@trycompai/mcp-server 0.2.4 → 0.2.6

package/src/models/vendoracceptancescontrollerlistvendoracceptancesv1op.ts

@@ -0,0 +1,288 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod";
+import { ClosedEnum } from "../types/enums.js";
+
+/**
+ * Residual likelihood frozen at acceptance
+ */
+export const VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood =
+  {
+    VeryUnlikely: "very_unlikely",
+    Unlikely: "unlikely",
+    Possible: "possible",
+    Likely: "likely",
+    VeryLikely: "very_likely",
+  } as const;
+/**
+ * Residual likelihood frozen at acceptance
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood =
+  ClosedEnum<
+    typeof VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood
+  >;
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood$zodSchema =
+  z.enum([
+    "very_unlikely",
+    "unlikely",
+    "possible",
+    "likely",
+    "very_likely",
+  ]).describe("Residual likelihood frozen at acceptance");
+
+/**
+ * Residual impact frozen at acceptance
+ */
+export const VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact =
+  {
+    Insignificant: "insignificant",
+    Minor: "minor",
+    Moderate: "moderate",
+    Major: "major",
+    Severe: "severe",
+  } as const;
+/**
+ * Residual impact frozen at acceptance
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact =
+  ClosedEnum<
+    typeof VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact
+  >;
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact$zodSchema =
+  z.enum([
+    "insignificant",
+    "minor",
+    "moderate",
+    "major",
+    "severe",
+  ]).describe("Residual impact frozen at acceptance");
+
+/**
+ * Risk level of the accepted residual rating
+ */
+export const VendorAcceptancesControllerListVendorAcceptancesV1Level = {
+  VeryLow: "very-low",
+  Low: "low",
+  Medium: "medium",
+  High: "high",
+  VeryHigh: "very-high",
+} as const;
+/**
+ * Risk level of the accepted residual rating
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1Level =
+  ClosedEnum<typeof VendorAcceptancesControllerListVendorAcceptancesV1Level>;
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1Level$zodSchema =
+  z.enum([
+    "very-low",
+    "low",
+    "medium",
+    "high",
+    "very-high",
+  ]).describe("Risk level of the accepted residual rating");
+
+/**
+ * How the request was authenticated
+ */
+export const VendorAcceptancesControllerListVendorAcceptancesV1AuthType = {
+  ApiKey: "api-key",
+  Session: "session",
+  Service: "service",
+} as const;
+/**
+ * How the request was authenticated
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1AuthType =
+  ClosedEnum<typeof VendorAcceptancesControllerListVendorAcceptancesV1AuthType>;
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1AuthType$zodSchema =
+  z.enum([
+    "api-key",
+    "session",
+    "service",
+  ]).describe("How the request was authenticated");
+
+export type VendorAcceptancesControllerListVendorAcceptancesV1Request = {
+  id: string;
+};
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1Request$zodSchema:
+  z.ZodType<VendorAcceptancesControllerListVendorAcceptancesV1Request> = z
+    .object({
+      id: z.string().describe("Vendor ID"),
+    });
+
+/**
+ * Internal server error
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1InternalServerErrorResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1InternalServerErrorResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerListVendorAcceptancesV1InternalServerErrorResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Internal server error");
+
+/**
+ * Vendor not found
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1NotFoundResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1NotFoundResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerListVendorAcceptancesV1NotFoundResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Vendor not found");
+
+/**
+ * Forbidden - User does not have permission to access vendor risks
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1ForbiddenResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1ForbiddenResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerListVendorAcceptancesV1ForbiddenResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe(
+    "Forbidden - User does not have permission to access vendor risks",
+  );
+
+/**
+ * Unauthorized - Invalid authentication
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1UnauthorizedResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1UnauthorizedResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerListVendorAcceptancesV1UnauthorizedResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Unauthorized - Invalid authentication");
+
+export type VendorAcceptancesControllerListVendorAcceptancesV1Data = {
+  id?: string | undefined;
+  acceptedById?: string | null | undefined;
+  acceptedByName?: string | undefined;
