
+    if (content.summary) sections.push("## Summary", content.summary);
+    if (content.description)
+      sections.push("## Description", content.description);
+    if (content.impact) sections.push("## Business Impact", content.impact);
+    if (content.details) sections.push("## Details", content.details);
+    if (content.remediation)
+      sections.push("## Remediation", content.remediation);
+    if (content.codeReference) {
+      sections.push(
+        "## Code reference",
+        `- ${content.codeReference.file}:${content.codeReference.line}`
+      );
+      if (content.codeReference.snippet) {
+        sections.push("```", content.codeReference.snippet, "```");
+      }
+    }
+    if (content.affectedAssets?.length) {
+      sections.push(
+        "## Affected Assets",
+        content.affectedAssets.map((asset) => `- ${asset.display} (${asset.assetId})`).join("\n")
+      );
+    }
+  }
+  if (context) {
+    sections.push(
+      "## Remediation workflow",
+      `- **Suggested branch:** ${context.suggestedBranch ?? "Not available"}`,
+      `- **Ready for a user-created PR:** ${yesNo(context.workflow.readyForUserCreatedPullRequest)}`,
+      `- **GitHub connected:** ${yesNo(context.workflow.githubConnected)}`,
+      `- **Automatic retests:** ${context.workflow.automaticRetestsReady ? "Ready after merge" : "Not ready"}`
+    );
+    if (context.workflow.blockers.length) {
+      sections.push(
+        "### Blockers",
+        context.workflow.blockers.map((blocker) => `- ${blocker}`).join("\n")
+      );
+    }
+    if (context.workflow.nextSteps.length) {
+      sections.push(
+        "### Next steps",
+        context.workflow.nextSteps.map((step) => `- ${step}`).join("\n")
+      );
+    }
+    if (context.linkedPullRequests.length) {
+      sections.push(
+        "## Linked GitHub pull requests",
+        context.linkedPullRequests.map(
+          (pullRequest) => `- [#${pullRequest.number}](${pullRequest.url}) ${escapePipes(pullRequest.title)} \u2014 ${pullRequest.state}, linked via ${pullRequest.linkedVia}`
+        ).join("\n")
+      );
+    } else {
+      sections.push("## Linked GitHub pull requests", "_None linked._");
+    }
+    sections.push("## Latest retest");
+    if (context.latestRetest.state === "unavailable") {
+      sections.push(`_${context.latestRetest.reason}_`);
+    } else if (context.latestRetest.state === "none") {
+      sections.push("_No retest history is available yet._");
+    } else {
+      sections.push(formatRetestSummary(context.latestRetest.retest));
+    }
+  }
+  return [...header, "", ...sections].join("\n");
+}
+function formatFindingStatusUpdate(finding) {
+  const identifier = finding.identifier ?? finding.findingId;
+  return [
+    `Updated finding **${identifier}** (internal ID ${finding.findingId}) status to **${formatStatus(finding.status)}**.`,
+    `Title: ${finding.title}`
+  ].join("\n");
+}
+function formatFindingPullRequestLink(data) {
+  const identifier = data.finding.identifier ?? data.finding.findingId;
+  const pullRequest = data.pullRequest;
+  const readiness = data.workflow.automaticRetestsReady ? "Automatic retesting is ready after this PR merges." : "Automatic retesting is not currently ready; review the blockers below.";
+  const blockers = data.workflow.blockers.length ? `
+${data.workflow.blockers.map((blocker) => `- ${blocker}`).join("\n")}` : "";
+  return [
+    `Linked existing GitHub pull request [#${pullRequest.number}](${pullRequest.url}) to **${identifier}**.`,
+    `Repository: ${pullRequest.repo}; state: ${pullRequest.state}; finding status: ${formatStatus(data.finding.status)}.`,
+    "Odin did not create, modify, merge, or push this pull request.",
+    readiness,
+    blockers ? `Workflow blockers:${blockers}` : ""
+  ].filter(Boolean).join("\n");
+}
+function formatFindingRetests(data) {
+  if (data.state === "none" || data.retests.length === 0) {
+    return "No retest history is available for this finding.";
+  }
+  return [
+    `Retest history (${data.retests.length}):`,
+    "",
+    "| Retest | Status | Trigger | Verdict | Created | Completed |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...data.retests.map(
+      (retest) => `| ${retest.retestId} | ${RETEST_STATUS_LABELS[retest.status]} | ${retest.trigger} | ${retest.combinedVerdict ?? "\u2014"} | ${formatDate(retest.createdAt)} | ${formatDate(retest.completedAt ?? 0)} |`
+    ),
+    "",
+    "Queued and running entries are still in progress; completed, skipped, and failed entries are final for that run."
