@neobiotechlabs/neobiotech-dev-agent 0.1.20 → 0.1.21

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
         "source": "npm",
         "package": "@neobiotechlabs/neobiotech-dev-agent",
         "registry": "https://registry.npmjs.org",
-        "version": "0.1.20"
+        "version": "0.1.21"
       },
       "description": "의료기기 SW 규제 개발 자동화 (Jira·Confluence·Risk·CVSS·Xray·IEC 62304/62366·MDR·문서 렌더)",
       "category": "medical-device",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "neobiotech-dev-agent",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "displayName": "NeoBiotech Dev Agent (MedDev)",
   "description": "의료기기 SW 규제 개발 자동화 — Jira·Confluence·Risk·CVSS·Xray·IEC 62304/62366·MDR·문서 렌더",
   "author": {

package/dist/index.js

@@ -159642,6 +159642,7 @@ var RiskClient = class {
     this.authHeader = `Basic ${Buffer.from(`${email2}:${token}`).toString("base64")}`;
     this.riskAuthToken = riskAuthToken2;
   }
+  /** Jira issue property 활성화 (Jira 표준 REST + Basic auth) */
   async activateRiskPanel(issueKey) {
     const appId = "306e01a8-5530-427d-b93a-f91f4898ff16";
     const configId = "2a1d023a-d4a5-42c7-91e2-51a05b9eb9be";
@@ -159660,11 +159661,23 @@ var RiskClient = class {
     );
     return resp.ok;
   }
-  async setRiskValue(issueKey, riskConfig, classifierName, optionName) {
-    const classifier = riskConfig.classifiers[classifierName];
-    if (!classifier) throw new Error(`Unknown classifier: ${classifierName}`);
-    const optionId = classifier.options[optionName];
-    if (!optionId) throw new Error(`Unknown option: ${optionName} for ${classifierName}`);
+  /**
+   * Legacy 0.1.20 호환 — classifier/option name을 받아 lookup 후 setRawPayload 호출.
+   * 0.1.21+ 핸들러는 planSetRisk 결과를 setRiskValueRaw로 직접 보내므로 이 메서드는
+   * 그레이스존 유지용. 그러나 RISK_DEFAULTS 정의를 사용하지 않으므로 항상 undefined.
+   */
+  async setRiskValue(_issueKey, _riskConfig, _classifierName, _optionName) {
+    return {
+      ok: false,
+      status: 0,
+      error: "risk_set_values\uC740 0.1.21\uC5D0\uC11C setRiskValueRaw\uB85C \uC774\uC804\uB418\uC5C8\uC2B5\uB2C8\uB2E4. planSetRisk() \uC0AC\uC6A9 \uAD8C\uC7A5."
+    };
+  }
+  /**
+   * 신규 0.1.21 메서드 — payload가 완전 set된 상태로 RMP webtrigger 호출.
+   * endpoint+token은 환경변수에서 받음 (회사 사이트마다 다름).
+   */
+  async setRiskValueRaw(issueKey, payload) {
     if (!this.riskAuthToken) {
       return {
         ok: false,
@@ -159672,24 +159685,27 @@ var RiskClient = class {
         error: "RISK_PLUGIN_AUTH_TOKEN not configured (x-trigger-authentication header would be empty)"
       };
     }
-    const payload = {
+    const endpoint = process.env.RISK_PLUGIN_ENDPOINT;
+    if (!endpoint) {
+      return {
+        ok: false,
+        status: 0,
+        error: "RISK_PLUGIN_ENDPOINT not configured. \uD68C\uC0AC DYN \uC0AC\uC774\uD2B8\uC758 RMP webtrigger URL\uC744 environment \uBCC0\uC218\uB85C \uC785\uB825\uD558\uC138\uC694."