+  notes?: string | null | undefined;
+  residualLikelihood?:
+    | VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood
+    | undefined;
+  residualImpact?:
+    | VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact
+    | undefined;
+  level?: VendorAcceptancesControllerListVendorAcceptancesV1Level | undefined;
+  levelLabel?: string | undefined;
+  stale?: boolean | undefined;
+  createdAt?: string | undefined;
+};
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1Data$zodSchema:
+  z.ZodType<VendorAcceptancesControllerListVendorAcceptancesV1Data> = z.object({
+    acceptedById: z.string().nullable().optional().describe(
+      "Member ID of the acceptor (null if since removed)",
+    ),
+    acceptedByName: z.string().optional().describe(
+      "Acceptor display name, frozen at acceptance",
+    ),
+    createdAt: z.iso.datetime({ offset: true }).optional().describe(
+      "When the acceptance was recorded (server-set, immutable)",
+    ),
+    id: z.string().optional().describe("Acceptance event ID"),
+    level: VendorAcceptancesControllerListVendorAcceptancesV1Level$zodSchema
+      .optional().describe("Risk level of the accepted residual rating"),
+    levelLabel: z.string().optional().describe("Human-readable level label"),
+    notes: z.string().nullable().optional(),
+    residualImpact:
+      VendorAcceptancesControllerListVendorAcceptancesV1ResidualImpact$zodSchema
+        .optional().describe("Residual impact frozen at acceptance"),
+    residualLikelihood:
+      VendorAcceptancesControllerListVendorAcceptancesV1ResidualLikelihood$zodSchema
+        .optional().describe("Residual likelihood frozen at acceptance"),
+    stale: z.boolean().optional().describe(
+      "True when the residual rating changed after this acceptance was recorded — re-acceptance is required",
+    ),
+  });
+
+/**
+ * User information (only for session auth)
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1AuthenticatedUser =
+  { id?: string | undefined; email?: string | undefined };
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1AuthenticatedUser$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerListVendorAcceptancesV1AuthenticatedUser
+  > = z.object({
+    email: z.string().optional(),
+    id: z.string().optional(),
+  }).describe("User information (only for session auth)");
+
+/**
+ * Acceptance history retrieved successfully (newest first)
+ */
+export type VendorAcceptancesControllerListVendorAcceptancesV1ResponseBody = {
+  data?:
+    | Array<VendorAcceptancesControllerListVendorAcceptancesV1Data>
+    | undefined;
+  authType?:
+    | VendorAcceptancesControllerListVendorAcceptancesV1AuthType
+    | undefined;
+  authenticatedUser?:
+    | VendorAcceptancesControllerListVendorAcceptancesV1AuthenticatedUser
+    | undefined;
+};
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1ResponseBody$zodSchema:
+  z.ZodType<VendorAcceptancesControllerListVendorAcceptancesV1ResponseBody> = z
+    .object({
+      authType:
+        VendorAcceptancesControllerListVendorAcceptancesV1AuthType$zodSchema
+          .optional().describe("How the request was authenticated"),
+      authenticatedUser: z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1AuthenticatedUser$zodSchema
+      ).optional().describe("User information (only for session auth)"),
+      data: z.array(
+        z.lazy(() =>
+          VendorAcceptancesControllerListVendorAcceptancesV1Data$zodSchema
+        ),
+      ).optional(),
+    }).describe("Acceptance history retrieved successfully (newest first)");
+
+export type VendorAcceptancesControllerListVendorAcceptancesV1Response =
+  | VendorAcceptancesControllerListVendorAcceptancesV1ResponseBody
+  | VendorAcceptancesControllerListVendorAcceptancesV1UnauthorizedResponseBody
+  | VendorAcceptancesControllerListVendorAcceptancesV1ForbiddenResponseBody
+  | VendorAcceptancesControllerListVendorAcceptancesV1NotFoundResponseBody
+  | VendorAcceptancesControllerListVendorAcceptancesV1InternalServerErrorResponseBody;
+
+export const VendorAcceptancesControllerListVendorAcceptancesV1Response$zodSchema:
+  z.ZodType<VendorAcceptancesControllerListVendorAcceptancesV1Response> = z
+    .union([
+      z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1ResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1UnauthorizedResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1ForbiddenResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1NotFoundResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerListVendorAcceptancesV1InternalServerErrorResponseBody$zodSchema
+      ),
+    ]);

package/src/models/vendoracceptancescontrollerrecordvendoracceptancev1op.ts

@@ -0,0 +1,300 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod";
+import { ClosedEnum } from "../types/enums.js";
+import {
+  CreateRiskAcceptanceDto,