+  ].join("\n");
+}
+function formatPentestsList(data) {
+  if (data.pentests.length === 0) return "No pentests found.";
+  const rows = data.pentests.map(formatPentestRow);
+  return [
+    "| Pentest ID | Name | Status | Start | End | Scope |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatPentestDetail(data) {
+  const p = data.pentest;
+  const end = p.endAt ? formatDate(p.endAt) : "open";
+  const scope = p.scope.length ? p.scope.map((s) => `- ${s}`).join("\n") : "_No scope defined._";
+  return [
+    `# ${p.name}`,
+    "",
+    `- **ID:** ${p.pentestId}`,
+    `- **Status:** ${p.status}`,
+    `- **Start:** ${formatDate(p.startAt)}`,
+    `- **End:** ${end}`,
+    `- **Created:** ${formatDate(p.createdAt)}`,
+    "",
+    "## Scope",
+    "",
+    scope
+  ].join("\n");
+}
+function formatFindingsForAsset(findings) {
+  if (findings.length === 0) return "_No findings reference this asset._";
+  return [
+    `## Findings (${findings.length})`,
+    "",
+    "| Identifier | Internal ID | Title | Severity | Status | Created |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...findings.map(formatFindingRow)
+  ].join("\n");
+}
+function formatAssetsList(data) {
+  const { assets, pagination } = data;
+  if (assets.length === 0) return "No assets match the supplied filters.";
+  const rows = assets.map(formatAssetRow);
+  return [
+    `Showing ${assets.length} of ${pagination.total} asset(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
+    "",
+    "| Asset ID | Type | Value | Source | Status | Last seen |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows
+  ].join("\n");
+}
+function formatAssetDetail(data) {
+  const { asset, findings } = data;
+  const header = [
+    `# ${asset.value}`,
+    "",
+    `- **ID:** ${asset.assetId}`,
+    `- **Type:** ${asset.type}`,
+    `- **Source:** ${asset.source}`,
+    `- **Status:** ${asset.status}`,
+    `- **Last seen:** ${formatDate(asset.lastSeenAt)}`,
+    `- **Created:** ${formatDate(asset.createdAt)}`
+  ];
+  return [...header, "", formatFindingsForAsset(findings)].join("\n");
+}
+function formatFindingRow(finding) {
+  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;
+  return `| ${finding.identifier ?? "\u2014"} | ${finding.findingId} | ${escapePipes(finding.title)} | ${severity} | ${formatStatus(finding.status)} | ${formatDate(finding.createdAt)} |`;
+}
+function formatPentestRow(p) {
+  const end = p.endAt ? formatDate(p.endAt) : "open";
+  const scope = p.scope.slice(0, 3).join(", ") + (p.scope.length > 3 ? ", \u2026" : "");
+  return `| ${p.pentestId} | ${escapePipes(p.name)} | ${p.status} | ${formatDate(p.startAt)} | ${end} | ${escapePipes(scope)} |`;
+}
+function formatAssetRow(a) {
+  return `| ${a.assetId} | ${a.type} | ${escapePipes(a.value)} | ${a.source} | ${a.status} | ${formatDate(a.lastSeenAt)} |`;
+}
+function formatRetestSummary(retest) {
+  return [
+    `- **Status:** ${RETEST_STATUS_LABELS[retest.status]}`,
+    `- **Trigger:** ${retest.trigger}`,
+    `- **Verdict:** ${retest.combinedVerdict ?? "Not available yet"}`,
+    `- **Finding action:** ${retest.statusAction ?? "None"}`,
+    `- **Created:** ${formatDate(retest.createdAt)}`,
+    `- **Completed:** ${formatDate(retest.completedAt ?? 0)}`
+  ].join("\n");
+}
+function formatStatus(status) {
+  return STATUS_LABELS[status] ?? status;
+}
+function yesNo(value) {
+  return value ? "Yes" : "No";
+}
+function escapePipes(value) {
+  return value.replace(/\|/g, "\\|");
+}
+function formatDate(epoch) {
+  if (!epoch) return "\u2014";
+  const ms = epoch < 1e12 ? epoch * 1e3 : epoch;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+// src/tools/list-findings.ts
+var severityInput = z7.enum([
+  "CRITICAL",
+  "HIGH",
+  "MEDIUM",
+  "LOW",
+  "INFORMATIONAL"
+]);
+var statusInput = z7.enum([
+  "REPORTED",
+  "ACKNOWLEDGED",
+  "MITIGATING",
+  "OPEN_FOR_RETEST",
+  "NEEDS_REVISION",
+  "FIXED_AND_RETESTED"
+]);
+var sourceInput = z7.enum([
+  "MANUAL",
+  "WATCHDOG",
+  "IMPORT",
+  "AGENT",
+  "THREAT_MODEL"
+]);
+var confirmationTypeInput = z7.enum(["static", "partial", "exploited"]);
+var assigneeInput = z7.string().trim().min(1).max(500);
+var findingFilterFields = {
+  pentestId: z7.string().optional().describe("Filter to a single pentest."),
+  assetId: z7.string().optional().describe(
+    "Filter to findings whose latest revision references this asset."