+      };
+    }
+    const fullPayload = {
+      ...payload,
       issueKey,
-      author: riskConfig.author,
-      riskModelKey: riskConfig.riskModelKey,
-      riskSetId: riskConfig.riskSetId,
-      classifierValuePayload: {
-        classifierId: classifier.id,
-        optionId
-      }
+      author: payload.author ?? ""
     };
     try {
-      const resp = await fetch(riskConfig.endpoint, {
+      const resp = await fetch(endpoint, {
         method: "POST",
         headers: {
           "x-trigger-authentication": this.riskAuthToken,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(payload)
+        body: JSON.stringify(fullPayload)
       });
       const body = await resp.text();
       return {
@@ -160081,57 +160097,244 @@ var registerConfluenceTools = (ctx2) => {
   });
 };
 
-// src/config/project-config.ts
-var RISK_DEFAULTS = {
-  endpoint: "https://306e01a8-5530-427d-b93a-f91f4898ff16.hello.atlassian-dev.net/x1/p3_h8rdLbpp1-9mjDOXQiqJ4jL4",
-  author: "712020:baa962da-2822-4cc7-9659-2d780f703b3e",
-  risk_model_key: "risk-model-9dc1c741-0858-4a96-65d6-5feaf052da71",
-  risk_sets: {
-    initial: "2f43f135-d043-84bd-4222-46ba4a309738",
-    current: "f957cae9-a34c-30d7-557b-f7f29a414ba5"
-  },
-  classifiers: {
-    severity: {
-      id: "120dbe93-8a5c-89d9-398c-6fdefc8fa072",
-      options: {
-        negligible: "0750b204-3be7-14b2-34c9-5100846e99db",
-        minor: "70ccea9f-a585-d248-dbd0-e6eefcc683e8",
-        serious: "a8b765c0-2e55-f6c4-25ff-1a4513c1cfd7",
-        critical: "587d166e-890a-5123-e179-15bafbd617e1",
-        catastrophic: "981fbfd5-604d-f9b9-6765-3405a165f401"
+// src/config/risk-models.ts
+var RISK_MODELS = {
+  p1_p2_iso14971: {
+    label: "P1-P2 ISO14971 Hazard analysis",
+    modelKey: "risk-model-9dc1c741-0858-4a96-65d6-5feaf052da71",
+    riskSets: {
+      initial: "2f43f135-d043-84bd-4222-46ba4a309738",
+      current: "f957cae9-a34c-30d7-557b-f7f29a414ba5"
+    },
+    classifiers: {
+      severity: {
+        id: "120dbe93-8a5c-89d9-398c-6fdefc8fa072",
+        options: {
+          negligible: "0750b204-3be7-14b2-34c9-5100846e99db",
+          minor: "70ccea9f-a585-d248-dbd0-e6eefcc683e8",
+          serious: "a8b765c0-2e55-f6c4-25ff-1a4513c1cfd7",
+          critical: "587d166e-890a-5123-e179-15bafbd617e1",
+          catastrophic: "981fbfd5-604d-f9b9-6765-3405a165f401"
+        }
+      },
+      p1: {
+        id: "c2c0af5d-74de-e463-ad13-ba80da1b6afd",
+        options: {
+          improvable: "3ac4a3b1-55ef-de93-3452-61c572a905a3",
+          remote: "2d173a68-c28f-d589-1300-bc127f962810",
+          occasional: "039596ac-784e-f0ac-50cf-d4d2cc96b096",
+          probable: "702cb81f-3bc6-d150-5cc3-daa04d3f0404",
+          frequent: "09fb301a-4448-d8aa-afd2-76d371f501f3"
+        }
+      },
+      p2: {
+        id: "cdada7bb-cb4a-3b00-260b-5e5227e85a74",
+        options: {
+          improvable: "7e044b34-25c4-ffae-5237-48eebb190358",
+          remote: "58257cb8-59e2-5ec7-dd1d-9e966fb13589",
+          occasional: "6cf5ebce-3b07-69b1-b093-9e0ef9def95c",
+          probable: "bbcbfdd1-0c02-6105-e8e4-f60ae6cacb5c",
+          frequent: "e35de539-93d5-f854-c6ed-50067ad8599b"
+        }
       }
+    }
+  },
+  rpn: {
+    label: "Risk Score Calculator",
+    modelKey: "risk-model-c3edfff2-bea1-eb85-1f53-1007c429357a",
+    riskSets: {
+      initial: "f0f50906-1516-0826-8e82-009813ce7ff7",
+      current: "069094fa-c4b1-28a1-d330-464f78b4ecb5",
+      final: "d972671a-06c1-cf5d-e73b-20779079b509"
     },
-    p1: {
-      id: "c2c0af5d-74de-e463-ad13-ba80da1b6afd",
-      options: {
-        improvable: "3ac4a3b1-55ef-de93-3452-61c572a905a3",
