@openziti/ziti-mcp-server 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (210) hide show
  1. package/LICENSE +201 -0
  2. package/README.md +868 -0
  3. package/dist/auth/client-credentials-flow.d.ts +21 -0
  4. package/dist/auth/client-credentials-flow.js +63 -0
  5. package/dist/auth/client-credentials-flow.js.map +1 -0
  6. package/dist/auth/device-auth-flow.d.ts +47 -0
  7. package/dist/auth/device-auth-flow.js +291 -0
  8. package/dist/auth/device-auth-flow.js.map +1 -0
  9. package/dist/clients/base.d.ts +74 -0
  10. package/dist/clients/base.js +109 -0
  11. package/dist/clients/base.js.map +1 -0
  12. package/dist/clients/claude.d.ts +22 -0
  13. package/dist/clients/claude.js +40 -0
  14. package/dist/clients/claude.js.map +1 -0
  15. package/dist/clients/cursor.d.ts +22 -0
  16. package/dist/clients/cursor.js +39 -0
  17. package/dist/clients/cursor.js.map +1 -0
  18. package/dist/clients/index.d.ts +33 -0
  19. package/dist/clients/index.js +39 -0
  20. package/dist/clients/index.js.map +1 -0
  21. package/dist/clients/types.d.ts +70 -0
  22. package/dist/clients/types.js +2 -0
  23. package/dist/clients/types.js.map +1 -0
  24. package/dist/clients/utils.d.ts +22 -0
  25. package/dist/clients/utils.js +46 -0
  26. package/dist/clients/utils.js.map +1 -0
  27. package/dist/clients/vscode.d.ts +76 -0
  28. package/dist/clients/vscode.js +159 -0
  29. package/dist/clients/vscode.js.map +1 -0
  30. package/dist/clients/windsurf.d.ts +22 -0
  31. package/dist/clients/windsurf.js +39 -0
  32. package/dist/clients/windsurf.js.map +1 -0
  33. package/dist/commands/init.d.ts +45 -0
  34. package/dist/commands/init.js +133 -0
  35. package/dist/commands/init.js.map +1 -0
  36. package/dist/commands/logout.d.ts +12 -0
  37. package/dist/commands/logout.js +90 -0
  38. package/dist/commands/logout.js.map +1 -0
  39. package/dist/commands/run.d.ts +15 -0
  40. package/dist/commands/run.js +94 -0
  41. package/dist/commands/run.js.map +1 -0
  42. package/dist/commands/session.d.ts +12 -0
  43. package/dist/commands/session.js +99 -0
  44. package/dist/commands/session.js.map +1 -0
  45. package/dist/index.d.ts +2 -0
  46. package/dist/index.js +105 -0
  47. package/dist/index.js.map +1 -0
  48. package/dist/server.d.ts +67 -0
  49. package/dist/server.js +171 -0
  50. package/dist/server.js.map +1 -0
  51. package/dist/tools/api-sessions.d.ts +3 -0
  52. package/dist/tools/api-sessions.js +86 -0
  53. package/dist/tools/api-sessions.js.map +1 -0
  54. package/dist/tools/auth-policies.d.ts +3 -0
  55. package/dist/tools/auth-policies.js +347 -0
  56. package/dist/tools/auth-policies.js.map +1 -0
  57. package/dist/tools/authenticators.d.ts +3 -0
  58. package/dist/tools/authenticators.js +183 -0
  59. package/dist/tools/authenticators.js.map +1 -0
  60. package/dist/tools/certificate-authorities.d.ts +3 -0
  61. package/dist/tools/certificate-authorities.js +288 -0
  62. package/dist/tools/certificate-authorities.js.map +1 -0
  63. package/dist/tools/config-types.d.ts +3 -0
  64. package/dist/tools/config-types.js +194 -0
  65. package/dist/tools/config-types.js.map +1 -0
  66. package/dist/tools/configs.d.ts +3 -0
  67. package/dist/tools/configs.js +203 -0
  68. package/dist/tools/configs.js.map +1 -0
  69. package/dist/tools/controller-settings.d.ts +3 -0
  70. package/dist/tools/controller-settings.js +219 -0
  71. package/dist/tools/controller-settings.js.map +1 -0
  72. package/dist/tools/controllers.d.ts +3 -0
  73. package/dist/tools/controllers.js +89 -0
  74. package/dist/tools/controllers.js.map +1 -0
  75. package/dist/tools/edge-router-policies.d.ts +3 -0
  76. package/dist/tools/edge-router-policies.js +262 -0
  77. package/dist/tools/edge-router-policies.js.map +1 -0
  78. package/dist/tools/edge-routers.d.ts +3 -0
  79. package/dist/tools/edge-routers.js +381 -0
  80. package/dist/tools/edge-routers.js.map +1 -0
  81. package/dist/tools/enrollments.d.ts +3 -0
  82. package/dist/tools/enrollments.js +187 -0
  83. package/dist/tools/enrollments.js.map +1 -0
  84. package/dist/tools/external-jwt-signers.d.ts +3 -0
  85. package/dist/tools/external-jwt-signers.js +242 -0
  86. package/dist/tools/external-jwt-signers.js.map +1 -0
  87. package/dist/tools/identities.d.ts +3 -0
  88. package/dist/tools/identities.js +741 -0
  89. package/dist/tools/identities.js.map +1 -0
  90. package/dist/tools/identity-types.d.ts +3 -0
  91. package/dist/tools/identity-types.js +58 -0
  92. package/dist/tools/identity-types.js.map +1 -0
  93. package/dist/tools/index.d.ts +3 -0
  94. package/dist/tools/index.js +101 -0
  95. package/dist/tools/index.js.map +1 -0
