@securityreviewai/security-review-mcp 0.2.9

package/dist/tools/projectTools.js

@@ -0,0 +1,104 @@
+import * as z from "zod/v4";
+import { getApiClient } from "../api/client.js";
+import { runTool } from "./common.js";
+export function registerProjectTools(server) {
+    server.registerTool("list_projects", {
+        description: "List all projects in the SRAI platform. Returns project IDs, names, and descriptions. Use this to discover available projects before operating on them.",
+    }, async () => runTool(async () => getApiClient().listProjects()));
+    server.registerTool("get_project", {
+        description: "Get detailed information about a specific SRAI project by its ID. Returns project name, description, settings, and metadata.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getProject(project_id)));
+    server.registerTool("create_project", {
+        description: "Create a new project in SRAI. Provide a name and description. Returns the created project with its ID. Use this before uploading documents or creating reviews.",
+        inputSchema: {
+            name: z.string(),
+            description: z.string(),
+        },
+    }, async ({ name, description }) => runTool(async () => getApiClient().createProject(name, description)));
+    server.registerTool("get_project_settings", {
+        description: "Get settings and configuration for a specific SRAI project. Includes integration settings, compliance frameworks, etc.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getProjectSettings(project_id)));
+    server.registerTool("get_project_profile", {
+        description: "Get the project profile hub summary for a project, including profile and high-level counts.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getProjectProfile(project_id)));
+    server.registerTool("get_full_project_profile", {
+        description: "Get the full project profile graph payload for a project, including all profile sub-objects.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getFullProjectProfile(project_id)));
+    server.registerTool("get_project_profile_description", {
+        description: "Get the project profile description node (description and purpose) for a project.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getProjectProfileDescription(project_id)));
+    server.registerTool("list_profile_technology_categories", {
+        description: "List all project profile technology categories for a project.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().listProjectProfileTechnologyCategories(project_id)));
+    server.registerTool("get_project_profile_technology_category", {
+        description: "Get a single project profile technology category by category name.",
+        inputSchema: {
+            project_id: z.number().int(),
+            category_name: z.string(),
+        },
+    }, async ({ project_id, category_name }) => runTool(async () => getApiClient().getProjectProfileTechnologyCategory(project_id, category_name)));
+    server.registerTool("list_project_profile_architecture_notes", {
+        description: "List project profile architecture notes for a project.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().listProjectProfileArchitectureNotes(project_id)));
+    server.registerTool("list_project_profile_user_groups", {
+        description: "List project profile user groups, optionally filtered by group_type.",
+        inputSchema: {
+            project_id: z.number().int(),
+            group_type: z.string().optional(),
+        },
+    }, async ({ project_id, group_type }) => runTool(async () => getApiClient().listProjectProfileUserGroups(project_id, group_type)));
+    server.registerTool("list_project_profile_language_stacks", {
+        description: "List project profile language stacks for a project.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().listProjectProfileLanguageStacks(project_id)));
+    server.registerTool("list_project_profile_security_controls", {
+        description: "List project profile security controls, optionally filtered by status.",
+        inputSchema: {
+            project_id: z.number().int(),
+            status: z.string().optional(),
+        },
+    }, async ({ project_id, status }) => runTool(async () => getApiClient().listProjectProfileSecurityControls(project_id, status)));
+    server.registerTool("get_project_profile_security_control", {
+        description: "Get a single project profile security control by control ID.",
+        inputSchema: {
+            project_id: z.number().int(),
+            control_id: z.number().int(),
+        },
+    }, async ({ project_id, control_id }) => runTool(async () => getApiClient().getProjectProfileSecurityControl(project_id, control_id)));
+    server.registerTool("list_profile_compliance_requirements", {
+        description: "List project profile compliance requirements for a project.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().listProjectProfileComplianceRequirements(project_id)));
+    server.registerTool("get_profile_compliance_requirement", {
+        description: "Get a single project profile compliance requirement by requirement ID.",
+        inputSchema: {
+            project_id: z.number().int(),
+            requirement_id: z.number().int(),
+        },
