@nimbus-dev/connectors 0.2.1 → 0.2.2

package/connectors/readwise/src/server.ts

@@ -1,92 +1,6 @@
-import { z } from "zod";
-import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterReadwiseBooks, filterReadwiseHighlights } from "./search-filter.ts";
-
-const BASE = "https://readwise.io";
-
-function apiToken(): string {
-  const t = process.env["READWISE_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("READWISE_TOKEN is not set");
-  }
-  return t;
-}
-
-function authHeader(): Record<string, string> {
-  return { Authorization: `Token ${apiToken()}`, Accept: "application/json" };
-}
-
-async function readwiseGet(path: string): Promise<unknown> {
-  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Readwise ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
+import { registerReadwiseTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-readwise", (reg) => {
-  reg(
-    "readwise_list",
-    "List the user's Readwise highlights (`GET /api/v2/highlights/?page_size=1000`). Returns the DRF `{ count, next, previous, results: [...] }` envelope — `results` holds the highlight objects and `next` is the next-page URL (null on the last page).",
-    z.object({}),
-    async () => {
-      return jsonResult(await readwiseGet(`/api/v2/highlights/?page_size=1000`));
-    },
-  );
-
-  reg(
-    "readwise_get",
-    "Fetch one Readwise highlight by its id (`GET /api/v2/highlights/{id}/`). Returns the highlight object directly. Throws when no match is found.",
-    z.object({
-      id: z.string().min(1),
-    }),
-    async (p) => {
-      return jsonResult(await readwiseGet(`/api/v2/highlights/${encodeURIComponent(p.id)}/`));
-    },
-  );
-
-  reg(
-    "readwise_search",
-    "Substring search across the user's Readwise highlights (first page only). Matches the query against the highlight text, the user's note, color, location_type, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    searchToolInputSchema(100),
-    async (p) => {
-      const root = await readwiseGet(`/api/v2/highlights/?page_size=1000`);
-      const results = (root as { results?: unknown[] } | null)?.results;
-      return matchesResult(results, filterReadwiseHighlights, p);
-    },
-  );
-
-  reg(
-    "readwise_books_list",
-    "List the user's Readwise books/articles (`GET /api/v2/books/?page_size=1000`) — the parent records a highlight's `book_id` points at. Returns the same DRF `{ count, next, previous, results: [...] }` envelope as `readwise_list`; `results` holds the book objects (`id`, `title`, `author`, `category`, `source`, `num_highlights`, `highlights_url`, `source_url`, `asin`, `tags`, `document_note`).",
-    z.object({}),
-    async () => {
-      return jsonResult(await readwiseGet(`/api/v2/books/?page_size=1000`));
-    },
-  );
-
-  reg(
-    "readwise_book_get",
-    "Fetch one Readwise book/article by its id (`GET /api/v2/books/{id}/`). Note the id space is SEPARATE from the highlight id space — pass a highlight's `book_id`, not its `id`. Returns the book object directly. Throws when no match is found.",
-    z.object({
-      id: z.string().min(1),
-    }),
-    async (p) => {
-      return jsonResult(await readwiseGet(`/api/v2/books/${encodeURIComponent(p.id)}/`));
-    },
-  );
-
-  reg(
-    "readwise_books_search",
-    "Substring search across the user's Readwise books/articles (first page only). Matches the query against the title, author, category, source, the user's document note, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    searchToolInputSchema(100),
-    async (p) => {
-      const root = await readwiseGet(`/api/v2/books/?page_size=1000`);
-      const results = (root as { results?: unknown[] } | null)?.results;
-      return matchesResult(results, filterReadwiseBooks, p);
-    },
-  );
+  registerReadwiseTools(reg);
 });

