@zivis/mcp 0.1.0-alpha.1

package/dist/tools/enterprise/manage-data-flow.js

@@ -0,0 +1,98 @@
+/**
+ * zivis_manage_data_flow — Create, update, or delete data flows in a threat model
+ *
+ * Maps to: POST/PATCH/DELETE /api/threat-models/:id/data-flows
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const MANAGE_DATA_FLOW_NAME = "zivis_manage_data_flow";
+export const MANAGE_DATA_FLOW_DESCRIPTION = `Create, update, or delete a data flow between components in a threat model.
+
+Data flows represent the movement of data between components. They are critical for identifying where data crosses trust boundaries and where threats may exist.
+
+Actions:
+- create: Add a new data flow (requires name, source_component_id, target_component_id)
+- update: Modify an existing data flow (requires flow_id)
+- delete: Remove a data flow (requires flow_id)`;
+export const MANAGE_DATA_FLOW_SCHEMA = {
+    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
+    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
+    flow_id: z.string().optional().describe("Data flow UUID (required for update/delete)"),
+    name: z.string().optional().describe("Flow name (e.g., 'User Auth Request', 'API Response')"),
+    source_component_id: z.string().optional().describe("Source component UUID"),
+    target_component_id: z.string().optional().describe("Target component UUID"),
+    description: z.string().optional().describe("Description of what data flows and why"),
+    protocol: z.string().optional().describe("Protocol used (e.g., 'HTTPS', 'gRPC', 'WebSocket')"),
+    data_classification: z
+        .enum(["public", "internal", "confidential", "restricted", "critical"])
+        .optional()
+        .describe("Classification of data in this flow"),
+    is_encrypted: z.boolean().optional().describe("Whether the data flow is encrypted in transit"),
+    crosses_trust_boundary: z.boolean().optional().describe("Whether this flow crosses a trust boundary"),
+};
+export function createManageDataFlowHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { threat_model_id, action, flow_id } = params;
+            if ((action === "update" || action === "delete") && !flow_id) {
+                return {
+                    content: [{ type: "text", text: "Error: flow_id is required for update/delete" }],
+                    isError: true,
+                };
+            }
+            let data;
+            if (action === "create") {
+                if (!params.name || !params.source_component_id || !params.target_component_id) {
+                    return {
+                        content: [{ type: "text", text: "Error: name, source_component_id, and target_component_id are required for create" }],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post(`/api/threat-models/${threat_model_id}/data-flows`, {
+                    name: params.name,
+                    sourceComponentId: params.source_component_id,
+                    targetComponentId: params.target_component_id,
+                    description: params.description,
+                    protocol: params.protocol,
+                    dataClassification: params.data_classification,
+                    isEncrypted: params.is_encrypted,
+                    crossesTrustBoundary: params.crosses_trust_boundary,
+                });
+            }
+            else if (action === "update") {
+                const body = {};
+                if (params.name)
+                    body.name = params.name;
+                if (params.source_component_id)
+                    body.sourceComponentId = params.source_component_id;
+                if (params.target_component_id)
+                    body.targetComponentId = params.target_component_id;
+                if (params.description !== undefined)
+                    body.description = params.description;
+                if (params.protocol !== undefined)
+                    body.protocol = params.protocol;
+                if (params.data_classification)
+                    body.dataClassification = params.data_classification;
+                if (params.is_encrypted !== undefined)
+                    body.isEncrypted = params.is_encrypted;
+                if (params.crosses_trust_boundary !== undefined)
+                    body.crossesTrustBoundary = params.crosses_trust_boundary;
+                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/data-flows/${flow_id}`, body);
+            }
+            else {
+                data = await apiClient.del(`/api/threat-models/${threat_model_id}/data-flows/${flow_id}`);
+            }
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage data flow";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=manage-data-flow.js.map

package/dist/tools/enterprise/manage-data-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-data-flow.js","sourceRoot":"","sources":["../../../src/tools/enterprise/manage-data-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;gDAOI,CAAC;AAEjD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACtF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC7F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC5E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC9F,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;SACtE,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC9F,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CACtG,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB;IAC9D,OAAO,KAAK,EAAE,MAYb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;YAEpD,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7D,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;oBAC1F,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,IAA6B,CAAC;YAElC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/E,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,mFAAmF,EAAE,CAAC;wBAC/H,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CACzB,sBAAsB,eAAe,aAAa,EAClD;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,iBAAiB,EAAE,MAAM,CAAC,mBAAmB;oBAC7C,iBAAiB,EAAE,MAAM,CAAC,mBAAmB;oBAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,kBAAkB,EAAE,MAAM,CAAC,mBAAmB;oBAC9C,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,oBAAoB,EAAE,MAAM,CAAC,sBAAsB;iBACpD,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAA4B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzC,IAAI,MAAM,CAAC,mBAAmB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;gBACpF,IAAI,MAAM,CAAC,mBAAmB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;gBACpF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnE,IAAI,MAAM,CAAC,mBAAmB;oBAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,mBAAmB,CAAC;gBACrF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC9E,IAAI,MAAM,CAAC,sBAAsB,KAAK,SAAS;oBAAE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,sBAAsB,CAAC;gBAE3G,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAC1B,sBAAsB,eAAe,eAAe,OAAO,EAAE,EAC7D,IAAI,CACL,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CACxB,sBAAsB,eAAe,eAAe,OAAO,EAAE,CAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/manage-finding.d.ts