+    }, async ({ project_id, requirement_id }) => runTool(async () => getApiClient().getProjectProfileComplianceRequirement(project_id, requirement_id)));
+}

package/dist/tools/reviewArtifactTools.js

@@ -0,0 +1,61 @@
+import * as z from "zod/v4";
+import { getApiClient } from "../api/client.js";
+import { runTool } from "./common.js";
+export function registerReviewArtifactTools(server) {
+    server.registerTool("get_security_objectives", {
+        description: "Get all security objectives from a completed review. Returns objectives categorized as Regulatory, Internal, or Contractual requirements, with names, descriptions, and compliance framework mappings.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getSecurityObjectives(project_id, review_id)));
+    server.registerTool("get_threat_scenarios", {
+        description: "Get all threat scenarios from a completed review. Returns threats with names, descriptions, severity (Critical/High/Medium/Low), CVSS scores, CWE IDs, PWN-ISMS categories (Product, Workload, Network, IAM, Secrets, Logging, Supply Chain), and STRIDE classifications.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getThreatScenarios(project_id, review_id)));
+    server.registerTool("get_countermeasures", {
+        description: "Get all countermeasures/mitigations from a completed review. Returns mitigations with names, descriptions, implementation steps, status (Pending/Implemented/Partially Implemented), mapped threat IDs, and compliance framework references.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getCountermeasures(project_id, review_id)));
+    server.registerTool("get_components", {
+        description: "Get all system components/entities identified in a review. Returns component names, descriptions, purposes, connections, and security objective mappings.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getComponents(project_id, review_id)));
+    server.registerTool("get_data_dictionaries", {
+        description: "Get the data dictionary from a completed review. Returns identified sensitive data assets (PII, financial, health data) and stepping stones (API keys, credentials, tokens) with descriptions and reasoning.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getDataDictionaries(project_id, review_id)));
+    server.registerTool("get_questions", {
+        description: "Get security questions generated for a review. These are contextual questions about the system that help refine the security analysis.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getQuestions(project_id, review_id)));
+    server.registerTool("get_findings", {
+        description: "Get findings from a completed review. Findings are aggregated security insights derived from the analysis.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getFindings(project_id, review_id)));
+    server.registerTool("get_security_test_cases", {
+        description: "Get security test cases generated for a review. These are actionable test cases derived from the threat scenarios and countermeasures.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getSecurityTestCases(project_id, review_id)));
+}

package/dist/tools/reviewTools.js

@@ -0,0 +1,405 @@
+import * as z from "zod/v4";
+import { getApiClient, SraiApiError } from "../api/client.js";
+import { errorToolResult, textToolResult } from "../utils/serialization.js";
+import { runTool } from "./common.js";
+export function registerReviewTools(server) {
+    server.registerTool("find_project_by_name", {
+        description: "Find SRAI projects by exact, partial, or fuzzy name match. Use this when the user provides a project name instead of project_id.",
+        inputSchema: {
+            project_name: z.string(),
+            max_results: z.number().int().default(5),
+        },
+    }, async ({ project_name, max_results }) => runTool(async () => {
+        const projectsPayload = await getApiClient().listProjects();
+        const projects = extractItems(projectsPayload, ["projects", "items", "data"]);
+        const matches = rankByName(projects, project_name).slice(0, Math.max(1, max_results));
+        return {
+            query: project_name,
+            total_projects: projects.length,
+            match_count: matches.length,
+            matches: matches.map((item) => ({
+                id: item.id,
+                name: item.name,
+                description: item.description,
+                match_score: item._match_score,
+            })),
+        };
+    }));
+    server.registerTool("list_reviews", {
+        description: "List all security reviews in an SRAI project. Returns review IDs, names, descriptions, status, and review type. Use this to find reviews to inspect or to check workflow progress.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().listReviews(project_id)));
+    server.registerTool("list_reviews_by_project_name", {
+        description: "List reviews for a project identified by name (supports fuzzy matches). This resolves the project first, then returns reviews only for that project.",
+        inputSchema: {
+            project_name: z.string(),
+            review_name: z.string().optional(),
+            max_results: z.number().int().default(10),
+        },
+    }, async ({ project_name, review_name, max_results }) => runTool(async () => {