package/connectors/readwise/src/tools.ts

@@ -0,0 +1,81 @@
+import {
+  type CollectionToolsConfig,
+  collectionToolNames,
+  envelopeRows,
+  registerCollectionTools,
+} from "../../../shared/collection-tool-kit.ts";
+import { createJsonGetter, envAuthHeaders } from "../../../shared/env-json-api.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterReadwiseBooks, filterReadwiseHighlights } from "./search-filter.ts";
+
+const BASE = "https://readwise.io";
+const HIGHLIGHTS = "/api/v2/highlights/?page_size=1000";
+const BOOKS = "/api/v2/books/?page_size=1000";
+
+/** Readwise authenticates with `Authorization: Token <key>`, not Bearer. */
+const readwiseGet = createJsonGetter({
+  base: BASE,
+  label: "Readwise",
+  headers: envAuthHeaders({ env: "READWISE_TOKEN", scheme: "Token" }),
+});
+
+/**
+ * Readwise exposes two collections with separate id spaces. Both are the plain
+ * list/get/search triple, so both are declarations rather than hand-written
+ * handlers; only the books collection needs non-default tool names.
+ */
+const HIGHLIGHT_TOOLS: CollectionToolsConfig = {
+  prefix: "readwise",
+  get: readwiseGet,
+  list: {
+    path: HIGHLIGHTS,
+    description:
+      "List the user's Readwise highlights (`GET /api/v2/highlights/?page_size=1000`). Returns the DRF `{ count, next, previous, results: [...] }` envelope — `results` holds the highlight objects and `next` is the next-page URL (null on the last page).",
+  },
+  item: {
+    path: (id) => `/api/v2/highlights/${id}/`,
+    description:
+      "Fetch one Readwise highlight by its id (`GET /api/v2/highlights/{id}/`). Returns the highlight object directly. Throws when no match is found.",
+  },
+  search: {
+    description:
+      "Substring search across the user's Readwise highlights (first page only). Matches the query against the highlight text, the user's note, color, location_type, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    rows: envelopeRows("results"),
+    filter: filterReadwiseHighlights,
+  },
+};
+
+const BOOK_TOOLS: CollectionToolsConfig = {
+  prefix: "readwise",
+  get: readwiseGet,
+  list: {
+    path: BOOKS,
+    tool: "books_list",
+    description:
+      "List the user's Readwise books/articles (`GET /api/v2/books/?page_size=1000`) — the parent records a highlight's `book_id` points at. Returns the same DRF `{ count, next, previous, results: [...] }` envelope as `readwise_list`; `results` holds the book objects (`id`, `title`, `author`, `category`, `source`, `num_highlights`, `highlights_url`, `source_url`, `asin`, `tags`, `document_note`).",
+  },
+  item: {
+    path: (id) => `/api/v2/books/${id}/`,
+    tool: "book_get",
+    description:
+      "Fetch one Readwise book/article by its id (`GET /api/v2/books/{id}/`). Note the id space is SEPARATE from the highlight id space — pass a highlight's `book_id`, not its `id`. Returns the book object directly. Throws when no match is found.",
+  },
+  search: {
+    tool: "books_search",
+    description:
+      "Substring search across the user's Readwise books/articles (first page only). Matches the query against the title, author, category, source, the user's document note, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    rows: envelopeRows("results"),
+    filter: filterReadwiseBooks,
+  },
+};
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const READWISE_TOOL_NAMES = [
+  ...collectionToolNames(HIGHLIGHT_TOOLS),
+  ...collectionToolNames(BOOK_TOOLS),
+] as const;
+
+export function registerReadwiseTools(reg: ZodToolRegistrar): void {
+  registerCollectionTools(reg, HIGHLIGHT_TOOLS);
+  registerCollectionTools(reg, BOOK_TOOLS);
+}

package/connectors/sagemaker/src/tools.ts

@@ -1,19 +1,21 @@
 import { z } from "zod";
+import {
+  asArray,
+  cliArg,
+  createCliJsonRunner,
+  isRecord,
+  strField,
+} from "../../../shared/cli-json-kit.ts";
 import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { nimbusSpawn } from "../../../shared/nimbus-spawn.ts";
 import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
-import { isSafeCliArg } from "../../../shared/safe-cli-arg.ts";
 