-        remote: "2d173a68-c28f-d589-1300-bc127f962810",
-        occasional: "039596ac-784e-f0ac-50cf-d4d2cc96b096",
-        probable: "702cb81f-3bc6-d150-5cc3-daa04d3f0404",
-        frequent: "09fb301a-4448-d8aa-afd2-76d371f501f3"
+    classifiers: {
+      severity: {
+        id: "fec8bdcd-0c55-4ab3-87e3-cfd7176aefd5",
+        options: {
+          negligible: "a87a6249-03e4-5419-d50e-0818d824e8cb",
+          minor: "f0f50906-1516-0826-8e82-009813ce7ff7",
+          serious: "15f87aeb-28ec-98ea-7310-4ad04b294127",
+          critical: "bf9cf219-e342-12ef-4305-2963f930138d",
+          catastrophic: "e04cdc89-ffae-6001-4c06-d14b9fea0eee"
+        }
+      },
+      occurrence: {
+        id: "dc6e3abf-8cfa-b48f-5693-0f51a2362c8f",
+        options: {
+          improvable: "421dfccd-e545-2ec1-6d76-74913955cb63",
+          remote: "8933daea-a933-3ea0-59c1-eb8b7aa0120e",
+          occasional: "96861e6d-1b59-6616-7dda-0e6f413f4f65",
+          probable: "40cd4688-3f91-3781-40c1-5ce65f7cb272",
+          frequent: "7d1c1103-238d-a104-28d7-ba312dd4e394"
+        }
+      },
+      detectability: {
+        id: "2c266e79-f190-1234-95d1-201f72c98acc",
+        options: {
+          improvable: "f57c4581-c957-a270-65e6-1d6930b93a7f",
+          remote: "f7fdea4b-5378-8c45-854d-bcd8ba3bee12",
+          occasional: "45fb0720-f204-acf9-33dd-c92ba27910fa",
+          probable: "c1a7a596-6fc4-db5d-1da3-f2b13d64da8c",
+          frequent: "67ea818d-8ed7-a1af-57ff-6ba68a24c4b4"
+        }
       }
+    }
+  },
+  cia: {
+    label: "Cyber Sec Risk Model",
+    modelKey: "risk-model-ciaRiskModel",
+    riskSets: {
+      initial: "68f0e9de-26c6-7ad8-5a72-a688ad770b24",
+      current: "b43d25e0-0ab5-3605-cd2d-3f54f904d26c"
+    },
+    ciaWrapper: {
+      id: "54d9d60c-7c53-2454-a48d-3c464bad23a9",
+      riskModelKey: "risk-model-overallCIAImpact"
     },
-    p2: {
-      id: "cdada7bb-cb4a-3b00-260b-5e5227e85a74",
-      options: {
-        improvable: "7e044b34-25c4-ffae-5237-48eebb190358",
-        remote: "58257cb8-59e2-5ec7-dd1d-9e966fb13589",
-        occasional: "6cf5ebce-3b07-69b1-b093-9e0ef9def95c",
-        probable: "bbcbfdd1-0c02-6105-e8e4-f60ae6cacb5c",
-        frequent: "e35de539-93d5-f854-c6ed-50067ad8599b"
+    classifiers: {
+      confidentiality: {
+        id: "193ceea6-d531-808b-bb83-d16eb233d73f",
+        options: {
+          negligible: "9dc59ace-7484-108c-77fc-383c85a54052",
+          low: "c1802cd2-a655-3ed9-8138-376297ab39ab",
+          moderate: "d96e2893-515d-29da-d168-c134fb055fa1",
+          high: "dc7f3d58-a8cd-7729-5e0a-37cedfe7996f",
+          severe: "39fe9a59-c8b9-d0b5-a273-fbfcc6efdb6c"
+        }
+      },
+      availability: {
+        id: "1121ee15-e019-dbd7-64f2-47e7af76e789",
+        options: {
+          negligible: "863fd4fd-d939-4e73-fdc9-b27489fcbbb4",
+          low: "cbb40d71-238c-97d7-02cd-4b905929eedb",
+          moderate: "4fbc0ef0-1378-3b2c-7401-75ce94d9443b",
+          high: "33a53544-c011-c30d-dc66-d5f9e0d0bb88",
+          severe: "d9f4a792-0822-c0b0-b463-4c2887ce4d01"
+        }
+      },
+      integrity: {
+        id: "639c61e6-9d11-9bb3-04e7-c1c3512c7e33",
+        options: {
+          negligible: "f35284c1-52a2-edce-e60b-69b97703b891",
+          low: "af67cc1b-9e25-76ce-baf3-d2e8247af569",
+          moderate: "a35a0d14-e8d4-b3c8-35fc-a1f81d2730c7",
+          high: "e535be53-21a8-0f8d-3c78-db4c3d7ebde1",
+          severe: "7a45c4d7-d926-5d01-0034-c9ef929117b3"
+        }
+      },
+      likelihood: {
+        id: "ff7ed5a9-53fe-7e29-f564-b8f3b96bdd5b",
+        options: {
+          rare: "5b3f2233-4603-f34a-9e06-1473e4e1da02",