+  CreateRiskAcceptanceDto$zodSchema,
+} from "./createriskacceptancedto.js";
+
+/**
+ * Residual likelihood frozen at acceptance
+ */
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood =
+  {
+    VeryUnlikely: "very_unlikely",
+    Unlikely: "unlikely",
+    Possible: "possible",
+    Likely: "likely",
+    VeryLikely: "very_likely",
+  } as const;
+/**
+ * Residual likelihood frozen at acceptance
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood =
+  ClosedEnum<
+    typeof VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood
+  >;
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood$zodSchema =
+  z.enum([
+    "very_unlikely",
+    "unlikely",
+    "possible",
+    "likely",
+    "very_likely",
+  ]).describe("Residual likelihood frozen at acceptance");
+
+/**
+ * Residual impact frozen at acceptance
+ */
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact =
+  {
+    Insignificant: "insignificant",
+    Minor: "minor",
+    Moderate: "moderate",
+    Major: "major",
+    Severe: "severe",
+  } as const;
+/**
+ * Residual impact frozen at acceptance
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact =
+  ClosedEnum<
+    typeof VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact
+  >;
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact$zodSchema =
+  z.enum([
+    "insignificant",
+    "minor",
+    "moderate",
+    "major",
+    "severe",
+  ]).describe("Residual impact frozen at acceptance");
+
+/**
+ * Risk level of the accepted residual rating
+ */
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1Level = {
+  VeryLow: "very-low",
+  Low: "low",
+  Medium: "medium",
+  High: "high",
+  VeryHigh: "very-high",
+} as const;
+/**
+ * Risk level of the accepted residual rating
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1Level =
+  ClosedEnum<typeof VendorAcceptancesControllerRecordVendorAcceptanceV1Level>;
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1Level$zodSchema =
+  z.enum([
+    "very-low",
+    "low",
+    "medium",
+    "high",
+    "very-high",
+  ]).describe("Risk level of the accepted residual rating");
+
+/**
+ * How the request was authenticated
+ */
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType = {
+  ApiKey: "api-key",
+  Session: "session",
+  Service: "service",
+} as const;
+/**
+ * How the request was authenticated
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType =
+  ClosedEnum<
+    typeof VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType
+  >;
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType$zodSchema =
+  z.enum([
+    "api-key",
+    "session",
+    "service",
+  ]).describe("How the request was authenticated");
+
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1Request = {
+  id: string;
+  body: CreateRiskAcceptanceDto;
+};
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1Request$zodSchema:
+  z.ZodType<VendorAcceptancesControllerRecordVendorAcceptanceV1Request> = z
+    .object({
+      body: CreateRiskAcceptanceDto$zodSchema.describe(
+        "Acceptance data (acceptor defaults to the vendor owner)",
+      ),
+      id: z.string().describe("Vendor ID"),
+    });
+
+/**
+ * Internal server error
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1InternalServerErrorResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1InternalServerErrorResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1InternalServerErrorResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Internal server error");
+
+/**
+ * Vendor not found
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1NotFoundResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1NotFoundResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1NotFoundResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Vendor not found");
+
+/**
+ * Forbidden - User does not have permission to access vendor risks
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1ForbiddenResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ForbiddenResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1ForbiddenResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe(
+    "Forbidden - User does not have permission to access vendor risks",
+  );
+
+/**
+ * Unauthorized - Invalid authentication
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1UnauthorizedResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1UnauthorizedResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1UnauthorizedResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("Unauthorized - Invalid authentication");
+
+/**
+ * No owner assigned, or the acceptor is not a valid member
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1BadRequestResponseBody =
+  { message?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1BadRequestResponseBody$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1BadRequestResponseBody