  96. package/dist/tools/posture-checks.d.ts +3 -0
  97. package/dist/tools/posture-checks.js +254 -0
  98. package/dist/tools/posture-checks.js.map +1 -0
  99. package/dist/tools/routers.d.ts +3 -0
  100. package/dist/tools/routers.js +169 -0
  101. package/dist/tools/routers.js.map +1 -0
  102. package/dist/tools/service-edge-router-policies.d.ts +3 -0
  103. package/dist/tools/service-edge-router-policies.js +282 -0
  104. package/dist/tools/service-edge-router-policies.js.map +1 -0
  105. package/dist/tools/service-policies.d.ts +3 -0
  106. package/dist/tools/service-policies.js +311 -0
  107. package/dist/tools/service-policies.js.map +1 -0
  108. package/dist/tools/services.d.ts +3 -0
  109. package/dist/tools/services.js +403 -0
  110. package/dist/tools/services.js.map +1 -0
  111. package/dist/tools/sessions.d.ts +3 -0
  112. package/dist/tools/sessions.js +86 -0
  113. package/dist/tools/sessions.js.map +1 -0
  114. package/dist/tools/terminators.d.ts +3 -0
  115. package/dist/tools/terminators.js +187 -0
  116. package/dist/tools/terminators.js.map +1 -0
  117. package/dist/tools/transit-routers.d.ts +3 -0
  118. package/dist/tools/transit-routers.js +169 -0
  119. package/dist/tools/transit-routers.js.map +1 -0
  120. package/dist/utils/analytics.d.ts +75 -0
  121. package/dist/utils/analytics.js +191 -0
  122. package/dist/utils/analytics.js.map +1 -0
  123. package/dist/utils/auth0-client.d.ts +27 -0
  124. package/dist/utils/auth0-client.js +67 -0
  125. package/dist/utils/auth0-client.js.map +1 -0
  126. package/dist/utils/authenticated-client.d.ts +6 -0
  127. package/dist/utils/authenticated-client.js +55 -0
  128. package/dist/utils/authenticated-client.js.map +1 -0
  129. package/dist/utils/config.d.ts +65 -0
  130. package/dist/utils/config.js +80 -0
  131. package/dist/utils/config.js.map +1 -0
  132. package/dist/utils/constants.d.ts +15 -0
  133. package/dist/utils/constants.js +17 -0
  134. package/dist/utils/constants.js.map +1 -0
  135. package/dist/utils/controller-client/client/client.gen.d.ts +2 -0
  136. package/dist/utils/controller-client/client/client.gen.js +229 -0
  137. package/dist/utils/controller-client/client/client.gen.js.map +1 -0
  138. package/dist/utils/controller-client/client/index.d.ts +8 -0
  139. package/dist/utils/controller-client/client/index.js +7 -0
  140. package/dist/utils/controller-client/client/index.js.map +1 -0
  141. package/dist/utils/controller-client/client/types.gen.d.ts +117 -0
  142. package/dist/utils/controller-client/client/types.gen.js +3 -0
  143. package/dist/utils/controller-client/client/types.gen.js.map +1 -0
  144. package/dist/utils/controller-client/client/utils.gen.d.ts +33 -0
  145. package/dist/utils/controller-client/client/utils.gen.js +232 -0
  146. package/dist/utils/controller-client/client/utils.gen.js.map +1 -0
  147. package/dist/utils/controller-client/client.gen.d.ts +12 -0
  148. package/dist/utils/controller-client/client.gen.js +6 -0
  149. package/dist/utils/controller-client/client.gen.js.map +1 -0
  150. package/dist/utils/controller-client/core/auth.gen.d.ts +18 -0
  151. package/dist/utils/controller-client/core/auth.gen.js +15 -0
  152. package/dist/utils/controller-client/core/auth.gen.js.map +1 -0
  153. package/dist/utils/controller-client/core/bodySerializer.gen.d.ts +25 -0
  154. package/dist/utils/controller-client/core/bodySerializer.gen.js +58 -0
  155. package/dist/utils/controller-client/core/bodySerializer.gen.js.map +1 -0
  156. package/dist/utils/controller-client/core/params.gen.d.ts +43 -0
  157. package/dist/utils/controller-client/core/params.gen.js +101 -0
  158. package/dist/utils/controller-client/core/params.gen.js.map +1 -0
  159. package/dist/utils/controller-client/core/pathSerializer.gen.d.ts +33 -0
  160. package/dist/utils/controller-client/core/pathSerializer.gen.js +115 -0
  161. package/dist/utils/controller-client/core/pathSerializer.gen.js.map +1 -0
  162. package/dist/utils/controller-client/core/queryKeySerializer.gen.d.ts +18 -0
  163. package/dist/utils/controller-client/core/queryKeySerializer.gen.js +100 -0
  164. package/dist/utils/controller-client/core/queryKeySerializer.gen.js.map +1 -0
  165. package/dist/utils/controller-client/core/serverSentEvents.gen.d.ts +71 -0
  166. package/dist/utils/controller-client/core/serverSentEvents.gen.js +136 -0
  167. package/dist/utils/controller-client/core/serverSentEvents.gen.js.map +1 -0
  168. package/dist/utils/controller-client/core/types.gen.d.ts +78 -0
  169. package/dist/utils/controller-client/core/types.gen.js +3 -0
  170. package/dist/utils/controller-client/core/types.gen.js.map +1 -0