+  ),
+  repository: z7.string().optional().describe("Filter to a source repository such as owner/name."),
+  severity: z7.union([severityInput, z7.array(severityInput).min(1)]).optional(),
+  status: z7.union([statusInput, z7.array(statusInput).min(1)]).optional(),
+  excludeStatuses: z7.union([statusInput, z7.array(statusInput).min(1)]).optional().describe("Exclude these client-visible statuses."),
+  source: z7.union([sourceInput, z7.array(sourceInput).min(1)]).optional(),
+  confirmationType: z7.union([confirmationTypeInput, z7.array(confirmationTypeInput).min(1)]).optional(),
+  assignee: z7.union([assigneeInput, z7.array(assigneeInput).min(1)]).refine((value) => String(value).length <= 500, {
+    message: "Combined assignee filter must be at most 500 characters."
+  }).optional().describe(
+    "Client user ID(s), or __unassigned__ to include findings without an assignee."
+  ),
+  cvssMin: z7.number().min(0).max(10).optional(),
+  cvssMax: z7.number().min(0).max(10).optional(),
+  hideDormant: z7.boolean().optional().describe("Hide findings on dormant assets."),
+  search: z7.string().optional().describe("Free-text search on finding titles and human identifiers.")
+};
+var listFindingsInput = z7.object({
+  ...findingFilterFields,
+  lean: z7.boolean().optional().describe(
+    "Exclude heavy evidence from list results; details stay available."
+  ),
+  stats: z7.boolean().optional().describe("Include aggregate statistics (defaults to true)."),
+  sortBy: z7.enum(["severity", "createdAt"]).optional(),
+  sortOrder: z7.enum(["asc", "desc"]).optional(),
+  limit: z7.number().int().min(1).max(200).optional().default(50),
+  offset: z7.number().int().min(0).optional().default(0)
+});
+function serializeFindingQuery(params) {
+  return Object.fromEntries(
+    Object.entries(params).map(([key, value]) => [
+      key,
+      Array.isArray(value) ? value.join(",") : typeof value === "boolean" ? String(value) : value
+    ])
+  );
+}
+var listFindingsTool = {
+  name: "list_findings",
+  title: "List findings",
+  description: "List security findings for the organisation. Filter by pentest, asset, repository, severity, client-visible status, source, confirmation type, assignee, CVSS range, or dormant assets. Search titles or human identifiers such as ODI-12.",
+  annotations: readAnnotations,
+  inputSchema: listFindingsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      "/api/findings",
+      serializeFindingQuery(params)
+    );
+    return {
+      markdown: formatFindingsList(data),
+      structured: {
+        findings: data.findings,
+        stats: data.stats,
+        pagination: data.pagination
+      }
+    };
+  }
+};
+
+// src/tools/findings-overview.ts
+var getFindingStatsInput = z8.object({
+  pentestId: z8.string().optional()
+});
+var getFindingStatsTool = {
+  name: "get_finding_stats",
+  title: "Get finding statistics",
+  description: "Read aggregate finding totals by severity and status, optionally scoped to a pentest. These totals do not apply other finding list filters.",
+  annotations: readAnnotations,
+  inputSchema: getFindingStatsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      "/api/findings/stats",
+      params
+    );
+    return {
+      markdown: `Total findings: ${data.stats.total}.
