@vibe-assurance/cli 1.3.0 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-assurance/cli",
-  "version": "1.3.0",
+  "version": "1.6.0",
   "description": "Vibe Assurance CLI - Connect AI coding agents to your governance platform via MCP",
   "main": "src/index.js",
   "bin": {
@@ -27,6 +27,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "@vibe-assurance/cli": "^1.3.0",
     "axios": "^1.6.0",
     "chalk": "^4.1.2",
     "commander": "^12.0.0",

package/src/mcp/tools.js

@@ -179,7 +179,7 @@ const tools = [
       properties: {
         type: {
           type: 'string',
-          enum: ['CR', 'RISK', 'VULNERABILITY', 'REPORT', 'POLICY', 'PLAN', 'ARCHITECTURE', 'CONFIG'],
+          enum: ['CR', 'RISK', 'VULNERABILITY', 'REPORT', 'POLICY', 'PLAN', 'ARCHITECTURE', 'CONFIG', 'SOP'],
           description: 'Type of artifact'
         },
         artifactId: {
@@ -298,14 +298,14 @@ const tools = [
 
   {
     name: 'vibe_list_artifacts',
-    description: 'List your stored artifacts with optional filters. Use this to see what governance documents you have stored.',
+    description: 'List your stored artifacts with optional filters. Use this to see what governance documents you have stored. TIP: Use type="PLAN" with status="Active" to find strategic plans before implementing features.',
     inputSchema: {
       type: 'object',
       properties: {
         type: {
           type: 'string',
-          enum: ['CR', 'RISK', 'VULNERABILITY', 'REPORT', 'POLICY', 'PLAN', 'ARCHITECTURE', 'CONFIG'],
-          description: 'Filter by artifact type'
+          enum: ['CR', 'RISK', 'VULNERABILITY', 'REPORT', 'POLICY', 'PLAN', 'ARCHITECTURE', 'CONFIG', 'SOP'],
+          description: 'Filter by artifact type. Use "PLAN" to find strategic plans.'
         },
         status: {
           type: 'string',
@@ -364,6 +364,554 @@ const tools = [
     handler: async ({ artifactId }) => {
       return await api.delete(`/api/mcp/artifacts/${artifactId}`);
     }
+  },
+
+  // ============================================================================
+  // STRATEGIC PLAN TOOLS - Use these FIRST when implementing features
+  // ============================================================================
+
+  {
+    name: 'vibe_get_strategic_plans',
+    description: 'START HERE when user asks to implement features or "the latest plan". Lists strategic PLAN artifacts containing CR roadmaps. Filter by status="Active" to find plans ready for implementation.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Filter by plan status. Use "Active" to find plans ready for implementation.'
+        }
+      }
+    },
+    handler: async (params = {}) => {
+      const query = new URLSearchParams();
+      query.set('type', 'PLAN');
+      if (params.status) query.set('status', params.status);
+      return await api.get(`/api/mcp/artifacts?${query.toString()}`);
+    }
+  },
+
+  {
+    name: 'vibe_update_plan_status',
+    description: 'Update a strategic plan\'s status. Use when all CRs from a plan are complete to mark it as Completed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        planId: {
+          type: 'string',
+          description: 'The plan artifact ID (e.g., "PLAN-2026-001")'
+        },
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'New status for the plan'
+        }
+      },
+      required: ['planId', 'status']
+    },
+    handler: async ({ planId, status }) => {
+      return await api.put(`/api/mcp/artifacts/${planId}`, { status });
+    }
+  },
+
+  // ============================================================================
+  // RISK MANAGEMENT TOOLS
+  // ============================================================================
+
+  {
+    name: 'vibe_get_risk_register',
+    description: 'Get the project\'s risk register. Returns all tracked risks with severity, status, and treatment plans.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        status: {
+          type: 'string',
+          enum: ['Active', 'Mitigated', 'Closed'],
+          description: 'Filter by risk status'
+        },
+        severity: {
+          type: 'string',
+          enum: ['Low', 'Medium', 'High', 'Critical'],
+          description: 'Filter by severity'
+        },
+        category: {
+          type: 'string',
+          enum: ['SEC', 'VEN', 'INF', 'OPS', 'CMP'],
+          description: 'Filter by category (SEC=Security, VEN=Vendor, INF=Infrastructure, OPS=Operational, CMP=Compliance)'
+        }
+      }
+    },
+    handler: async (params = {}) => {
+      const query = new URLSearchParams();