  171. package/dist/utils/controller-client/core/utils.gen.d.ts +19 -0
  172. package/dist/utils/controller-client/core/utils.gen.js +88 -0
  173. package/dist/utils/controller-client/core/utils.gen.js.map +1 -0
  174. package/dist/utils/controller-client/index.d.ts +2 -0
  175. package/dist/utils/controller-client/index.js +3 -0
  176. package/dist/utils/controller-client/index.js.map +1 -0
  177. package/dist/utils/controller-client/sdk.gen.d.ts +1302 -0
  178. package/dist/utils/controller-client/sdk.gen.js +4436 -0
  179. package/dist/utils/controller-client/sdk.gen.js.map +1 -0
  180. package/dist/utils/controller-client/types.gen.d.ts +9170 -0
  181. package/dist/utils/controller-client/types.gen.js +3 -0
  182. package/dist/utils/controller-client/types.gen.js.map +1 -0
  183. package/dist/utils/glob.d.ts +75 -0
  184. package/dist/utils/glob.js +110 -0
  185. package/dist/utils/glob.js.map +1 -0
  186. package/dist/utils/http-utility.d.ts +5 -0
  187. package/dist/utils/http-utility.js +68 -0
  188. package/dist/utils/http-utility.js.map +1 -0
  189. package/dist/utils/keychain.d.ts +129 -0
  190. package/dist/utils/keychain.js +193 -0
  191. package/dist/utils/keychain.js.map +1 -0
  192. package/dist/utils/logger.d.ts +4 -0
  193. package/dist/utils/logger.js +28 -0
  194. package/dist/utils/logger.js.map +1 -0
  195. package/dist/utils/package.d.ts +3 -0
  196. package/dist/utils/package.js +9 -0
  197. package/dist/utils/package.js.map +1 -0
  198. package/dist/utils/scopes.d.ts +12 -0
  199. package/dist/utils/scopes.js +19 -0
  200. package/dist/utils/scopes.js.map +1 -0
  201. package/dist/utils/terminal.d.ts +35 -0
  202. package/dist/utils/terminal.js +409 -0
  203. package/dist/utils/terminal.js.map +1 -0
  204. package/dist/utils/tools.d.ts +63 -0
  205. package/dist/utils/tools.js +149 -0
  206. package/dist/utils/tools.js.map +1 -0
  207. package/dist/utils/types.d.ts +55 -0
  208. package/dist/utils/types.js +3 -0
  209. package/dist/utils/types.js.map +1 -0
  210. package/package.json +89 -0
@@ -0,0 +1,741 @@
1
+ import { createErrorResponse } from '../utils/http-utility.js';
2
+ import { withAuthenticatedClient } from '../utils/authenticated-client.js';
3
+ import { listIdentities, detailIdentity, createIdentity, deleteIdentity, patchIdentity, listIdentityRoleAttributes, listIdentityServices, listIdentityEdgeRouters, listIdentityServicePolicies, listIdentitysEdgeRouterPolicies, listIdentitysServiceConfigs, getIdentityPolicyAdvice, disableIdentity, enableIdentity, getIdentityAuthenticators, getIdentityEnrollments, getIdentityFailedServiceRequests, getIdentityPostureData, removeIdentityMfa, updateIdentityTracing, associateIdentitysServiceConfigs, disassociateIdentitysServiceConfigs, } from '../utils/controller-client/sdk.gen.js';
4
+ // Define all available Identity tools
5
+ export const IDENTITY_TOOLS = [
6
+ {
7
+ name: 'listIdentities',
8
+ description: 'List all Identities in the Ziti network',
9
+ inputSchema: {
10
+ type: 'object',
11
+ properties: {},
12
+ },
13
+ _meta: {
14
+ requiredScopes: ['read:identities'],
15
+ readOnly: true,
16
+ },
17
+ annotations: {
18
+ title: 'List all Identities defined in the Ziti network.',
19
+ readOnlyHint: true,
20
+ destructiveHint: false,
21
+ idempotentHint: true,
22
+ openWorldHint: false,
23
+ },
24
+ },
25
+ {
26
+ name: 'listIdentity',
27
+ description: 'Get details about a specific Ziti identity',
28
+ inputSchema: {
29
+ type: 'object',
30
+ properties: {
31
+ id: { type: 'string', description: 'ID of the identity to retrieve' },
32
+ },
33
+ required: ['id'],
34
+ },
35
+ _meta: {
36
+ requiredScopes: ['read:identities'],
37
+ readOnly: true,
38
+ },
39
+ annotations: {
40
+ title: 'Get Ziti Identity Details',
41
+ readOnlyHint: true,
42
+ destructiveHint: false,
43
+ idempotentHint: true,
44
+ openWorldHint: false,
45
+ },
46
+ },
47
+ {
48
+ name: 'createIdentity',
49
+ description: 'Create a new Ziti Identity.',
50
+ inputSchema: {
51
+ type: 'object',
52
+ properties: {
53
+ name: { type: 'string', description: 'Name of the identity to create' },
54
+ admin: { type: 'boolean', description: 'Make an Admin or not.', default: false },
55
+ authPolicy: {
56
+ type: 'string',
57
+ description: 'The name or id of the auth policy to assign to the identity (default "default")',
58
+ default: 'default',
59
+ },
60
+ externalId: { type: 'string', description: 'An external id to give to the identity' },
61
+ roleAttributes: {
62
+ type: 'string',
63
+ description: 'Comma-separated role attributes for the new identity',
64
+ },
65
+ },
66
+ required: ['name'],