+        const client = getApiClient();
+        const projectsPayload = await client.listProjects();
+        const projects = extractItems(projectsPayload, ["projects", "items", "data"]);
+        const rankedProjects = rankByName(projects, project_name);
+        if (rankedProjects.length === 0) {
+            return {
+                error: `No project found matching '${project_name}'`,
+                query: project_name,
+            };
+        }
+        const selectedProject = rankedProjects[0];
+        const projectId = intOrZero(selectedProject.id);
+        const reviewsPayload = await client.listReviews(projectId);
+        let reviews = extractItems(reviewsPayload, ["reviews", "items", "data"]);
+        if (review_name) {
+            reviews = rankByName(reviews, review_name);
+        }
+        reviews = reviews.slice(0, Math.max(1, max_results));
+        return {
+            project: {
+                id: selectedProject.id,
+                name: selectedProject.name,
+                match_score: selectedProject._match_score,
+            },
+            review_query: review_name,
+            review_count: reviews.length,
+            reviews: reviews.map((review) => ({
+                id: review.id,
+                name: review.name,
+                description: review.description,
+                status: review.status,
+                review_type: review.review_type,
+                updated_at: review.updated_at,
+                match_score: review._match_score,
+            })),
+        };
+    }));
+    server.registerTool("get_review", {
+        description: "Get detailed information about a specific security review. Returns review configuration, status, associated documents, compliance frameworks, and workflow progress.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getReview(project_id, review_id)));
+    server.registerTool("get_review_overview", {
+        description: "Get a focused overview of a review based on user intent. Accepts project by ID or fuzzy name and review by ID or fuzzy name. If review is not provided, selects the latest review inside the resolved project.",
+        inputSchema: {
+            user_request: z.string(),
+            project_id: z.number().int().optional(),
+            project_name: z.string().optional(),
+            review_id: z.number().int().optional(),
+            review_name: z.string().optional(),
+        },
+    }, async ({ user_request, project_id, project_name, review_id, review_name }) => {
+        try {
+            const client = getApiClient();
+            if (project_id === undefined && !project_name) {
+                return errorToolResult("Provide either project_id or project_name.");
+            }
+            let selectedProject;
+            let resolvedProjectId = project_id;
+            let projectResolutionMode = "id";
+            if (resolvedProjectId !== undefined) {
+                const projectPayload = await client.getProject(resolvedProjectId);
+                selectedProject = asItem(projectPayload);
+            }
+            else {
+                projectResolutionMode = "name";
+                const projectsPayload = await client.listProjects();
+                const projects = extractItems(projectsPayload, ["projects", "items", "data"]);
+                const rankedProjects = rankByName(projects, String(project_name));
+                if (rankedProjects.length === 0) {
+                    return errorToolResult(`No project found matching '${project_name}'`);
+                }
+                selectedProject = rankedProjects[0];
+                resolvedProjectId = intOrZero(selectedProject?.id);
+            }
+            const reviewsPayload = await client.listReviews(resolvedProjectId);
+            const projectReviews = extractItems(reviewsPayload, ["reviews", "items", "data"]);
+            if (projectReviews.length === 0) {
+                return errorToolResult("No reviews found in this project.");
+            }
+            let selectedReview;
+            let reviewResolutionMode = "latest_in_project";
+            if (review_id !== undefined) {
+                selectedReview = projectReviews.find((review) => intOrZero(review.id) === review_id);
+                reviewResolutionMode = "id";
+                if (!selectedReview) {
+                    return errorToolResult(`Review ${review_id} is not in project ${resolvedProjectId}.`);
+                }
+            }
+            else if (review_name) {
+                const rankedReviews = rankByName(projectReviews, review_name);
+                selectedReview = rankedReviews[0];
+                reviewResolutionMode = "name";
+                if (!selectedReview) {
+                    return errorToolResult(`No review in project ${resolvedProjectId} matched '${review_name}'.`);
+                }
+            }
+            else {
+                selectedReview = pickLatestReview(projectReviews);
+            }
+            if (!selectedReview) {
+                return errorToolResult("Unable to resolve review for overview.");
+            }
+            const selectedReviewId = intOrZero(selectedReview.id);
+            const focus = focusFlags(user_request);
+            const reviewDetails = await client.getReview(resolvedProjectId, selectedReviewId);