+      if (params.status) query.set('status', params.status);
+      if (params.severity) query.set('severity', params.severity);
+      if (params.category) query.set('category', params.category);
+      const queryString = query.toString();
+      const path = queryString ? `/api/mcp/risks?${queryString}` : '/api/mcp/risks';
+      return await api.get(path);
+    }
+  },
+
+  {
+    name: 'vibe_add_risk',
+    description: 'Add a new risk to the project risk register. Severity is auto-calculated from likelihood × impact.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        riskId: {
+          type: 'string',
+          description: 'Unique risk ID (e.g., "RISK-001", "R-042")'
+        },
+        title: {
+          type: 'string',
+          description: 'Short title for the risk'
+        },
+        description: {
+          type: 'string',
+          description: 'Detailed description of the risk'
+        },
+        category: {
+          type: 'string',
+          enum: ['SEC', 'VEN', 'INF', 'OPS', 'CMP'],
+          description: 'Risk category'
+        },
+        likelihood: {
+          type: 'number',
+          description: 'Likelihood score (1-5)'
+        },
+        impact: {
+          type: 'number',
+          description: 'Impact score (1-5)'
+        },
+        treatmentPlan: {
+          type: 'string',
+          description: 'Optional: Treatment plan or mitigation strategy'
+        }
+      },
+      required: ['riskId', 'title', 'description', 'category', 'likelihood', 'impact']
+    },
+    handler: async (params) => {
+      return await api.post('/api/mcp/risks', params);
+    }
+  },
+
+  {
+    name: 'vibe_get_risk',
+    description: 'Get a specific risk by ID with full details.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        riskId: {
+          type: 'string',
+          description: 'The risk ID to retrieve (e.g., "RISK-001")'
+        }
+      },
+      required: ['riskId']
+    },
+    handler: async ({ riskId }) => {
+      return await api.get(`/api/mcp/risks/${riskId}`);
+    }
+  },
+
+  {
+    name: 'vibe_update_risk',
+    description: 'Update a risk\'s status, treatment plan, or reassess likelihood/impact.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        riskId: {
+          type: 'string',
+          description: 'The risk ID to update'
+        },
+        status: {
+          type: 'string',
+          enum: ['Active', 'Mitigated', 'Closed'],
+          description: 'New status'
+        },
+        likelihood: {
+          type: 'number',
+          description: 'Updated likelihood (1-5)'
+        },
+        impact: {
+          type: 'number',
+          description: 'Updated impact (1-5)'
+        },
+        treatmentPlan: {
+          type: 'string',
+          description: 'Updated treatment plan'
+        }
+      },
+      required: ['riskId']
+    },
+    handler: async ({ riskId, ...updates }) => {
+      return await api.put(`/api/mcp/risks/${riskId}`, updates);
+    }
+  },
+
+  // ============================================================================
+  // VULNERABILITY MANAGEMENT TOOLS
+  // ============================================================================
+
+  {
+    name: 'vibe_get_vulnerability_register',
+    description: 'Get the project\'s vulnerability register. Returns all tracked security vulnerabilities.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        status: {
+          type: 'string',
+          enum: ['Active', 'Pending Verification', 'Verified', 'Closed'],
+          description: 'Filter by vulnerability status'
+        },
+        severity: {
+          type: 'string',
+          enum: ['Low', 'Medium', 'High', 'Critical'],
+          description: 'Filter by severity'
+        },
+        owaspCategory: {
+          type: 'string',
+          description: 'Filter by OWASP category (e.g., "A01:2021-Broken Access Control")'
+        }
+      }
+    },
+    handler: async (params = {}) => {
+      const query = new URLSearchParams();
+      if (params.status) query.set('status', params.status);
+      if (params.severity) query.set('severity', params.severity);
+      if (params.owaspCategory) query.set('owaspCategory', params.owaspCategory);
+      const queryString = query.toString();
+      const path = queryString ? `/api/mcp/vulnerabilities?${queryString}` : '/api/mcp/vulnerabilities';
+      return await api.get(path);
+    }
+  },
+
+  {
+    name: 'vibe_add_vulnerability',
+    description: 'Add a new vulnerability to the project vulnerability register with OWASP category validation.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        vulId: {