+          unlikely: "7af594cb-4a87-73c1-2d0a-924124c5f247",
+          possibly: "ed8a2a21-ec63-5e9b-d1d3-60d39ad4ec91",
+          likely: "afe83dfb-fc00-7d3c-9b65-ed0ba6607b96",
+          almost_certain: "86def84c-70c4-15c2-7b7b-f084a9aaf19f"
+        }
       }
     }
   }
 };
-function getRiskConfig(_projectKey) {
-  return RISK_DEFAULTS;
+
+// src/config/project-config.ts
+function planSetRisk(model, riskSet, classifierOptions, issueKey) {
+  const m3 = RISK_MODELS[model];
+  if (!m3) return { items: [], skipped: [{ classifier: "*", optionName: model }] };
+  const setId = m3.riskSets[riskSet];
+  if (!setId) return { items: [], skipped: [{ classifier: "*", optionName: `riskSet.${riskSet}` }] };
+  const author = process.env.JIRA_EMAIL;
+  if (!author) return { items: [], skipped: [{ classifier: "*", optionName: "JIRA_EMAIL missing" }] };
+  const items = [];
+  const skipped = [];
+  for (const [classifierName, optionName] of Object.entries(classifierOptions)) {
+    if (!optionName) continue;
+    const cls = m3.classifiers[classifierName];
+    if (!cls) {
+      skipped.push({ classifier: classifierName, optionName });
+      continue;
+    }
+    const optionId = cls.options[optionName];
+    if (!optionId) {
+      skipped.push({ classifier: classifierName, optionName });
+      continue;
+    }
+    items.push({
+      model,
+      riskSet,
+      classifierName,
+      optionName,
+      payload: {
+        issueKey,
+        author,
+        riskModelKey: m3.modelKey,
+        riskSetId: setId,
+        classifierValuePayload: { classifierId: cls.id, optionId }
+      }
+    });
+  }
+  return {
+    items: items.map((i2) => ({ payload: i2.payload })),
+    skipped
+  };
 }
 
 // src/tools/risk.ts
-function formatRiskResult(name, value, r2) {
+var SEVERITY_P1P2 = external_exports.enum(["negligible", "minor", "serious", "critical", "catastrophic"]);
+var PROB_P1P2 = external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]);
+var SEVERITY_RPN = external_exports.enum(["negligible", "minor", "serious", "critical", "catastrophic"]);
+var PROB_RPN = external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]);
+var CIA_LEVEL = external_exports.enum(["negligible", "low", "moderate", "high", "severe"]);
+var LIKELIHOOD = external_exports.enum(["rare", "unlikely", "possibly", "likely", "almost_certain"]);
+var RISK_SET = external_exports.enum(["initial", "current", "final"]).default("current");
+var p1P2Payload = external_exports.object({
+  severity: SEVERITY_P1P2.optional(),
+  p1: PROB_P1P2.optional(),
+  p2: PROB_P1P2.optional()
+}).strict();
+var rpnPayload = external_exports.object({
+  severity: SEVERITY_RPN.optional(),
+  occurrence: PROB_RPN.optional(),
+  detectability: PROB_RPN.optional()
+}).strict();
+var ciaPayload = external_exports.object({
+  confidentiality: CIA_LEVEL.optional(),
+  availability: CIA_LEVEL.optional(),
+  integrity: CIA_LEVEL.optional(),
+  likelihood: LIKELIHOOD.optional()
+}).strict();
+function classifierFromId(model, id) {
+  const m3 = RISK_MODELS[model];
+  for (const [name, cls] of Object.entries(m3.classifiers)) {
+    if (cls.id === id) return name;
+  }
+  return id;
+}
+function formatSetDetail(line) {
+  const r2 = line.result;
   const tag = r2.ok ? "OK" : "FAILED";
   const detail = r2.error ? `status=${r2.status}, error=${r2.error}` : `status=${r2.status}${r2.body ? `, body=${r2.body}` : ""}`;
-  return `${name}=${value}: ${tag} (${detail})`;
+  return `${tag} [${line.model}] ${line.classifier}=${line.optionName} (${detail})`;
+}
+async function runSetPlans(riskStub, plans) {
+  const out = { details: [] };
+  for (const p of plans) {
+    if (p.res.skipped.length > 0) {