+            const sections = {};
+            const counts = {};
+            if (focus.objectives) {
+                const objectives = await client.getSecurityObjectives(resolvedProjectId, selectedReviewId);
+                sections.security_objectives = objectives;
+                counts.security_objectives = artifactCount(objectives);
+            }
+            if (focus.components) {
+                const components = await client.getComponents(resolvedProjectId, selectedReviewId);
+                sections.components = components;
+                counts.components = artifactCount(components);
+            }
+            if (focus.threats) {
+                const threats = await client.getThreatScenarios(resolvedProjectId, selectedReviewId);
+                sections.threat_scenarios = threats;
+                counts.threat_scenarios = artifactCount(threats);
+            }
+            if (focus.countermeasures) {
+                const countermeasures = await client.getCountermeasures(resolvedProjectId, selectedReviewId);
+                sections.countermeasures = countermeasures;
+                counts.countermeasures = artifactCount(countermeasures);
+            }
+            return textToolResult({
+                request: user_request,
+                resolution: {
+                    project_mode: projectResolutionMode,
+                    review_mode: reviewResolutionMode,
+                },
+                project: {
+                    id: resolvedProjectId,
+                    name: selectedProject?.name,
+                },
+                review: {
+                    id: selectedReviewId,
+                    name: selectedReview.name,
+                    status: selectedReview.status,
+                },
+                focus: Object.fromEntries(Object.entries(focus).filter(([, enabled]) => enabled)),
+                overview: {
+                    review_details: reviewDetails,
+                    artifact_counts: counts,
+                    artifacts: sections,
+                },
+            });
+        }
+        catch (error) {
+            if (error instanceof SraiApiError) {
+                return errorToolResult(error.detail, error.statusCode);
+            }
+            return errorToolResult(error instanceof Error ? error.message : String(error));
+        }
+    });
+    server.registerTool("create_review", {
+        description: "Create a new security review in an SRAI project. This sets up a review with associated documents and configuration.\n\nRequired parameters:\n- project_id: The project to create the review in\n- name: Review name\n- description: Review description\n- document_ids: List of document IDs to include in the review\n\nOptional parameters:\n- review_type: 'system' (default) or 'incremental'\n- generate_questions: Whether to generate security questions (default: false)\n- frameworks: List of compliance framework names to include (e.g. 'PCI-DSS', 'HIPAA', 'GDPR')\n- component_diagram_ids: List of component diagram document IDs\n- diagram_ids: List of diagram document IDs\n\nAfter creating a review, use start_workflow to begin the security analysis.",
+        inputSchema: {
+            project_id: z.number().int(),
+            name: z.string(),
+            description: z.string(),
+            document_ids: z.array(z.number().int()),
+            review_type: z.string().default("system"),
+            generate_questions: z.boolean().default(false),
+            frameworks: z.array(z.string()).optional(),
+            component_diagram_ids: z.array(z.number().int()).optional(),
+            diagram_ids: z.array(z.number().int()).optional(),
+        },
+    }, async ({ project_id, name, description, document_ids, review_type, generate_questions, frameworks, component_diagram_ids, diagram_ids, }) => runTool(async () => {
+        const reviewConfig = {
+            step1: {
+                name,
+                description,
+                review_type,
+                generate_questions,
+            },
+            step2: {
+                document_ids,
+            },
+            step3: {
+                component_diagram_ids: component_diagram_ids || [],
+                diagram_ids: diagram_ids || [],
+                is_finalized: true,
+            },
+            step4: {
+                framework: frameworks || [],
+                security_policy: [],
+            },
+            step5: {
+                existing_review: null,
+                end_date: null,
+                exclude_security_objectives: [],
+                exclude_threat_scenarios: [],
+                exclude_countermeasures: [],
+                include_security_objectives: [],
+                include_threat_scenarios: [],
+                include_countermeasures: [],
+            },
+        };
+        return getApiClient().createReview(project_id, reviewConfig);
+    }));
+    server.registerTool("get_review_resource_documents", {
+        description: "Get the list of documents available as resources for creating a review in a project. Use this to find which document IDs to pass when creating a review.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getReviewResourceDocuments(project_id)));