 /**
- * A SageMaker model name passed as a value to the `aws sagemaker` CLI. Rejected
- * at the schema boundary if it begins with `-` (argv flag smuggling) or contains
- * control characters. Exported so the contract test can assert the guard rejects
- * a `-`-prefixed value.
+ * The argv-injection guard every SageMaker model name passes through on its way to the
+ * `aws sagemaker` CLI. Re-exported so this connector's own test can assert the guard rejects a
+ * `-`-prefixed value.
  */
-export const cliArg = z
-  .string()
-  .min(1)
-  .refine(isSafeCliArg, { message: 'must not start with "-" or contain control characters' });
+export { cliArg };
 
 /**
  * Amazon SageMaker (Tier-3, metadata-only) MCP tool surface. ALL tools index
@@ -32,40 +34,19 @@ export const SAGEMAKER_TOOL_NAMES = [
 
 const PAGE = "50";
 
-function isRecord(v: unknown): v is Record<string, unknown> {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-
-function strField(r: Record<string, unknown>, key: string): string {
-  const v = r[key];
-  return typeof v === "string" ? v : "";
-}
-
-function asArray(parsed: unknown, key: string): unknown[] {
-  if (!isRecord(parsed)) {
-    return [];
-  }
-  const arr = parsed[key];
-  return Array.isArray(arr) ? arr : [];
-}
-
 /**
  * Run `aws sagemaker <args> --output json` and parse stdout. The AWS CLI reads
  * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_DEFAULT_REGION / AWS_PROFILE
  * natively from the process env injected at spawn time. Throws on non-zero exit.
  */
-async function sagemakerCli(args: string[]): Promise<unknown> {
-  const { code, stdout, stderr } = await nimbusSpawn(
-    ["aws", "sagemaker", ...args, "--output", "json"],
-    {},
-  );
-  const out = stdout.trim();
-  const err = stderr.trim();
-  if (code !== 0) {
-    throw new Error(`aws sagemaker ${args[0] ?? ""} failed: ${err.slice(0, 400)}`);
-  }
-  return out === "" ? {} : (JSON.parse(out) as unknown);
-}
+const sagemakerCli = createCliJsonRunner(
+  {
+    argv: (args) => ["aws", "sagemaker", ...args, "--output", "json"],
+    label: "aws sagemaker",
+    emptyResult: {},
+  },
+  nimbusSpawn,
+);
 
 function modelMatches(entry: unknown, q: string): boolean {
   if (!isRecord(entry)) {

package/connectors/salesforce/src/search-filter.ts

@@ -1,8 +1,7 @@
 import {
-  asObjectish,
+  fieldsFromKeys,
   makeQueryFilter,
   type SearchMatchOptions,
-  stringField,
 } from "../../../shared/search-filter.ts";
 
 export type SalesforceSearchMatchOptions = SearchMatchOptions;
@@ -12,12 +11,6 @@ export type SalesforceSearchMatchOptions = SearchMatchOptions;
  * `{ Id, Name, StageName, Amount, CloseDate, Type, ... }`. Match (case-insensitive
  * substring) against the opportunity name, its stage, and its type.
  */
-function fieldsOf(item: unknown): readonly string[] | null {
-  const row = asObjectish(item);
-  if (row === undefined) {
-    return null;
-  }
-  return [stringField(row, "Name"), stringField(row, "StageName"), stringField(row, "Type")];
-}
-
-export const filterSalesforceOpportunities = makeQueryFilter(fieldsOf);
+export const filterSalesforceOpportunities = makeQueryFilter(
+  fieldsFromKeys(["Name", "StageName", "Type"]),
+);