67
+ },
68
+ _meta: {
69
+ requiredScopes: ['write:identities'],
70
+ readOnly: true,
71
+ },
72
+ annotations: {
73
+ title: 'Create a new Identity in the Ziti network.',
74
+ readOnlyHint: true,
75
+ destructiveHint: false,
76
+ idempotentHint: true,
77
+ openWorldHint: false,
78
+ },
79
+ },
80
+ {
81
+ name: 'deleteIdentity',
82
+ description: 'Delete a Ziti Identity.',
83
+ inputSchema: {
84
+ type: 'object',
85
+ properties: {
86
+ id: { type: 'string', description: 'ID of the identity to delete' },
87
+ },
88
+ required: ['id'],
89
+ },
90
+ _meta: {
91
+ requiredScopes: ['write:identities'],
92
+ readOnly: true,
93
+ },
94
+ annotations: {
95
+ title: 'Delete an Identity from the Ziti network.',
96
+ readOnlyHint: true,
97
+ destructiveHint: true,
98
+ idempotentHint: false,
99
+ openWorldHint: false,
100
+ },
101
+ },
102
+ {
103
+ name: 'updateIdentity',
104
+ description: 'Update an existing Ziti Identity.',
105
+ inputSchema: {
106
+ type: 'object',
107
+ properties: {
108
+ id: { type: 'string', description: 'ID of the identity to update' },
109
+ name: { type: 'string', description: 'Name to give the identity' },
110
+ admin: { type: 'boolean', description: 'Make an Admin or not.' },
111
+ authPolicy: {
112
+ type: 'string',
113
+ description: 'The name or id of the auth policy to assign to the identity',
114
+ },
115
+ externalId: { type: 'string', description: 'An external id to give to the identity' },
116
+ roleAttributes: {
117
+ type: 'string',
118
+ description: 'Comma-separated role attributes for the new identity',
119
+ },
120
+ },
121
+ required: ['id'],
122
+ },
123
+ _meta: {
124
+ requiredScopes: ['write:identities'],
125
+ readOnly: false,
126
+ },
127
+ annotations: {
128
+ title: 'Update an existing Identity in the Ziti network.',
129
+ readOnlyHint: false,
130
+ destructiveHint: true,
131
+ idempotentHint: true,
132
+ openWorldHint: false,
133
+ },
134
+ },
135
+ {
136
+ name: 'listIdentityServices',
137
+ description: 'List all Services accessible by a specific Identity',
138
+ inputSchema: {
139
+ type: 'object',
140
+ properties: {
141
+ id: { type: 'string', description: 'ID of the identity' },
142
+ },
143
+ required: ['id'],
144
+ },
145
+ _meta: {
146
+ requiredScopes: ['read:identities'],
147
+ readOnly: true,
148
+ },
149
+ annotations: {
150
+ title: 'List Services for an Identity.',
151
+ readOnlyHint: true,
152
+ destructiveHint: false,
153
+ idempotentHint: true,
154
+ openWorldHint: false,
155
+ },
156
+ },
157
+ {
158
+ name: 'listIdentityEdgeRouters',
159
+ description: 'List all Edge Routers accessible by a specific Identity',
160
+ inputSchema: {
161
+ type: 'object',
162
+ properties: {
163
+ id: { type: 'string', description: 'ID of the identity' },
164
+ },
165
+ required: ['id'],
166
+ },
167
+ _meta: {
168
+ requiredScopes: ['read:identities'],
169
+ readOnly: true,
170
+ },
171
+ annotations: {
172
+ title: 'List Edge Routers for an Identity.',
173
+ readOnlyHint: true,
174
+ destructiveHint: false,
175
+ idempotentHint: true,
176
+ openWorldHint: false,
177
+ },
178
+ },
179
+ {
180
+ name: 'listIdentityServicePolicies',
181
+ description: 'List all Service Policies that apply to a specific Identity',
182
+ inputSchema: {
183
+ type: 'object',
184
+ properties: {
185
+ id: { type: 'string', description: 'ID of the identity' },
186
+ },
187
+ required: ['id'],
188
+ },
189
+ _meta: {
190
+ requiredScopes: ['read:identities'],
191
+ readOnly: true,
192
+ },
193
+ annotations: {
194
+ title: 'List Service Policies for an Identity.',
195
+ readOnlyHint: true,
196
+ destructiveHint: false,
197
+ idempotentHint: true,
198
+ openWorldHint: false,
199
+ },
200
+ },
201
+ {
202
+ name: 'listIdentityEdgeRouterPolicies',
203
+ description: 'List all Edge Router Policies that apply to a specific Identity',
204
+ inputSchema: {
205
+ type: 'object',
206
+ properties: {
207
+ id: { type: 'string', description: 'ID of the identity' },
208
+ },
209
+ required: ['id'],
210
+ },
211
+ _meta: {
212
+ requiredScopes: ['read:identities'],
213
+ readOnly: true,
214
+ },
215
+ annotations: {
216
+ title: 'List Edge Router Policies for an Identity.',
217
+ readOnlyHint: true,
218
+ destructiveHint: false,
219
+ idempotentHint: true,
220
+ openWorldHint: false,
221
+ },
222
+ },
223
+ {
224
+ name: 'listIdentityServiceConfigs',
225
+ description: 'List all Service Configs associated with a specific Identity',
226
+ inputSchema: {
227
+ type: 'object',
228
+ properties: {
229
+ id: { type: 'string', description: 'ID of the identity' },
230
+ },
231
+ required: ['id'],
232
+ },
233
+ _meta: {
234
+ requiredScopes: ['read:identities'],