+          type: 'string',
+          description: 'Unique vulnerability ID (e.g., "VUL-001")'
+        },
+        title: {
+          type: 'string',
+          description: 'Short title for the vulnerability'
+        },
+        description: {
+          type: 'string',
+          description: 'Detailed description of the vulnerability'
+        },
+        severity: {
+          type: 'string',
+          enum: ['Low', 'Medium', 'High', 'Critical'],
+          description: 'Severity level'
+        },
+        owaspCategory: {
+          type: 'string',
+          description: 'OWASP Top 10 category (e.g., "A01:2021-Broken Access Control")'
+        },
+        location: {
+          type: 'string',
+          description: 'File path or component where vulnerability exists'
+        }
+      },
+      required: ['vulId', 'title', 'description', 'severity']
+    },
+    handler: async (params) => {
+      return await api.post('/api/mcp/vulnerabilities', params);
+    }
+  },
+
+  {
+    name: 'vibe_get_vulnerability',
+    description: 'Get a specific vulnerability by ID with full details.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        vulId: {
+          type: 'string',
+          description: 'The vulnerability ID to retrieve (e.g., "VUL-001")'
+        }
+      },
+      required: ['vulId']
+    },
+    handler: async ({ vulId }) => {
+      return await api.get(`/api/mcp/vulnerabilities/${vulId}`);
+    }
+  },
+
+  {
+    name: 'vibe_update_vulnerability',
+    description: 'Update a vulnerability\'s status, severity, or link it to a remediation CR.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        vulId: {
+          type: 'string',
+          description: 'The vulnerability ID to update'
+        },
+        status: {
+          type: 'string',
+          enum: ['Active', 'Pending Verification', 'Verified', 'Closed'],
+          description: 'New status'
+        },
+        severity: {
+          type: 'string',
+          enum: ['Low', 'Medium', 'High', 'Critical'],
+          description: 'Updated severity'
+        },
+        relatedCR: {
+          type: 'string',
+          description: 'Link to remediation CR (e.g., "CR-2026-042")'
+        }
+      },
+      required: ['vulId']
+    },
+    handler: async ({ vulId, ...updates }) => {
+      return await api.put(`/api/mcp/vulnerabilities/${vulId}`, updates);
+    }
+  },
+
+  // ============================================================================
+  // SOP MANAGEMENT TOOLS (CR-2026-054)
+  // ============================================================================
+
+  {
+    name: 'vibe_list_sops',
+    description: 'List all Standard Operating Procedures (SOPs) for the project. SOPs define step-by-step procedures for operational tasks.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Filter by SOP status'
+        },
+        category: {
+          type: 'string',
+          description: 'Filter by category (e.g., "Security", "HR", "SDLC", "Change Management")'
+        }
+      }
+    },
+    handler: async (params = {}) => {
+      const query = new URLSearchParams();
+      if (params.status) query.set('status', params.status);
+      if (params.category) query.set('category', params.category);
+      const queryString = query.toString();
+      const path = queryString ? `/api/mcp/sops?${queryString}` : '/api/mcp/sops';
+      return await api.get(path);
+    }
+  },
+
+  {
+    name: 'vibe_store_sop',
+    description: 'Create a new Standard Operating Procedure (SOP). SOPs define step-by-step procedures for operational tasks like onboarding, offboarding, access reviews, etc.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sopId: {
+          type: 'string',
+          description: 'Unique SOP ID (e.g., "SOP-001", "SOP-SDLC-001")'
+        },
+        title: {
+          type: 'string',
+          description: 'Title of the SOP (e.g., "Employee Onboarding Checklist")'
+        },
+        content: {
+          type: 'string',
+          description: 'Full SOP content in markdown format'
+        },
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'SOP status (default: Active)'
+        },
+        metadata: {
+          type: 'object',
+          description: 'Additional metadata (e.g., category, version, owner)',
+          additionalProperties: true
+        }
+      },
+      required: ['sopId', 'title', 'content']
+    },
+    handler: async (params) => {
+      return await api.post('/api/mcp/sops', params);
+    }
+  },
+
+  {
+    name: 'vibe_get_sop',