+  > = z.object({
+    message: z.string().optional(),
+  }).describe("No owner assigned, or the acceptor is not a valid member");
+
+/**
+ * User information (only for session auth)
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1AuthenticatedUser =
+  { id?: string | undefined; email?: string | undefined };
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1AuthenticatedUser$zodSchema:
+  z.ZodType<
+    VendorAcceptancesControllerRecordVendorAcceptanceV1AuthenticatedUser
+  > = z.object({
+    email: z.string().optional(),
+    id: z.string().optional(),
+  }).describe("User information (only for session auth)");
+
+/**
+ * Acceptance recorded successfully
+ */
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1ResponseBody = {
+  id?: string | undefined;
+  acceptedById?: string | null | undefined;
+  acceptedByName?: string | undefined;
+  notes?: string | null | undefined;
+  residualLikelihood?:
+    | VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood
+    | undefined;
+  residualImpact?:
+    | VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact
+    | undefined;
+  level?: VendorAcceptancesControllerRecordVendorAcceptanceV1Level | undefined;
+  levelLabel?: string | undefined;
+  stale?: boolean | undefined;
+  createdAt?: string | undefined;
+  authType?:
+    | VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType
+    | undefined;
+  authenticatedUser?:
+    | VendorAcceptancesControllerRecordVendorAcceptanceV1AuthenticatedUser
+    | undefined;
+};
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1ResponseBody$zodSchema:
+  z.ZodType<VendorAcceptancesControllerRecordVendorAcceptanceV1ResponseBody> = z
+    .object({
+      acceptedById: z.string().nullable().optional().describe(
+        "Member ID of the acceptor (null if since removed)",
+      ),
+      acceptedByName: z.string().optional().describe(
+        "Acceptor display name, frozen at acceptance",
+      ),
+      authType:
+        VendorAcceptancesControllerRecordVendorAcceptanceV1AuthType$zodSchema
+          .optional().describe("How the request was authenticated"),
+      authenticatedUser: z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1AuthenticatedUser$zodSchema
+      ).optional().describe("User information (only for session auth)"),
+      createdAt: z.iso.datetime({ offset: true }).optional().describe(
+        "When the acceptance was recorded (server-set, immutable)",
+      ),
+      id: z.string().optional().describe("Acceptance event ID"),
+      level: VendorAcceptancesControllerRecordVendorAcceptanceV1Level$zodSchema
+        .optional().describe("Risk level of the accepted residual rating"),
+      levelLabel: z.string().optional().describe("Human-readable level label"),
+      notes: z.string().nullable().optional(),
+      residualImpact:
+        VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualImpact$zodSchema
+          .optional().describe("Residual impact frozen at acceptance"),
+      residualLikelihood:
+        VendorAcceptancesControllerRecordVendorAcceptanceV1ResidualLikelihood$zodSchema
+          .optional().describe("Residual likelihood frozen at acceptance"),
+      stale: z.boolean().optional().describe(
+        "True when the residual rating changed after this acceptance was recorded — re-acceptance is required",
+      ),
+    }).describe("Acceptance recorded successfully");
+
+export type VendorAcceptancesControllerRecordVendorAcceptanceV1Response =
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1ResponseBody
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1BadRequestResponseBody
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1UnauthorizedResponseBody
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1ForbiddenResponseBody
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1NotFoundResponseBody
+  | VendorAcceptancesControllerRecordVendorAcceptanceV1InternalServerErrorResponseBody;
+
+export const VendorAcceptancesControllerRecordVendorAcceptanceV1Response$zodSchema:
+  z.ZodType<VendorAcceptancesControllerRecordVendorAcceptanceV1Response> = z
+    .union([
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1ResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1BadRequestResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1UnauthorizedResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1ForbiddenResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1NotFoundResponseBody$zodSchema
+      ),
+      z.lazy(() =>
+        VendorAcceptancesControllerRecordVendorAcceptanceV1InternalServerErrorResponseBody$zodSchema
+      ),
+    ]);

package/src/tool-names.ts

@@ -440,6 +440,14 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "delete-risk",
     "description": "Delete organization risk\n\nDelete an organization risk that no longer needs active tracking in the risk register or compliance program."