235
+ readOnly: true,
236
+ },
237
+ annotations: {
238
+ title: 'List Service Configs for an Identity.',
239
+ readOnlyHint: true,
240
+ destructiveHint: false,
241
+ idempotentHint: true,
242
+ openWorldHint: false,
243
+ },
244
+ },
245
+ {
246
+ name: 'getIdentityPolicyAdvice',
247
+ description: 'Check whether an Identity can dial or bind a specific Service and get policy advice explaining why or why not',
248
+ inputSchema: {
249
+ type: 'object',
250
+ properties: {
251
+ id: { type: 'string', description: 'ID of the identity' },
252
+ serviceId: { type: 'string', description: 'ID of the service to check access for' },
253
+ },
254
+ required: ['id', 'serviceId'],
255
+ },
256
+ _meta: {
257
+ requiredScopes: ['read:identities'],
258
+ readOnly: true,
259
+ },
260
+ annotations: {
261
+ title: 'Get policy advice for an Identity and Service.',
262
+ readOnlyHint: true,
263
+ destructiveHint: false,
264
+ idempotentHint: true,
265
+ openWorldHint: false,
266
+ },
267
+ },
268
+ {
269
+ name: 'listIdentityRoleAttributes',
270
+ description: 'List all role attributes in use by Identities in the Ziti network',
271
+ inputSchema: {
272
+ type: 'object',
273
+ properties: {},
274
+ },
275
+ _meta: {
276
+ requiredScopes: ['read:identities'],
277
+ readOnly: true,
278
+ },
279
+ annotations: {
280
+ title: 'List all Identity role attributes.',
281
+ readOnlyHint: true,
282
+ destructiveHint: false,
283
+ idempotentHint: true,
284
+ openWorldHint: false,
285
+ },
286
+ },
287
+ {
288
+ name: 'disableIdentity',
289
+ description: 'Temporarily disable a Ziti Identity for a specified duration',
290
+ inputSchema: {
291
+ type: 'object',
292
+ properties: {
293
+ id: { type: 'string', description: 'ID of the identity to disable' },
294
+ durationMinutes: {
295
+ type: 'number',
296
+ description: 'Number of minutes to disable the identity for',
297
+ },
298
+ },
299
+ required: ['id', 'durationMinutes'],
300
+ },
301
+ _meta: {
302
+ requiredScopes: ['write:identities'],
303
+ readOnly: false,
304
+ },
305
+ annotations: {
306
+ title: 'Disable a Ziti Identity.',
307
+ readOnlyHint: false,
308
+ destructiveHint: true,
309
+ idempotentHint: true,
310
+ openWorldHint: false,
311
+ },
312
+ },
313
+ {
314
+ name: 'enableIdentity',
315
+ description: 'Re-enable a previously disabled Ziti Identity',
316
+ inputSchema: {
317
+ type: 'object',
318
+ properties: {
319
+ id: { type: 'string', description: 'ID of the identity to enable' },
320
+ },
321
+ required: ['id'],
322
+ },
323
+ _meta: {
324
+ requiredScopes: ['write:identities'],
325
+ readOnly: false,
326
+ },
327
+ annotations: {
328
+ title: 'Enable a Ziti Identity.',
329
+ readOnlyHint: false,
330
+ destructiveHint: false,
331
+ idempotentHint: true,
332
+ openWorldHint: false,
333
+ },
334
+ },
335
+ {
336
+ name: 'getIdentityAuthenticators',
337
+ description: 'List all Authenticators for a specific Identity',
338
+ inputSchema: {
339
+ type: 'object',
340
+ properties: {
341
+ id: { type: 'string', description: 'ID of the identity' },
342
+ },
343
+ required: ['id'],
344
+ },
345
+ _meta: {
346
+ requiredScopes: ['read:identities'],
347
+ readOnly: true,
348
+ },
349
+ annotations: {
350
+ title: 'Get Authenticators for an Identity.',
351
+ readOnlyHint: true,
352
+ destructiveHint: false,
353
+ idempotentHint: true,
354
+ openWorldHint: false,
355
+ },
356
+ },
357
+ {
358
+ name: 'getIdentityEnrollments',
359
+ description: 'List all Enrollments for a specific Identity',
360
+ inputSchema: {
361
+ type: 'object',
362
+ properties: {
363
+ id: { type: 'string', description: 'ID of the identity' },
364
+ },
365
+ required: ['id'],
366
+ },
367
+ _meta: {
368
+ requiredScopes: ['read:identities'],
369
+ readOnly: true,
370
+ },
371
+ annotations: {
372
+ title: 'Get Enrollments for an Identity.',
373
+ readOnlyHint: true,
374
+ destructiveHint: false,
375
+ idempotentHint: true,
376
+ openWorldHint: false,
377
+ },
378
+ },
379
+ {
380
+ name: 'getIdentityFailedServiceRequests',
381
+ description: 'List failed service requests for a specific Identity',
382
+ inputSchema: {
383
+ type: 'object',
384
+ properties: {
385
+ id: { type: 'string', description: 'ID of the identity' },
386
+ },
387
+ required: ['id'],
388
+ },
389
+ _meta: {
390
+ requiredScopes: ['read:identities'],
391
+ readOnly: true,
392
+ },
393
+ annotations: {
394
+ title: 'Get failed service requests for an Identity.',
395
+ readOnlyHint: true,
396
+ destructiveHint: false,
397
+ idempotentHint: true,
398
+ openWorldHint: false,
399
+ },
400
+ },
401
+ {
402
+ name: 'getIdentityPostureData',
403
+ description: 'Get posture data for a specific Identity',