+    server.registerTool("get_review_resource_compliance", {
+        description: "Get the list of compliance frameworks available for a review in a project. Returns framework names that can be passed when creating a review.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getReviewResourceCompliance(project_id)));
+}
+function extractItems(payload, keys) {
+    if (Array.isArray(payload)) {
+        return payload.filter(isItem);
+    }
+    if (isItem(payload)) {
+        for (const key of keys) {
+            const value = payload[key];
+            if (Array.isArray(value)) {
+                return value.filter(isItem);
+            }
+        }
+    }
+    return [];
+}
+function normalize(value) {
+    if (value === undefined || value === null) {
+        return "";
+    }
+    return String(value).trim().toLowerCase();
+}
+function similarityScore(query, candidate) {
+    if (!query || !candidate) {
+        return 0;
+    }
+    if (query === candidate) {
+        return 1;
+    }
+    if (candidate.startsWith(query)) {
+        return 0.95;
+    }
+    if (candidate.includes(query)) {
+        return 0.9;
+    }
+    return diceCoefficient(query, candidate);
+}
+function rankByName(items, query) {
+    const normalizedQuery = normalize(query);
+    const queryTokens = normalizedQuery.split(/\s+/u).filter((token) => token.length >= 3);
+    const scored = [];
+    for (const item of items) {
+        const name = normalize(item.name);
+        if (!name) {
+            continue;
+        }
+        const score = similarityScore(normalizedQuery, name);
+        const hasTokenOverlap = queryTokens.some((token) => name.includes(token));
+        if (score >= 0.6 || hasTokenOverlap) {
+            scored.push({
+                ...item,
+                _match_score: Number(score.toFixed(3)),
+            });
+        }
+    }
+    scored.sort((a, b) => Number(b._match_score ?? 0) - Number(a._match_score ?? 0));
+    return scored;
+}
+function pickLatestReview(reviews) {
+    return reviews
+        .slice()
+        .sort((a, b) => {
+        const aUpdated = String(a.updated_at ?? "");
+        const bUpdated = String(b.updated_at ?? "");
+        if (aUpdated !== bUpdated) {
+            return bUpdated.localeCompare(aUpdated);
+        }
+        const aCreated = String(a.created_at ?? "");
+        const bCreated = String(b.created_at ?? "");
+        if (aCreated !== bCreated) {
+            return bCreated.localeCompare(aCreated);
+        }
+        return intOrZero(b.id) - intOrZero(a.id);
+    })[0];
+}
+function artifactCount(payload) {
+    if (Array.isArray(payload)) {
+        return payload.length;
+    }
+    if (isItem(payload)) {
+        for (const key of ["items", "data", "results", "findings", "questions"]) {
+            const value = payload[key];
+            if (Array.isArray(value)) {
+                return value.length;
+            }
+        }
+    }
+    return 0;
+}
+function focusFlags(question) {
+    const text = normalize(question);
+    if (!text) {
+        return {
+            objectives: true,
+            components: true,
+            threats: true,
+            countermeasures: true,
+        };
+    }
+    const mapping = {
+        objectives: ["objective", "objectives", "requirement", "requirements", "compliance"],
+        components: ["component", "components", "entity", "entities", "architecture"],
+        threats: ["threat", "threats", "risk", "risks"],
+        countermeasures: ["countermeasure", "countermeasures", "mitigation", "mitigations", "control", "controls"],
+    };
+    const flags = Object.fromEntries(Object.entries(mapping).map(([key, terms]) => [key, terms.some((term) => text.includes(term))]));
+    if (!Object.values(flags).some(Boolean) ||
+        ["overview", "summary", "analy", "review"].some((term) => text.includes(term))) {
+        return {
+            objectives: true,
+            components: true,
+            threats: true,
+            countermeasures: true,
+        };
+    }
+    return flags;
+}
+function diceCoefficient(a, b) {
+    if (a.length < 2 || b.length < 2) {
+        return a === b ? 1 : 0;
+    }
+    const aBigrams = new Map();
+    for (let i = 0; i < a.length - 1; i += 1) {
+        const gram = a.slice(i, i + 2);
+        aBigrams.set(gram, (aBigrams.get(gram) ?? 0) + 1);
+    }
+    let intersection = 0;
+    for (let i = 0; i < b.length - 1; i += 1) {
+        const gram = b.slice(i, i + 2);
+        const count = aBigrams.get(gram) ?? 0;
+        if (count > 0) {
+            aBigrams.set(gram, count - 1);
+            intersection += 1;
+        }
+    }
+    return (2 * intersection) / (a.length - 1 + (b.length - 1));
+}
+function intOrZero(value) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+function isItem(value) {
+    return typeof value === "object" && value !== null;
+}
+function asItem(value) {
+    return isItem(value) ? value : {};
+}

package/dist/tools/workflowTools.js

@@ -0,0 +1,105 @@
+import * as z from "zod/v4";
+import { getApiClient } from "../api/client.js";
+import { runTool } from "./common.js";
+export function registerWorkflowTools(server) {
+    server.registerTool("list_ai_ide_workflows", {
+        description: "List AI IDE workflows for a project with pagination. Returns workflow records and pagination metadata.",