+${JSON.stringify(data.stats, null, 2)}`,
+      structured: data
+    };
+  }
+};
+var listFindingRepositoriesTool = {
+  name: "list_finding_repositories",
+  title: "List repositories with findings",
+  description: "List organisation repositories available for the repository filter in list_findings.",
+  annotations: readAnnotations,
+  inputSchema: z8.object({}),
+  handler: (client) => async () => {
+    const data = await client.get(
+      "/api/findings/repositories"
+    );
+    return {
+      markdown: data.repositories.map((repository) => `- ${repository}`).join("\n") || "No repositories with findings.",
+      structured: data
+    };
+  }
+};
+var listFindingAssetsTool = {
+  name: "list_finding_assets",
+  title: "List assets referenced by findings",
+  description: "List organisation assets referenced by findings for use with the assetId filter. This differs from listing all attack-surface assets.",
+  annotations: readAnnotations,
+  inputSchema: z8.object({}),
+  handler: (client) => async () => {
+    const data = await client.get(
+      "/api/findings/assets"
+    );
+    return {
+      markdown: data.assets.map((asset) => `- ${asset.value} (${asset.type}, ${asset.assetId})`).join("\n") || "No assets referenced by findings.",
+      structured: data
+    };
+  }
+};
+var exportFindingsInput = z8.object(findingFilterFields);
+var exportFindingsTool = {
+  name: "export_findings",
+  title: "Export findings and revision content",
+  description: "Export findings matching the supplied filters, including revision Markdown and affected assets. The API returns all matching rows without pagination; narrow the filters for large organisations. This reads data and creates no file.",
+  annotations: readAnnotations,
+  inputSchema: exportFindingsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      "/api/findings/export",
+      serializeFindingQuery(params)
+    );
+    return {
+      markdown: `Exported ${data.findings.length} matching finding(s). Revision content is in the structured findings result.`,
+      structured: data
+    };
+  }
+};
+var findingSummariesInput = z8.object({
+  findingIds: z8.array(z8.string().trim().min(1)).max(200).describe(
+    "Up to 200 internal finding IDs from list_findings. Human identifiers are not accepted by these batch endpoints."
+  )
+});
+var getFindingRetestSummariesTool = {
+  name: "get_finding_retest_summaries",
+  title: "Get latest retests for several findings",
+  description: "Read the latest retest summary for up to 200 finding IDs. Requires read permission and the organisation's retest capability; never starts a retest or spends credits. Missing entries have no latest retest.",
+  annotations: readAnnotations,
+  inputSchema: findingSummariesInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      "/api/findings/retest-summaries",
+      params
+    );
+    return {
+      markdown: `Latest retests available for ${Object.keys(data.summaries).length} finding(s).
+${JSON.stringify(data.summaries, null, 2)}`,
+      structured: data
+    };
+  }
+};
+var getFindingDiscussionSummariesTool = {
+  name: "get_finding_discussion_summaries",
+  title: "Get discussion summaries for several findings",
+  description: "Read message counts and unresolved discussion state for up to 200 finding IDs. API keys have no personal unread state; unreadCount is zero for key-authenticated calls.",
+  annotations: readAnnotations,
+  inputSchema: findingSummariesInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      "/api/findings/thread-summaries",
+      params
+    );
+    return {
+      markdown: `Discussion summaries available for ${Object.keys(data.summaries).length} finding(s).
+${JSON.stringify(data.summaries, null, 2)}`,
+      structured: data
+    };
+  }
+};
+
+// src/tools/additional-tools.ts
+var additionalFindingTools = [
+  getFindingStatsTool,
+  listFindingRepositoriesTool,
+  listFindingAssetsTool,
+  exportFindingsTool,
+  getFindingRetestSummariesTool,
+  getFindingDiscussionSummariesTool,
+  assignFindingTool,
+  getFindingDiscussionTool,
+  createFindingMessageTool,
+  editFindingMessageTool,
+  deleteFindingMessageTool,
+  updateFindingDiscussionTool,
+  listFindingMentionablesTool,
+  disconnectFindingDiscussionTool,
+  prepareFindingAttachmentUploadTool,
+  getFindingAttachmentUrlTool,
+  getFindingSlackUrlTool,
+  listFindingPullRequestsTool,
+  unlinkFindingPullRequestTool,
+  followFindingTool,
+  requestFindingRetestTool
+];
+
+// src/tools/get-asset.ts
+import { z as z9 } from "zod";
+var getAssetInput = z9.object({
+  assetId: z9.string().min(1)
+});
+var getAssetTool = {
+  name: "get_asset",
+  title: "Get asset",
+  description: "Fetch a single attack-surface asset by ID, including the findings that reference it in their latest revision.",
+  annotations: readAnnotations,
+  inputSchema: getAssetInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      `/api/assets/${encodeURIComponent(params.assetId)}`
+    );
+    return {
+      markdown: formatAssetDetail(data),
+      structured: { asset: data.asset, findings: data.findings }
+    };
+  }
+};
+
+// src/tools/get-finding.ts
+var getFindingInput = findingReferenceInput;
+var getFindingTool = {
+  name: "get_finding",
+  title: "Get finding remediation context",
+  description: "Fetch a finding by human identifier such as ODI-12 (preferred) or by internal findingId. Returns bounded remediation context, the suggested branch name, linked GitHub pull requests, workflow readiness, and retest state. Odin only provides context and can link an existing PR; it never creates commits, pushes branches, or creates pull requests.",
+  annotations: readAnnotations,
+  inputSchema: getFindingInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      findingReferencePath(params)
+    );
+    return {
+      markdown: formatFindingDetail(data),
+      structured: {
+        finding: data.remediationContext ?? data.finding,
+        revision: data.remediationContext?.revision ?? data.revision,
+        remediationContext: data.remediationContext ?? null
+      }
+    };
+  }
+};
+
+// src/tools/get-finding-retests.ts
+import { z as z10 } from "zod";
+var getFindingRetestsInput = z10.object(findingReferenceFields).refine((value) => Boolean(value.identifier || value.findingId), {
+  message: "Provide either identifier or findingId."