+      for (const sk of p.res.skipped) {
+        out.skipped = out.skipped ?? [];
+        out.skipped.push({ classifier: `${p.name}.${sk.classifier}`, reason: "option-not-mapped" });
+      }
+    }
+    for (const { payload } of p.res.items) {
+      const r2 = await riskStub.setRiskValueRaw(p.issueKey, payload);
+      out.details.push({
+        model: p.name,
+        classifier: classifierFromId(p.model, payload.classifierValuePayload.classifierId),
+        optionName: payload.classifierValuePayload.optionId,
+        result: r2
+      });
+    }
+  }
+  return out;
 }
 var registerRiskTools = (ctx2) => {
   const { server: server2, risk: risk2, jira: jira2 } = ctx2;
@@ -160141,62 +160344,77 @@ var registerRiskTools = (ctx2) => {
     const ok = await risk2.activateRiskPanel(issue_key);
     return { content: [{ type: "text", text: ok ? `Risk panel activated on ${issue_key}` : `Failed to activate risk panel on ${issue_key}` }] };
   });
-  server2.tool("risk_set_values", "Set risk values (severity, p1, p2) on an issue via Risk Management Plugin", {
-    issue_key: external_exports.string().describe("Issue key"),
-    project_key: external_exports.string().describe("Project key (for config lookup)"),
-    severity: external_exports.enum(["negligible", "minor", "serious", "critical", "catastrophic"]).optional(),
-    p1: external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]).optional(),
-    p2: external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]).optional(),
-    risk_set: external_exports.enum(["initial", "current"]).default("current").describe("Which risk set to update")
-  }, async ({ issue_key, project_key, severity, p1, p2, risk_set }) => {
-    const riskConfig = getRiskConfig(project_key);
-    if (!riskConfig) return { content: [{ type: "text", text: `No risk management config for project ${project_key}. (\uD604\uC7AC \uC774 \uC11C\uBC84\uB294 \uB2E8\uC77C Risk \uC124\uC815\uB9CC \uC9C0\uC6D0\uD569\uB2C8\uB2E4 \u2014 PROJECT_CONFIG_PATH \uB294 \uBBF8\uAD6C\uD604 \uC0C1\uD0DC\uC785\uB2C8\uB2E4.)` }] };
-    const riskSetId = riskConfig.risk_sets[risk_set];
-    const configForSet = {
-      endpoint: riskConfig.endpoint,
-      author: riskConfig.author,
-      riskModelKey: riskConfig.risk_model_key,
-      riskSetId,
-      classifiers: riskConfig.classifiers
-    };
-    const results = [];
-    for (const [name, value] of [["severity", severity], ["p1", p1], ["p2", p2]]) {
-      if (value) {
-        const r2 = await risk2.setRiskValue(issue_key, configForSet, name, value);
-        results.push(formatRiskResult(name, value, r2));
+  server2.tool(
+    "risk_set_values",
+    "Set risk values on an issue via RMP webtrigger. P1-P2 / RPN / CIA \uB3D9\uC2DC \uC785\uB825 \uAC00\uB2A5. \uC635\uC158\uC740 name \uBB38\uC790\uC5F4(UUID \uC790\uB3D9 \uB9E4\uD551). lookup \uC2E4\uD328 \uD56D\uBAA9\uC740 SKIP.",
+    {
+      issue_key: external_exports.string().describe("Issue key"),
+      project_key: external_exports.string().describe("Project key (for context)"),
+      risk_set: RISK_SET,
+      p1_p2_iso14971: p1P2Payload.optional(),
+      rpn: rpnPayload.optional(),
+      cia: ciaPayload.optional()
+    },
+    async ({ issue_key, project_key, risk_set, p1_p2_iso14971, rpn, cia }) => {
+      const tasks = [
+        { model: "p1_p2_iso14971", name: "P1-P2", res: planSetRisk("p1_p2_iso14971", risk_set, p1_p2_iso14971 ?? {}, issue_key), issueKey: issue_key },
+        { model: "rpn", name: "RPN", res: planSetRisk("rpn", risk_set, rpn ?? {}, issue_key), issueKey: issue_key },
+        { model: "cia", name: "CIA", res: planSetRisk("cia", risk_set, cia ?? {}, issue_key), issueKey: issue_key }