   },
+  {
+    "name": "list-risk-acceptances",
+    "description": "List risk-owner acceptance events\n\nReturns the residual-risk acceptance history for a risk, newest first. Each event freezes the residual rating at acceptance and carries a stale flag set when the risk's residual rating has changed since (ISO 27001 6.1.3(f))."
+  },
+  {
+    "name": "record-risk-acceptance",
+    "description": "Record risk-owner acceptance\n\nRecords an immutable, timestamped acceptance of a risk's current residual risk by the risk owner (or a chosen member). Re-record after the residual rating changes; prior events remain in the history."
+  },
   {
     "name": "search-global-vendors",
     "description": "Search global vendors\n\nSearch global vendor records to prefill vendor profiles and speed up third-party risk assessment workflows."
@@ -468,6 +476,14 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "trigger-assessment",
     "description": "Trigger vendor risk assessment\n\nTrigger a vendor risk assessment so Comp AI can update third-party risk evidence and vendor security review status."
   },
+  {
+    "name": "list-vendor-acceptances",
+    "description": "List vendor risk acceptance events\n\nReturns the residual-risk acceptance history for a vendor, newest first. Each event freezes the residual rating at acceptance and carries a stale flag set when the vendor's residual rating has changed since (ISO 27001 6.1.3(f))."
+  },
+  {
+    "name": "record-vendor-acceptance",
+    "description": "Record vendor risk-owner acceptance\n\nRecords an immutable, timestamped acceptance of a vendor's current residual risk by the vendor owner (or a chosen member). Re-record after the residual rating changes; prior events remain in the history."
+  },
   {
     "name": "get-all-context",
     "description": "List organization context\n\nList organization context entries used as approved source material for evidence, questionnaires, policies, and AI workflows."
@@ -1220,6 +1236,10 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "drift",
     "description": "Detect drift against the approved snapshot\n\nDetect drift against the approved snapshot in Comp AI."
   },
+  {
+    "name": "risk-treatment",
+    "description": "The Risk Treatment Plan's rows (Clause 6.1.3)\n\nReturns the organisational and supplier risk rows the Risk Treatment Plan renders (from the Risk Register and Vendors, with acceptance state per row) plus its submit-readiness messages."
+  },
   {
     "name": "get-versions",
     "description": "List an ISMS document's published version history\n\nList an ISMS document's published version history in Comp AI."
@@ -1304,6 +1324,10 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "send-training-completion-email",
     "description": "Send training completion email with certificate\n\nSend training completion email with certificate in Comp AI. Record security awareness and HIPAA training completion status and generate completion certificates."
   },
+  {
+    "name": "send-hipaa-training-completion-email",
+    "description": "Send HIPAA training completion email with certificate\n\nChecks if the member has completed the HIPAA Security Awareness Training. If so, sends an email with the HIPAA training certificate attached."
+  },
   {
     "name": "generate-certificate",
     "description": "Generate training certificate\n\nGenerate a training completion certificate that can be shared with auditors or attached as workforce security evidence."
@@ -1408,6 +1432,10 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "get-issues",
     "description": "Get penetration test issues\n\nReturns the structured findings discovered during the run. Grows over time during a live scan as agents discover more issues."
   },
+  {
+    "name": "update-pentest-finding-status",
+    "description": "Update a penetration test finding status\n\nTriage or dispute a single penetration test finding. Marking one `false_positive` or `wont_fix` requires a justification note, recorded in the finding's status history and the audit log. Requires `pentest:update`."
+  },
   {
     "name": "get-events",
     "description": "Get penetration test agent events\n\nReturns the real-time agent activity log emitted during a run (tool calls, observations, etc.). Noisy — meant for activity feeds and debugging."