+});
+var getFindingRetestsTool = {
+  name: "get_finding_retests",
+  title: "Get finding retest history",
+  description: "Read the retest history for a finding by human identifier such as ODI-12 or internal findingId. Distinguishes no history, queued or running, completed, skipped, failed, and gated/unavailable results. This tool never triggers a retest or spends credits.",
+  annotations: readAnnotations,
+  inputSchema: getFindingRetestsInput,
+  handler: (client) => async (params) => {
+    try {
+      const data = await client.get(
+        findingReferencePath(params, "/retests")
+      );
+      return {
+        markdown: formatFindingRetests(data),
+        structured: {
+          state: data.state,
+          retests: data.retests
+        }
+      };
+    } catch (error) {
+      if (error instanceof OdinApiError && error.status === 404 && isRetestHistoryUnavailable(error.body)) {
+        const reason = "Retest history is gated or unavailable for this organisation.";
+        return {
+          markdown: reason,
+          structured: { state: "unavailable", reason, retests: [] }
+        };
+      }
+      throw error;
+    }
+  }
+};
+function isRetestHistoryUnavailable(body) {
+  return typeof body === "object" && body !== null && "code" in body && body.code === "RETEST_HISTORY_UNAVAILABLE";
+}
+
+// src/tools/get-pentest.ts
+import { z as z11 } from "zod";
+var getPentestInput = z11.object({
+  pentestId: z11.string().min(1)
+});
+var getPentestTool = {
+  name: "get_pentest",
+  title: "Get pentest",
+  description: "Fetch a single pentest by ID, including status, scheduled window, and in-scope targets.",
+  annotations: readAnnotations,
+  inputSchema: getPentestInput,
+  handler: (client) => async (params) => {
+    const data = await client.get(
+      `/api/pentests/${encodeURIComponent(params.pentestId)}`
+    );
+    return {
+      markdown: formatPentestDetail(data),
+      structured: { pentest: data.pentest }
+    };
+  }
+};
+
+// src/tools/link-finding-pull-request.ts
+import { z as z12 } from "zod";
+var linkFindingPullRequestInput = z12.object({
+  ...findingReferenceFields,
+  url: z12.string().url().describe("Existing GitHub pull request URL to link to the finding.")
+}).refine((value) => Boolean(value.identifier || value.findingId), {
+  message: "Provide either identifier or findingId."
+});
+var linkFindingPullRequestTool = {
+  name: "link_finding_pull_request",
+  title: "Link an existing GitHub pull request",
+  description: "Link an existing accessible GitHub pull request to a finding identified by ODI-12 or findingId. This operation is idempotent. It does not create, modify, merge, or push a pull request, commit, or branch, and it requires an API key with Read & Write permission; cookie-authenticated callers also need member role. Ask the user before linking.",
+  annotations: { ...writeAnnotations, idempotentHint: true },
+  inputSchema: linkFindingPullRequestInput,
+  handler: (client) => async (params) => {
+    const data = await client.post(
+      findingReferencePath(params, "/link-pr"),
+      { url: params.url }
+    );
+    return {
+      markdown: formatFindingPullRequestLink(data),
+      structured: {
+        finding: data.finding,
+        pullRequest: data.pullRequest,
+        linkSource: data.linkSource,
+        workflow: data.workflow
+      }
+    };
+  }
+};
+
+// src/tools/list-assets.ts
+import { z as z13 } from "zod";
+var listAssetsInput = z13.object({
+  type: z13.enum(["DOMAIN", "SUBDOMAIN", "IP"]).optional(),
+  source: z13.enum(["MANUAL", "RECON", "IMPORT", "AGENT"]).optional(),
+  status: z13.string().optional().describe(
+    "Dynamic asset status set by recon (e.g. ACTIVE, INACTIVE, TLS_ERROR)."