+        inputSchema: {
+            project_id: z.number().int(),
+            page: z.number().int().min(1).default(1),
+            page_size: z.number().int().min(1).max(100).default(10),
+        },
+    }, async ({ project_id, page, page_size }) => runTool(async () => getApiClient().listAiIdeWorkflows(project_id, page, page_size)));
+    server.registerTool("get_ai_ide_workflow", {
+        description: "Get a specific AI IDE workflow by workflow ID within a project. Returns workflow metadata and linked AI IDE data source.",
+        inputSchema: {
+            project_id: z.number().int(),
+            workflow_id: z.number().int(),
+        },
+    }, async ({ project_id, workflow_id }) => runTool(async () => getApiClient().getAiIdeWorkflow(project_id, workflow_id)));
+    server.registerTool("create_ai_ide_workflow", {
+        description: "Create an AI IDE workflow for a project. This creates a workflow and its AI IDE data source in SRAI.",
+        inputSchema: {
+            project_id: z.number().int(),
+            name: z.string(),
+            description: z.string().optional(),
+        },
+    }, async ({ project_id, name, description }) => runTool(async () => getApiClient().createAiIdeWorkflow(project_id, name, description)));
+    server.registerTool("create_ai_ide_event", {
+        description: "Create an AI IDE event under an existing AI IDE workflow. Include summary, developer details, mitigated threats (each threat must include severity: critical/high/medium/low), best practices, secure snippets, and optional event metadata.",
+        inputSchema: {
+            project_id: z.number().int(),
+            workflow_id: z.number().int(),
+            external_id: z.string(),
+            title: z.string(),
+            summary: z.string(),
+            developer_name: z.string(),
+            developer_email: z.string(),
+            threats_mitigated: z
+                .array(z
+                .object({
+                severity: z.enum(["critical", "high", "medium", "low"]),
+            })
+                .catchall(z.unknown()))
+                .default([]),
+            best_practices_achieved: z.array(z.object({}).catchall(z.unknown())).default([]),
+            secure_code_snippets: z.array(z.object({}).catchall(z.unknown())).default([]),
+            event_metadata: z.record(z.string(), z.unknown()).default({}),
+        },
+    }, async ({ project_id, workflow_id, external_id, title, summary, developer_name, developer_email, threats_mitigated, best_practices_achieved, secure_code_snippets, event_metadata, }) => runTool(async () => getApiClient().createAiIdeEvent(project_id, workflow_id, {
+        external_id,
+        title,
+        summary,
+        developer_name,
+        developer_email,
+        threats_mitigated,
+        best_practices_achieved,
+        secure_code_snippets,
+        event_metadata,
+    })));
+    server.registerTool("start_workflow", {
+        description: "Start the security review workflow for a review. This triggers the SRAI AI agents to begin generating security objectives, components, data dictionaries, threat scenarios, and countermeasures. The workflow runs asynchronously. Use get_workflow_status to monitor progress.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().startWorkflow(project_id, review_id)));
+    server.registerTool("get_workflow_status", {
+        description: "Get the current status and progress of a review workflow. Returns the list of workflow jobs with their status (pending, in_progress, completed, failed) and any pending job IDs.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getWorkflowStatus(project_id, review_id)));
+    server.registerTool("get_workflow_job_status", {
+        description: "Get the status of a specific workflow job. Returns detailed job information including status, logs, and timestamps.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+            job_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id, job_id }) => runTool(async () => getApiClient().getWorkflowJobStatus(project_id, review_id, job_id)));
+    server.registerTool("start_next_workflow_job", {
+        description: "Advance the workflow by starting the next pending job. Use this to manually progress through workflow steps after a job completes.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id }) => runTool(async () => getApiClient().getNextWorkflowJob(project_id, review_id)));
+    server.registerTool("start_workflow_job", {
+        description: "Start a specific workflow job by ID. Use this to manually trigger a particular step in the workflow.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+            job_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id, job_id }) => runTool(async () => getApiClient().startWorkflowJob(project_id, review_id, job_id)));
+    server.registerTool("retry_workflow_job", {
+        description: "Retry a failed workflow job. Use this when a workflow step has failed and you want to re-attempt it.",
+        inputSchema: {
+            project_id: z.number().int(),
+            review_id: z.number().int(),
+            job_id: z.number().int(),
+        },
+    }, async ({ project_id, review_id, job_id }) => runTool(async () => getApiClient().retryWorkflowJob(project_id, review_id, job_id)));
+}