package/connectors/salesforce/src/server.ts

@@ -1,94 +1,6 @@
-import { z } from "zod";
-import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterSalesforceOpportunities } from "./search-filter.ts";
-
-const API_VERSION = "v60.0";
-const OPPORTUNITY_FIELDS =
-  "Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate";
-
-function accessToken(): string {
-  const t = process.env["SALESFORCE_ACCESS_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("SALESFORCE_ACCESS_TOKEN is not set");
-  }
-  return t;
-}
-
-function instanceUrl(): string {
-  let raw = process.env["SALESFORCE_INSTANCE_URL"]?.trim();
-  if (raw === undefined || raw === "") {
-    throw new Error("SALESFORCE_INSTANCE_URL is not set");
-  }
-  // Strip trailing slashes without a backtracking regex.
-  while (raw.endsWith("/")) {
-    raw = raw.slice(0, -1);
-  }
-  return raw;
-}
-
-function authHeader(): Record<string, string> {
-  return { Authorization: `Bearer ${accessToken()}`, Accept: "application/json" };
-}
-
-async function salesforceGet(path: string): Promise<unknown> {
-  const res = await fetch(`${instanceUrl()}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Salesforce ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
-
-function recordsFrom(root: unknown): unknown[] {
-  const records = (root as { records?: unknown } | null)?.records;
-  return Array.isArray(records) ? records : [];
-}
-
-function listQueryPath(limit: number): string {
-  const soql = `SELECT ${OPPORTUNITY_FIELDS} FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT ${String(limit)}`;
-  return `/services/data/${API_VERSION}/query?q=${encodeURIComponent(soql)}`;
-}
+import { registerSalesforceTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-salesforce", (reg) => {
-  reg(
-    "salesforce_list",
-    "List the authenticated org's Salesforce Opportunities via the SOQL query API (GET <instance_url>/services/data/v60.0/query?q=SELECT ... FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT N). Returns the { totalSize, done, records: [...], nextRecordsUrl? } envelope — `records` holds the Opportunity objects, each shaped { Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate }. `limit` (default 200) caps the single first-page request; when `done` is false a `nextRecordsUrl` cursor is present for the next page (the local Nimbus index has full coverage).",
-    z.object({
-      limit: z.number().int().min(1).max(2000).optional(),
-    }),
-    async (p) => {
-      return jsonResult(await salesforceGet(listQueryPath(p.limit ?? 200)));
-    },
-  );
-
-  reg(
-    "salesforce_get",
-    "Fetch one Salesforce Opportunity by its 15- or 18-character Id (GET <instance_url>/services/data/v60.0/sobjects/Opportunity/<id>). Returns the Opportunity object directly (NOT wrapped in `records`). Throws when no Opportunity with that id exists or is accessible.",
-    z.object({
-      id: z.string().min(1),
-    }),
-    async (p) => {
-      return jsonResult(
-        await salesforceGet(
-          `/services/data/${API_VERSION}/sobjects/Opportunity/${encodeURIComponent(p.id)}`,
-        ),
-      );
-    },
-  );
-
-  reg(
-    "salesforce_search",
-    "**Substring search over the FIRST PAGE only** (up to the queried limit of most-recently-modified Opportunities) of the authenticated org's Salesforce Opportunities. This tool runs the SOQL query once and matches the query locally (case-insensitive) against each opportunity's name, stage, and type. **Opportunities beyond the first page are not searchable here — query the local Nimbus index instead for full coverage.** Returns a { matches: [...] } envelope.",
-    searchToolInputSchema(2000),
-    async (p) => {
-      const root = await salesforceGet(listQueryPath(2000));
-      const matches = filterSalesforceOpportunities(recordsFrom(root), {
-        query: p.query,
-        limit: p.limit,
-      });
-      return jsonResult({ matches });
-    },
-  );
+  registerSalesforceTools(reg);
 });