404
+ inputSchema: {
405
+ type: 'object',
406
+ properties: {
407
+ id: { type: 'string', description: 'ID of the identity' },
408
+ },
409
+ required: ['id'],
410
+ },
411
+ _meta: {
412
+ requiredScopes: ['read:identities'],
413
+ readOnly: true,
414
+ },
415
+ annotations: {
416
+ title: 'Get posture data for an Identity.',
417
+ readOnlyHint: true,
418
+ destructiveHint: false,
419
+ idempotentHint: true,
420
+ openWorldHint: false,
421
+ },
422
+ },
423
+ {
424
+ name: 'removeIdentityMfa',
425
+ description: 'Remove MFA from a specific Identity',
426
+ inputSchema: {
427
+ type: 'object',
428
+ properties: {
429
+ id: { type: 'string', description: 'ID of the identity' },
430
+ },
431
+ required: ['id'],
432
+ },
433
+ _meta: {
434
+ requiredScopes: ['write:identities'],
435
+ readOnly: false,
436
+ },
437
+ annotations: {
438
+ title: 'Remove MFA from an Identity.',
439
+ readOnlyHint: false,
440
+ destructiveHint: true,
441
+ idempotentHint: true,
442
+ openWorldHint: false,
443
+ },
444
+ },
445
+ {
446
+ name: 'updateIdentityTracing',
447
+ description: 'Update tracing configuration for a specific Identity',
448
+ inputSchema: {
449
+ type: 'object',
450
+ properties: {
451
+ id: { type: 'string', description: 'ID of the identity' },
452
+ enabled: { type: 'boolean', description: 'Whether tracing is enabled' },
453
+ duration: { type: 'string', description: 'Duration for tracing (e.g. "5m", "1h")' },
454
+ traceId: { type: 'string', description: 'Trace ID to use' },
455
+ channels: {
456
+ type: 'string',
457
+ description: 'Comma-separated list of channels to trace',
458
+ },
459
+ },
460
+ required: ['id'],
461
+ },
462
+ _meta: {
463
+ requiredScopes: ['write:identities'],
464
+ readOnly: false,
465
+ },
466
+ annotations: {
467
+ title: 'Update tracing for an Identity.',
468
+ readOnlyHint: false,
469
+ destructiveHint: false,
470
+ idempotentHint: true,
471
+ openWorldHint: false,
472
+ },
473
+ },
474
+ {
475
+ name: 'associateIdentityServiceConfigs',
476
+ description: 'Associate service configs with a specific Identity',
477
+ inputSchema: {
478
+ type: 'object',
479
+ properties: {
480
+ id: { type: 'string', description: 'ID of the identity' },
481
+ serviceConfigs: {
482
+ type: 'string',
483
+ description: 'JSON array of objects with serviceId and configId, e.g. [{"serviceId":"abc","configId":"def"}]',
484
+ },
485
+ },
486
+ required: ['id', 'serviceConfigs'],
487
+ },
488
+ _meta: {
489
+ requiredScopes: ['write:identities'],
490
+ readOnly: false,
491
+ },
492
+ annotations: {
493
+ title: 'Associate service configs with an Identity.',
494
+ readOnlyHint: false,
495
+ destructiveHint: false,
496
+ idempotentHint: true,
497
+ openWorldHint: false,
498
+ },
499
+ },
500
+ {
501
+ name: 'disassociateIdentityServiceConfigs',
502
+ description: 'Remove service config associations from a specific Identity',
503
+ inputSchema: {
504
+ type: 'object',
505
+ properties: {
506
+ id: { type: 'string', description: 'ID of the identity' },
507
+ serviceConfigs: {
508
+ type: 'string',
509
+ description: 'JSON array of objects with serviceId and configId, e.g. [{"serviceId":"abc","configId":"def"}]',
510
+ },
511
+ },
512
+ required: ['id', 'serviceConfigs'],
513
+ },
514
+ _meta: {
515
+ requiredScopes: ['write:identities'],
516
+ readOnly: false,
517
+ },
518
+ annotations: {
519
+ title: 'Disassociate service configs from an Identity.',
520
+ readOnlyHint: false,
521
+ destructiveHint: true,
522
+ idempotentHint: true,
523
+ openWorldHint: false,
524
+ },
525
+ },
526
+ ];
527
+ // Define handlers for each Identity tool
528
+ export const IDENTITY_HANDLERS = {
529
+ listIdentities: (request, config) => withAuthenticatedClient(request, config, 'list identities', (client, ztSession) => listIdentities({ client, headers: { 'zt-session': ztSession } })),
530
+ listIdentity: (request, config) => {
531
+ const { id } = request.parameters;
532
+ if (!id)
533
+ return Promise.resolve(createErrorResponse('Error: id is required'));
534
+ return withAuthenticatedClient(request, config, 'get identity', (client, ztSession) => detailIdentity({ path: { id }, client, headers: { 'zt-session': ztSession } }));
535
+ },
536
+ createIdentity: (request, config) => {
537
+ const { name, admin = false, authPolicy = 'default', externalId, roleAttributes, } = request.parameters;
538
+ if (!name)
539
+ return Promise.resolve(createErrorResponse('Error: name is required'));
540
+ return withAuthenticatedClient(request, config, 'create identity', (client, ztSession) => createIdentity({
541
+ body: {
542
+ authPolicyId: authPolicy,
543
+ externalId,