+      ];
+      const out = await runSetPlans(risk2, tasks);
+      const lines = [`Risk values for ${issue_key} (${risk_set} set):`];
+      if (out.details.length === 0 && (out.skipped ?? []).length === 0) {
+        lines.push(`(no risk values specified for ${project_key})`);
       }
+      for (const d2 of out.details) lines.push(formatSetDetail(d2));
+      for (const s2 of out.skipped ?? []) lines.push(`SKIPPED ${s2.classifier} (${s2.reason})`);
+      return { content: [{ type: "text", text: lines.join("\n") }] };
     }
-    return { content: [{ type: "text", text: `Risk values for ${issue_key} (${risk_set} set):
-${results.join("\n")}` }] };
-  });
-  server2.tool("risk_get_config", "Get risk management configuration for a project", {
-    project_key: external_exports.string().describe("Project key")
-  }, async ({ project_key }) => {
-    const config2 = getRiskConfig(project_key);
-    if (!config2) return { content: [{ type: "text", text: `No risk config for ${project_key}` }] };
-    return { content: [{ type: "text", text: JSON.stringify({
-      risk_model_key: config2.risk_model_key,
-      risk_sets: config2.risk_sets,
-      classifiers: Object.fromEntries(Object.entries(config2.classifiers).map(([k, v2]) => [k, { id: v2.id, options: Object.keys(v2.options) }])),
-      // 주의: 이 값은 하드코딩된 RISK_DEFAULTS 출력이지, project_key 에 해당하는
-      // 실제 Risk 앱 설정 조회가 아니다. set_values 실패 시 endpoint/token 문제일 수 있음.
-      diagnostic_note: "\uC774 \uC751\uB2F5\uC740 \uD558\uB4DC\uCF54\uB529\uB41C \uB2E8\uC77C \uC124\uC815 \uCD9C\uB825\uC784. \uC2E4\uC81C endpoint/token \uACFC \uC77C\uCE58\uD558\uB294\uC9C0 \uBCC4\uB3C4 \uD655\uC778 \uD544\uC694."
-    }, null, 2) }] };
-  });
-  server2.tool("risk_create_hazards", "Batch create Hazard tickets with Risk panel activation, risk values, and Risk Source links. Migrated from rmr_create_hazards.py.", {
-    project_key: external_exports.string().describe("Project key"),
-    rmr_key: external_exports.string().describe("RMR Document ticket key"),
+  );
+  server2.tool(
+    "risk_get_config",
+    "Get RMP risk model configuration for a project. Returns 3 model identifiers, classifier/option UUID \uD480, \uD658\uACBD \uC548\uB0B4.",
+    {
+      project_key: external_exports.string().describe("Project key")
+    },
+    async ({ project_key }) => {
+      const endpoint = process.env.RISK_PLUGIN_ENDPOINT ?? null;
+      const tokenPresent = !!process.env.RISK_PLUGIN_AUTH_TOKEN;
+      return { content: [{ type: "text", text: JSON.stringify({
+        endpoint,
+        token_present: tokenPresent,
+        diagnostic_note: "token\uC774 \uC5C6\uAC70\uB098 endpoint\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC73C\uBA74 setRiskValue \uD638\uCD9C\uC774 \uC2E4\uD328\uD569\uB2C8\uB2E4. /plugin configure \uB85C RISK_PLUGIN_ENDPOINT / RISK_PLUGIN_AUTH_TOKEN \uC744 \uC785\uB825.",
+        models: Object.fromEntries(
+          Object.keys(RISK_MODELS).map((k) => {
+            const m3 = RISK_MODELS[k];
+            return [k, {
+              label: m3.label,
+              modelKey: m3.modelKey,
+              riskSets: m3.riskSets,
+              classifiers: Object.fromEntries(
+                Object.entries(m3.classifiers).map(([cn, c]) => [cn, { id: c.id, options: Object.keys(c.options) }])
+              ),
+              ...m3.ciaWrapper ? { ciaWrapper: m3.ciaWrapper } : {}
+            }];
+          })
+        ),
+        project: project_key
+      }, null, 2) }] };
+    }
+  );
+  server2.tool("risk_create_hazards", "Batch create Hazard tickets with Risk Source links and (\uC120\uD0DD\uC801) 3 \uBAA8\uB378 risk values \uC790\uB3D9 \uC14B\uD305.", {