package/connectors/salesforce/src/tools.ts

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders, requiredBaseUrl } from "../../../shared/env-json-api.ts";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSalesforceOpportunities } from "./search-filter.ts";
+
+const API_VERSION = "v60.0";
+const OPPORTUNITY_FIELDS =
+  "Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate";
+
+const salesforceGet = createJsonGetter({
+  base: () => requiredBaseUrl("SALESFORCE_INSTANCE_URL"),
+  label: "Salesforce",
+  headers: envAuthHeaders({ env: "SALESFORCE_ACCESS_TOKEN" }),
+});
+
+function recordsFrom(root: unknown): unknown[] {
+  const records = (root as { records?: unknown } | null)?.records;
+  return Array.isArray(records) ? records : [];
+}
+
+function listQueryPath(limit: number): string {
+  const soql = `SELECT ${OPPORTUNITY_FIELDS} FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT ${String(limit)}`;
+  return `/services/data/${API_VERSION}/query?q=${encodeURIComponent(soql)}`;
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const SALESFORCE_TOOL_NAMES = [
+  "salesforce_list",
+  "salesforce_get",
+  "salesforce_search",
+] as const;
+
+export function registerSalesforceTools(reg: ZodToolRegistrar): void {
+  reg(
+    "salesforce_list",
+    "List the authenticated org's Salesforce Opportunities via the SOQL query API (GET <instance_url>/services/data/v60.0/query?q=SELECT ... FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT N). Returns the { totalSize, done, records: [...], nextRecordsUrl? } envelope — `records` holds the Opportunity objects, each shaped { Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate }. `limit` (default 200) caps the single first-page request; when `done` is false a `nextRecordsUrl` cursor is present for the next page (the local Nimbus index has full coverage).",
+    z.object({
+      limit: z.number().int().min(1).max(2000).optional(),
+    }),
+    async (p) => {
+      return jsonResult(await salesforceGet(listQueryPath(p.limit ?? 200)));
+    },
+  );
+
+  reg(
+    "salesforce_get",
+    "Fetch one Salesforce Opportunity by its 15- or 18-character Id (GET <instance_url>/services/data/v60.0/sobjects/Opportunity/<id>). Returns the Opportunity object directly (NOT wrapped in `records`). Throws when no Opportunity with that id exists or is accessible.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(
+        await salesforceGet(
+          `/services/data/${API_VERSION}/sobjects/Opportunity/${encodeURIComponent(p.id)}`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "salesforce_search",
+    "**Substring search over the FIRST PAGE only** (up to the queried limit of most-recently-modified Opportunities) of the authenticated org's Salesforce Opportunities. This tool runs the SOQL query once and matches the query locally (case-insensitive) against each opportunity's name, stage, and type. **Opportunities beyond the first page are not searchable here — query the local Nimbus index instead for full coverage.** Returns a { matches: [...] } envelope.",
+    searchToolInputSchema(2000),
+    async (p) => {
+      const root = await salesforceGet(listQueryPath(2000));
+      const matches = filterSalesforceOpportunities(recordsFrom(root), {
+        query: p.query,
+        limit: p.limit,
+      });
+      return jsonResult({ matches });
+    },
+  );
+}

package/connectors/semgrep/src/search-filter.ts

@@ -1,20 +1,13 @@
 import {
   asObjectish,
   makeQueryFilter,
+  nestedString,
   type SearchMatchOptions,
   stringField,
 } from "../../../shared/search-filter.ts";
 
 export type SemgrepSearchMatchOptions = SearchMatchOptions;
 
-function nestedString(row: Record<string, unknown>, parent: string, key: string): string {
-  const p = row[parent];
-  if (p === null || typeof p !== "object") {
-    return "";
-  }
-  return stringField(p as Record<string, unknown>, key);
-}
-
 function fieldsOf(item: unknown): readonly string[] | null {
   const row = asObjectish(item);
   if (row === undefined) {
@@ -23,8 +16,8 @@ function fieldsOf(item: unknown): readonly string[] | null {
   return [
     stringField(row, "rule_name"),
     stringField(row, "rule_message"),
-    nestedString(row, "location", "file_path"),
-    nestedString(row, "repository", "name"),
+    nestedString(row, ["location", "file_path"]),
+    nestedString(row, ["repository", "name"]),
   ];
 }
 