544
+ isAdmin: admin,
545
+ name,
546
+ roleAttributes: roleAttributes
547
+ ? roleAttributes.split(',').map((attr) => attr.trim())
548
+ : undefined,
549
+ type: 'User',
550
+ },
551
+ client,
552
+ headers: { 'zt-session': ztSession },
553
+ }));
554
+ },
555
+ deleteIdentity: (request, config) => {
556
+ const { id } = request.parameters;
557
+ if (!id)
558
+ return Promise.resolve(createErrorResponse('Error: id is required'));
559
+ return withAuthenticatedClient(request, config, 'delete identity', (client, ztSession) => deleteIdentity({ path: { id }, client, headers: { 'zt-session': ztSession } }));
560
+ },
561
+ listIdentityServices: (request, config) => {
562
+ const { id } = request.parameters;
563
+ if (!id)
564
+ return Promise.resolve(createErrorResponse('Error: id is required'));
565
+ return withAuthenticatedClient(request, config, 'list identity services', (client, ztSession) => listIdentityServices({ path: { id }, client, headers: { 'zt-session': ztSession } }));
566
+ },
567
+ listIdentityEdgeRouters: (request, config) => {
568
+ const { id } = request.parameters;
569
+ if (!id)
570
+ return Promise.resolve(createErrorResponse('Error: id is required'));
571
+ return withAuthenticatedClient(request, config, 'list identity edge routers', (client, ztSession) => listIdentityEdgeRouters({ path: { id }, client, headers: { 'zt-session': ztSession } }));
572
+ },
573
+ listIdentityServicePolicies: (request, config) => {
574
+ const { id } = request.parameters;
575
+ if (!id)
576
+ return Promise.resolve(createErrorResponse('Error: id is required'));
577
+ return withAuthenticatedClient(request, config, 'list identity service policies', (client, ztSession) => listIdentityServicePolicies({ path: { id }, client, headers: { 'zt-session': ztSession } }));
578
+ },
579
+ listIdentityEdgeRouterPolicies: (request, config) => {
580
+ const { id } = request.parameters;
581
+ if (!id)
582
+ return Promise.resolve(createErrorResponse('Error: id is required'));
583
+ return withAuthenticatedClient(request, config, 'list identity edge router policies', (client, ztSession) => listIdentitysEdgeRouterPolicies({
584
+ path: { id },
585
+ client,
586
+ headers: { 'zt-session': ztSession },
587
+ }));
588
+ },
589
+ listIdentityServiceConfigs: (request, config) => {
590
+ const { id } = request.parameters;
591
+ if (!id)
592
+ return Promise.resolve(createErrorResponse('Error: id is required'));
593
+ return withAuthenticatedClient(request, config, 'list identity service configs', (client, ztSession) => listIdentitysServiceConfigs({
594
+ path: { id },
595
+ client,
596
+ headers: { 'zt-session': ztSession },
597
+ }));
598
+ },
599
+ getIdentityPolicyAdvice: (request, config) => {
600
+ const { id, serviceId } = request.parameters;
601
+ if (!id)
602
+ return Promise.resolve(createErrorResponse('Error: id is required'));
603
+ if (!serviceId)
604
+ return Promise.resolve(createErrorResponse('Error: serviceId is required'));
605
+ return withAuthenticatedClient(request, config, 'get identity policy advice', (client, ztSession) => getIdentityPolicyAdvice({
606
+ path: { id, serviceId },
607
+ client,
608
+ headers: { 'zt-session': ztSession },
609
+ }));
610
+ },
611
+ listIdentityRoleAttributes: (request, config) => withAuthenticatedClient(request, config, 'list identity role attributes', (client, ztSession) => listIdentityRoleAttributes({ client, headers: { 'zt-session': ztSession } })),
612
+ updateIdentity: (request, config) => {
613
+ const { id, name, admin, authPolicy, externalId, roleAttributes } = request.parameters;
614
+ if (!id)
615
+ return Promise.resolve(createErrorResponse('Error: id is required'));
616
+ return withAuthenticatedClient(request, config, 'update identity', (client, ztSession) => patchIdentity({
617
+ path: { id },
618
+ body: {
619
+ authPolicyId: authPolicy,
620
+ externalId,
621
+ isAdmin: admin,
622
+ name,
623
+ roleAttributes: roleAttributes
624
+ ? roleAttributes.split(',').map((attr) => attr.trim())
625
+ : undefined,
626
+ },
627
+ client,
628
+ headers: { 'zt-session': ztSession },
629
+ }));
630
+ },
631
+ disableIdentity: (request, config) => {
632
+ const { id, durationMinutes } = request.parameters;
633
+ if (!id)
634
+ return Promise.resolve(createErrorResponse('Error: id is required'));
635
+ if (durationMinutes === undefined)
636
+ return Promise.resolve(createErrorResponse('Error: durationMinutes is required'));
637
+ return withAuthenticatedClient(request, config, 'disable identity', (client, ztSession) => disableIdentity({
638
+ path: { id },
639
+ body: { durationMinutes },
640
+ client,
641
+ headers: { 'zt-session': ztSession },