+    project_key: external_exports.string(),
+    rmr_key: external_exports.string(),
     hazards: external_exports.array(external_exports.object({
       summary: external_exports.string(),
       description: external_exports.string(),
       harm: external_exports.string(),
-      severity: external_exports.enum(["negligible", "minor", "serious", "critical", "catastrophic"]),
-      p1: external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]),
-      p2: external_exports.enum(["improvable", "remote", "occasional", "probable", "frequent"]),
-      source_keys: external_exports.array(external_exports.string()).describe("Related IU/SyRS ticket keys")
-    })).describe("Array of hazard definitions")
+      source_keys: external_exports.array(external_exports.string()),
+      p1_p2_iso14971: p1P2Payload.optional(),
+      rpn: rpnPayload.optional(),
+      cia: ciaPayload.optional()
+    }).strict())
   }, async ({ project_key, rmr_key, hazards }) => {
-    const riskConfig = getRiskConfig(project_key);
     const { textToAdf: textToAdf2 } = await Promise.resolve().then(() => (init_jira_client(), jira_client_exports));
     const results = [];
     const errors = [];
@@ -160215,50 +160433,45 @@ ${results.join("\n")}` }] };
           continue;
         }
         await risk2.activateRiskPanel(issueKey);
-        let riskOk = true;
-        const riskDetails = [];
-        if (riskConfig) {
-          for (const setName of ["initial", "current"]) {
-            const setConfig = {
-              endpoint: riskConfig.endpoint,
-              author: riskConfig.author,
-              riskModelKey: riskConfig.risk_model_key,
-              riskSetId: riskConfig.risk_sets[setName],
-              classifiers: riskConfig.classifiers
-            };
-            for (const [name, value] of [["severity", h2.severity], ["p1", h2.p1], ["p2", h2.p2]]) {
-              const r2 = await risk2.setRiskValue(issueKey, setConfig, name, value);
-              if (!r2.ok) riskOk = false;
-              riskDetails.push(`${setName}.${name}=${value}: ${r2.ok ? "OK" : "FAILED"} (${r2.error ?? `status=${r2.status}${r2.body ? `, body=${r2.body}` : ""}`})`);
-            }
-          }
-        } else {
-          riskOk = false;
-          riskDetails.push("no risk config for project");
-        }
+        const tasks = [
+          { model: "p1_p2_iso14971", name: "P1-P2", res: planSetRisk("p1_p2_iso14971", "initial", h2.p1_p2_iso14971 ?? {}, issueKey), issueKey },
+          { model: "rpn", name: "RPN", res: planSetRisk("rpn", "initial", h2.rpn ?? {}, issueKey), issueKey },
+          { model: "cia", name: "CIA", res: planSetRisk("cia", "initial", h2.cia ?? {}, issueKey), issueKey }
+        ];
+        const out = await runSetPlans(risk2, tasks);
+        const riskOk = out.details.every((d2) => d2.result.ok);
+        const riskSkipped = out.skipped ?? [];
         for (const srcKey of h2.source_keys) {
           await jira2.createLink("Risk Source", issueKey, srcKey);
         }
         await jira2.createLink("Relates", issueKey, rmr_key);
-        results.push({ key: issueKey, summary: h2.summary, status: "created", risk_values: { ok: riskOk, details: riskDetails } });
+        results.push({
+          key: issueKey,
+          summary: h2.summary,
+          status: "created",
+          risk_values: {
+            ok: riskOk,
+            details: out.details.map(formatSetDetail),
+            skipped: riskSkipped
+          }
+        });
       } catch (e2) {
         errors.push(`${h2.summary}: ${e2.message}`);
       }
     }