+  ),
+  search: z13.string().optional(),
+  stats: z13.boolean().optional().describe("Include aggregate statistics (defaults to true)."),
+  sortBy: z13.enum(["lastSeenAt", "createdAt", "value"]).optional(),
+  sortOrder: z13.enum(["asc", "desc"]).optional(),
+  limit: z13.number().int().min(1).max(100).optional().default(50),
+  offset: z13.number().int().min(0).optional().default(0)
+});
+var listAssetsTool = {
+  name: "list_assets",
+  title: "List assets",
+  description: "List attack-surface assets for the organisation. Supports filtering by type, source, status, and free-text search.",
+  annotations: readAnnotations,
+  inputSchema: listAssetsInput,
+  handler: (client) => async (params) => {
+    const data = await client.get("/api/assets", {
+      ...params,
+      stats: params.stats === void 0 ? void 0 : String(params.stats)
+    });
+    return {
+      markdown: formatAssetsList(data),
+      structured: {
+        assets: data.assets,
+        stats: data.stats,
+        pagination: data.pagination
+      }
+    };
+  }
+};
+
+// src/tools/list-pentests.ts
+import { z as z14 } from "zod";
+var listPentestsInput = z14.object({});
+var listPentestsTool = {
+  name: "list_pentests",
+  title: "List pentests",
+  description: "List all pentests for the organisation, including status, scheduled window, and in-scope targets.",
+  annotations: readAnnotations,
+  inputSchema: listPentestsInput,
+  handler: (client) => async () => {
+    const data = await client.get("/api/pentests");
+    return {
+      markdown: formatPentestsList(data),
+      structured: { pentests: data.pentests }
+    };
+  }
+};
+
+// src/tools/update-finding-status.ts
+import { z as z15 } from "zod";
+var updateFindingStatusInput = z15.object({
+  ...findingReferenceFields,
+  status: z15.enum(["MITIGATING", "OPEN_FOR_RETEST", "ACKNOWLEDGED"]).describe(
+    "Target status. MITIGATING (shown in Odin as Fixing) means work has started, OPEN_FOR_RETEST means the fix is ready for verification, and ACKNOWLEDGED (shown as Risk accepted) means the organisation accepts the risk for now."
+  )
+}).refine((value) => Boolean(value.identifier || value.findingId), {
+  message: "Provide either identifier or findingId."
+});
+var updateFindingStatusTool = {
+  name: "update_finding_status",
+  title: "Update finding status",
+  description: "Change a finding's status by human identifier such as ODI-12 or internal findingId. Requires an API key with Read & Write permission; cookie-authenticated callers also need member role. Only use this after the user explicitly asks for the status change; a matching pull request is not permission to mutate a finding.",
+  annotations: { ...writeAnnotations, idempotentHint: true },
+  inputSchema: updateFindingStatusInput,
+  handler: (client) => async (params) => {
+    const findingId = await resolveFindingId(client, params);
+    const data = await client.patch(
+      `/api/findings/${encodeURIComponent(findingId)}/status`,
+      { status: params.status }
+    );
+    return {
+      markdown: formatFindingStatusUpdate(data.finding),
+      structured: { finding: data.finding }
+    };
+  }
+};
+
+// src/tools.ts
+var definitions = [
+  listFindingsTool,
+  getFindingTool,
+  updateFindingStatusTool,
+  linkFindingPullRequestTool,
+  getFindingRetestsTool,
+  listPentestsTool,
+  getPentestTool,
+  listAssetsTool,
+  getAssetTool,
+  ...additionalFindingTools
+];
+var ODIN_TOOLS = definitions.map((tool) => ({
+  name: tool.name,
+  title: tool.title,
+  description: tool.description,
+  inputSchema: tool.inputSchema,
+  annotations: tool.annotations,
+  run: (client, params) => tool.handler(client)(
+    params
+  )
+}));
+
+export {
+  ODIN_TOOLS
+};
+//# sourceMappingURL=chunk-D5FYYTYV.js.map