+    description: 'Get a specific SOP by ID with full content.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sopId: {
+          type: 'string',
+          description: 'The SOP ID to retrieve (e.g., "SOP-001")'
+        }
+      },
+      required: ['sopId']
+    },
+    handler: async ({ sopId }) => {
+      return await api.get(`/api/mcp/sops/${sopId}`);
+    }
+  },
+
+  {
+    name: 'vibe_update_sop',
+    description: 'Update an existing SOP\'s content, status, or metadata.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sopId: {
+          type: 'string',
+          description: 'The SOP ID to update'
+        },
+        title: {
+          type: 'string',
+          description: 'Updated title'
+        },
+        content: {
+          type: 'string',
+          description: 'Updated content'
+        },
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Updated status'
+        },
+        metadata: {
+          type: 'object',
+          description: 'Updated metadata'
+        }
+      },
+      required: ['sopId']
+    },
+    handler: async ({ sopId, ...updates }) => {
+      return await api.put(`/api/mcp/sops/${sopId}`, updates);
+    }
+  },
+
+  // ============================================================================
+  // POLICY MANAGEMENT TOOLS (CR-2026-054)
+  // ============================================================================
+
+  {
+    name: 'vibe_list_policies',
+    description: 'List all policies for the project. Policies define organizational rules and guidelines.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Filter by policy status'
+        },
+        category: {
+          type: 'string',
+          description: 'Filter by category (e.g., "Security", "HR", "SDLC")'
+        }
+      }
+    },
+    handler: async (params = {}) => {
+      const query = new URLSearchParams();
+      if (params.status) query.set('status', params.status);
+      if (params.category) query.set('category', params.category);
+      const queryString = query.toString();
+      const path = queryString ? `/api/mcp/policies?${queryString}` : '/api/mcp/policies';
+      return await api.get(path);
+    }
+  },
+
+  {
+    name: 'vibe_store_policy',
+    description: 'Create a new policy document. Policies define organizational rules and guidelines for security, HR, SDLC, etc.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        policyId: {
+          type: 'string',
+          description: 'Unique policy ID (e.g., "POL-001", "POL-SEC-001")'
+        },
+        title: {
+          type: 'string',
+          description: 'Title of the policy (e.g., "Information Security Policy")'
+        },
+        content: {
+          type: 'string',
+          description: 'Full policy content in markdown format'
+        },
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Policy status (default: Active)'
+        },
+        metadata: {
+          type: 'object',
+          description: 'Additional metadata (e.g., category, version, owner)',
+          additionalProperties: true
+        }
+      },
+      required: ['policyId', 'title', 'content']
+    },
+    handler: async (params) => {
+      return await api.post('/api/mcp/policies', params);
+    }
+  },
+
+  {
+    name: 'vibe_get_policy',
+    description: 'Get a specific policy by ID with full content.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        policyId: {
+          type: 'string',
+          description: 'The policy ID to retrieve (e.g., "POL-001")'
+        }
+      },
+      required: ['policyId']
+    },
+    handler: async ({ policyId }) => {
+      return await api.get(`/api/mcp/policies/${policyId}`);
+    }
+  },
+
+  {
+    name: 'vibe_update_policy',
+    description: 'Update an existing policy\'s content, status, or metadata.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        policyId: {
+          type: 'string',
+          description: 'The policy ID to update'
+        },
+        title: {
+          type: 'string',
+          description: 'Updated title'
+        },
+        content: {
+          type: 'string',
+          description: 'Updated content'
+        },
+        status: {
+          type: 'string',
+          enum: ['Draft', 'Active', 'Completed', 'Closed'],
+          description: 'Updated status'
+        },
+        metadata: {
+          type: 'object',
+          description: 'Updated metadata'
+        }
+      },
+      required: ['policyId']
+    },
+    handler: async ({ policyId, ...updates }) => {
+      return await api.put(`/api/mcp/policies/${policyId}`, updates);
+    }
   }
 ];