     return { content: [{ type: "text", text: JSON.stringify({ created: results.length, failed: errors.length, results, errors }, null, 2) }] };
   });
-  server2.tool("risk_create_mitigation", "Create mitigation Requirements, link to Hazards, and update Hazard Current P2. Migrated from srs_create_requirements.py.", {
-    project_key: external_exports.string().describe("Project key"),
-    srs_key: external_exports.string().describe("SRS Document ticket key"),
+  server2.tool("risk_create_mitigation", "Create mitigation Requirements, link to Hazards, and update Hazard Current P2 (P1-P2 \uBAA8\uB378).", {
+    project_key: external_exports.string(),
+    srs_key: external_exports.string(),
     requirements: external_exports.array(external_exports.object({
       summary: external_exports.string(),
       description: external_exports.string(),
-      mitigates: external_exports.array(external_exports.string()).describe("Hazard keys this requirement mitigates"),
-      implements: external_exports.array(external_exports.string()).describe("System Requirement keys this implements")
+      mitigates: external_exports.array(external_exports.string()),
+      implements: external_exports.array(external_exports.string())
     })),
-    hazard_risk_updates: external_exports.record(external_exports.object({ p2: external_exports.string() })).describe("Hazard key \u2192 new P2 value mapping")
+    hazard_risk_updates: external_exports.record(external_exports.object({ p2: external_exports.string() }))
   }, async ({ project_key, srs_key, requirements, hazard_risk_updates }) => {
-    const riskConfig = getRiskConfig(project_key);
     const { textToAdf: textToAdf2 } = await Promise.resolve().then(() => (init_jira_client(), jira_client_exports));
     const results = [];
     const errors = [];
@@ -160288,20 +160501,15 @@ ${results.join("\n")}` }] };
       }
     }
     const riskUpdates = [];
-    if (riskConfig) {
-      const currentConfig = {
-        endpoint: riskConfig.endpoint,
-        author: riskConfig.author,
-        riskModelKey: riskConfig.risk_model_key,
-        riskSetId: riskConfig.risk_sets.current,
-        classifiers: riskConfig.classifiers
-      };
-      for (const [hazKey, update] of Object.entries(hazard_risk_updates)) {
-        const r2 = await risk2.setRiskValue(hazKey, currentConfig, "p2", update.p2);
-        riskUpdates.push(`${hazKey} P2\u2192${update.p2}: ${r2.ok ? "OK" : "FAILED"} (${r2.error ?? `status=${r2.status}${r2.body ? `, body=${r2.body}` : ""}`})`);
+    for (const [hazKey, update] of Object.entries(hazard_risk_updates)) {
+      const plan = planSetRisk("p1_p2_iso14971", "current", { p2: update.p2 }, hazKey);
+      if (plan.skipped.length > 0) {
+        riskUpdates.push(`SKIPPED ${hazKey} P2=${update.p2} (option-not-mapped)`);
+        continue;
       }
-    } else {
-      riskUpdates.push("no risk config for project \u2014 P2 update skipped");
+      const { payload } = plan.items[0];
+      const r2 = await risk2.setRiskValueRaw(hazKey, payload);
+      riskUpdates.push(formatSetDetail({ model: "P1-P2", classifier: "p2", optionName: update.p2, result: r2 }));
     }
     return { content: [{ type: "text", text: JSON.stringify({ requirements_created: results.length, results, risk_updates: riskUpdates, errors }, null, 2) }] };
   });
@@ -184760,7 +184968,7 @@ var xrayClientSecret = process.env.XRAY_CLIENT_SECRET || "";
 var xray = xrayClientId && xrayClientSecret ? new XrayClient(xrayClientId, xrayClientSecret, jiraUrl, jiraEmail, jiraToken) : null;
 var server = new McpServer({
   name: "jira-confluence",
-  version: "0.1.20"
+  version: "0.1.21"
 });
 var ctx = { server, jira, confluence, risk, xray };
 registerJiraCrudTools(ctx);