package/connectors/semgrep/src/server.ts

@@ -1,108 +1,6 @@
-import { z } from "zod";
-import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterSemgrepFindings } from "./search-filter.ts";
-
-const SEMGREP_API = "https://semgrep.dev/api/v1";
-const SEVERITIES = ["critical", "high", "medium", "low", "info"] as const;
-const STATUSES = ["open", "ignored", "fixed", "removed"] as const;
-
-function deploymentSlug(): string | undefined {
-  const v = process.env["SEMGREP_DEPLOYMENT_SLUG"]?.trim();
-  return v === undefined || v === "" ? undefined : v;
-}
-
-function authHeader(): Record<string, string> {
-  const t = process.env["SEMGREP_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("SEMGREP_TOKEN is not set");
-  }
-  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
-}
-
-async function semgrepGet(path: string): Promise<unknown> {
-  const res = await fetch(`${SEMGREP_API}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Semgrep ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
-
-function requireSlug(): string {
-  const slug = deploymentSlug();
-  if (slug === undefined) {
-    throw new Error("SEMGREP_DEPLOYMENT_SLUG is not set");
-  }
-  return slug;
-}
+import { registerSemgrepTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-semgrep", (reg) => {
-  reg(
-    "semgrep_list",
-    "List Semgrep deployments, or open findings for the configured deployment. When called without filters, returns the user's deployments (`/deployments`). Provide a `severity` or `status` filter to query findings under the deployment slug from `SEMGREP_DEPLOYMENT_SLUG` env.",
-    z.object({
-      severity: z.array(z.enum(SEVERITIES)).min(1).optional(),
-      status: z.array(z.enum(STATUSES)).min(1).optional(),
-      repository: z.string().min(1).optional(),
-      limit: z.number().int().min(1).max(500).optional(),
-    }),
-    async (p) => {
-      if (p.severity === undefined && p.status === undefined && p.repository === undefined) {
-        return jsonResult(await semgrepGet("/deployments"));
-      }
-      const slug = requireSlug();
-      const search = new URLSearchParams({
-        page_size: String(p.limit ?? 100),
-      });
-      if (p.severity !== undefined && p.severity.length > 0) {
-        search.set("severities", p.severity.join(","));
-      }
-      if (p.status !== undefined && p.status.length > 0) {
-        search.set("statuses", p.status.join(","));
-      }
-      if (p.repository !== undefined) {
-        search.set("repos", p.repository);
-      }
-      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
-      return jsonResult(await semgrepGet(path));
-    },
-  );
-
-  reg(
-    "semgrep_get",
-    "Fetch one Semgrep finding by id from the configured deployment. Returns the matching finding envelope; throws when no match is found.",
-    z.object({
-      findingId: z.string().min(1),
-    }),
-    async (p) => {
-      const slug = requireSlug();
-      const search = new URLSearchParams({ ids: p.findingId, page_size: "1" });
-      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
-      const root = await semgrepGet(path);
-      const findings = (root as { findings?: unknown[] } | null)?.findings;
-      if (!Array.isArray(findings) || findings.length === 0) {
-        throw new Error(`Semgrep: finding ${p.findingId} not found`);
-      }
-      return jsonResult(findings[0]);
-    },
-  );
-
-  reg(
-    "semgrep_search",
-    "Substring search across the deployment's open findings. Matches the query against `rule_name`, `rule_message`, `location.file_path`, and `repository.name` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    searchToolInputSchema(200),
-    async (p) => {
-      const slug = requireSlug();
-      const search = new URLSearchParams({
-        statuses: "open",
-        page_size: "500",
-      });
-      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
-      const root = await semgrepGet(path);
-      const findings = (root as { findings?: unknown[] } | null)?.findings;
-      return matchesResult(findings, filterSemgrepFindings, p);
-    },
-  );
+  registerSemgrepTools(reg);
 });