642
+ }));
643
+ },
644
+ enableIdentity: (request, config) => {
645
+ const { id } = request.parameters;
646
+ if (!id)
647
+ return Promise.resolve(createErrorResponse('Error: id is required'));
648
+ return withAuthenticatedClient(request, config, 'enable identity', (client, ztSession) => enableIdentity({ path: { id }, client, headers: { 'zt-session': ztSession } }));
649
+ },
650
+ getIdentityAuthenticators: (request, config) => {
651
+ const { id } = request.parameters;
652
+ if (!id)
653
+ return Promise.resolve(createErrorResponse('Error: id is required'));
654
+ return withAuthenticatedClient(request, config, 'get identity authenticators', (client, ztSession) => getIdentityAuthenticators({ path: { id }, client, headers: { 'zt-session': ztSession } }));
655
+ },
656
+ getIdentityEnrollments: (request, config) => {
657
+ const { id } = request.parameters;
658
+ if (!id)
659
+ return Promise.resolve(createErrorResponse('Error: id is required'));
660
+ return withAuthenticatedClient(request, config, 'get identity enrollments', (client, ztSession) => getIdentityEnrollments({ path: { id }, client, headers: { 'zt-session': ztSession } }));
661
+ },
662
+ getIdentityFailedServiceRequests: (request, config) => {
663
+ const { id } = request.parameters;
664
+ if (!id)
665
+ return Promise.resolve(createErrorResponse('Error: id is required'));
666
+ return withAuthenticatedClient(request, config, 'get identity failed service requests', (client, ztSession) => getIdentityFailedServiceRequests({
667
+ path: { id },
668
+ client,
669
+ headers: { 'zt-session': ztSession },
670
+ }));
671
+ },
672
+ getIdentityPostureData: (request, config) => {
673
+ const { id } = request.parameters;
674
+ if (!id)
675
+ return Promise.resolve(createErrorResponse('Error: id is required'));
676
+ return withAuthenticatedClient(request, config, 'get identity posture data', (client, ztSession) => getIdentityPostureData({ path: { id }, client, headers: { 'zt-session': ztSession } }));
677
+ },
678
+ removeIdentityMfa: (request, config) => {
679
+ const { id } = request.parameters;
680
+ if (!id)
681
+ return Promise.resolve(createErrorResponse('Error: id is required'));
682
+ return withAuthenticatedClient(request, config, 'remove identity mfa', (client, ztSession) => removeIdentityMfa({ path: { id }, client, headers: { 'zt-session': ztSession } }));
683
+ },
684
+ updateIdentityTracing: (request, config) => {
685
+ const { id, enabled, duration, traceId, channels } = request.parameters;
686
+ if (!id)
687
+ return Promise.resolve(createErrorResponse('Error: id is required'));
688
+ return withAuthenticatedClient(request, config, 'update identity tracing', (client, ztSession) => updateIdentityTracing({
689
+ path: { id },
690
+ body: {
691
+ enabled,
692
+ duration,
693
+ traceId,
694
+ channels: channels ? channels.split(',').map((c) => c.trim()) : undefined,
695
+ },
696
+ client,
697
+ headers: { 'zt-session': ztSession },
698
+ }));
699
+ },
700
+ associateIdentityServiceConfigs: (request, config) => {
701
+ const { id, serviceConfigs } = request.parameters;
702
+ if (!id)
703
+ return Promise.resolve(createErrorResponse('Error: id is required'));
704
+ if (!serviceConfigs)
705
+ return Promise.resolve(createErrorResponse('Error: serviceConfigs is required'));
706
+ let parsed;
707
+ try {
708
+ parsed = JSON.parse(serviceConfigs);
709
+ }
710
+ catch {
711
+ return Promise.resolve(createErrorResponse('Error: serviceConfigs must be valid JSON array'));
712
+ }
713
+ return withAuthenticatedClient(request, config, 'associate identity service configs', (client, ztSession) => associateIdentitysServiceConfigs({
714
+ path: { id },
715
+ body: parsed,
716
+ client,
717
+ headers: { 'zt-session': ztSession },
718
+ }));
719
+ },
720
+ disassociateIdentityServiceConfigs: (request, config) => {
721
+ const { id, serviceConfigs } = request.parameters;
722
+ if (!id)
723
+ return Promise.resolve(createErrorResponse('Error: id is required'));
724
+ if (!serviceConfigs)
725
+ return Promise.resolve(createErrorResponse('Error: serviceConfigs is required'));
726
+ let parsed;
727
+ try {
728
+ parsed = JSON.parse(serviceConfigs);
729
+ }
730
+ catch {
731
+ return Promise.resolve(createErrorResponse('Error: serviceConfigs must be valid JSON array'));
732
+ }
733
+ return withAuthenticatedClient(request, config, 'disassociate identity service configs', (client, ztSession) => disassociateIdentitysServiceConfigs({
734
+ path: { id },
735
+ body: parsed,
736
+ client,
737
+ headers: { 'zt-session': ztSession },
738
+ }));
739
+ },
740
+ };
741
+ //# sourceMappingURL=identities.js.map