@@ -0,0 +1,69 @@
+/**
+ * zivis_manage_finding — Create or update findings in a threat model
+ *
+ * Maps to: POST/PATCH /api/threat-models/:id/findings
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const MANAGE_FINDING_NAME = "zivis_manage_finding";
+export declare const MANAGE_FINDING_DESCRIPTION = "Create or update a finding (vulnerability) in a threat model.\n\nFindings represent confirmed or suspected vulnerabilities discovered during analysis or pen testing. They link to components, attack scenarios, and can be tracked through remediation.\n\nActions:\n- create: Add a new finding (requires title, severity)\n- update: Modify an existing finding (requires finding_id) \u2014 use to update status, add notes, etc.";
+export declare const MANAGE_FINDING_SCHEMA: {
+    threat_model_id: z.ZodString;
+    action: z.ZodEnum<{
+        create: "create";
+        update: "update";
+    }>;
+    finding_id: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        false_positive: "false_positive";
+        open: "open";
+        in_progress: "in_progress";
+        mitigated: "mitigated";
+        verified: "verified";
+        accepted_risk: "accepted_risk";
+    }>>;
+    category: z.ZodOptional<z.ZodString>;
+    component_id: z.ZodOptional<z.ZodString>;
+    attack_scenario_id: z.ZodOptional<z.ZodString>;
+    cwe_id: z.ZodOptional<z.ZodString>;
+    cvss_score: z.ZodOptional<z.ZodNumber>;
+    remediation: z.ZodOptional<z.ZodString>;
+    proof_of_concept: z.ZodOptional<z.ZodString>;
+};
+export declare function createManageFindingHandler(apiClient: ApiClient): (params: {
+    threat_model_id: string;
+    action: "create" | "update";
+    finding_id?: string;
+    title?: string;
+    description?: string;
+    severity?: string;
+    status?: string;
+    category?: string;
+    component_id?: string;
+    attack_scenario_id?: string;
+    cwe_id?: string;
+    cvss_score?: number;
+    remediation?: string;
+    proof_of_concept?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/enterprise/manage-finding.js

@@ -0,0 +1,106 @@
+/**
+ * zivis_manage_finding — Create or update findings in a threat model
+ *
+ * Maps to: POST/PATCH /api/threat-models/:id/findings
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const MANAGE_FINDING_NAME = "zivis_manage_finding";
+export const MANAGE_FINDING_DESCRIPTION = `Create or update a finding (vulnerability) in a threat model.
+
+Findings represent confirmed or suspected vulnerabilities discovered during analysis or pen testing. They link to components, attack scenarios, and can be tracked through remediation.
+
+Actions:
+- create: Add a new finding (requires title, severity)
+- update: Modify an existing finding (requires finding_id) — use to update status, add notes, etc.`;
+export const MANAGE_FINDING_SCHEMA = {
+    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
+    action: z.enum(["create", "update"]).describe("Action to perform"),
+    finding_id: z.string().optional().describe("Finding UUID (required for update)"),
+    title: z.string().optional().describe("Finding title (e.g., 'SQL Injection in user search endpoint')"),
+    description: z.string().optional().describe("Detailed description of the vulnerability"),
+    severity: z.enum(["critical", "high", "medium", "low", "info"]).optional().describe("Severity level"),
+    status: z
+        .enum(["open", "in_progress", "mitigated", "verified", "accepted_risk", "false_positive"])
+        .optional()
+        .describe("Finding status"),
+    category: z.string().optional().describe("Category (e.g., 'injection', 'authentication', 'authorization')"),
+    component_id: z.string().optional().describe("Affected component UUID"),
+    attack_scenario_id: z.string().optional().describe("Related attack scenario UUID"),
+    cwe_id: z.string().optional().describe("CWE identifier (e.g., 'CWE-89')"),
+    cvss_score: z.number().min(0).max(10).optional().describe("CVSS score (0-10)"),
+    remediation: z.string().optional().describe("Recommended remediation steps"),
+    proof_of_concept: z.string().optional().describe("Proof of concept or reproduction steps"),
+};
+export function createManageFindingHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { threat_model_id, action, finding_id } = params;
+            if (action === "update" && !finding_id) {
+                return {
+                    content: [{ type: "text", text: "Error: finding_id is required for update" }],
+                    isError: true,
+                };
+            }
+            let data;
+            if (action === "create") {
+                if (!params.title || !params.severity) {
+                    return {
+                        content: [{ type: "text", text: "Error: title and severity are required for create" }],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post(`/api/threat-models/${threat_model_id}/findings`, {
+                    title: params.title,
+                    description: params.description,
+                    severity: params.severity,
+                    status: params.status || "open",
+                    category: params.category,
+                    componentId: params.component_id,
+                    attackScenarioId: params.attack_scenario_id,
+                    cweId: params.cwe_id,
+                    cvssScore: params.cvss_score,
+                    remediation: params.remediation,
+                    proofOfConcept: params.proof_of_concept,
+                });
+            }
+            else {
+                const body = {};
+                if (params.title)
+                    body.title = params.title;
+                if (params.description !== undefined)
+                    body.description = params.description;
+                if (params.severity)
+                    body.severity = params.severity;
+                if (params.status)
+                    body.status = params.status;
+                if (params.category)
+                    body.category = params.category;
+                if (params.component_id)
+                    body.componentId = params.component_id;
+                if (params.attack_scenario_id)
+                    body.attackScenarioId = params.attack_scenario_id;
+                if (params.cwe_id)
+                    body.cweId = params.cwe_id;
+                if (params.cvss_score !== undefined)
+                    body.cvssScore = params.cvss_score;
+                if (params.remediation !== undefined)
+                    body.remediation = params.remediation;
+                if (params.proof_of_concept !== undefined)
+                    body.proofOfConcept = params.proof_of_concept;
+                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/findings/${finding_id}`, body);
+            }
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage finding";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=manage-finding.js.map

package/dist/tools/enterprise/manage-finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-finding.js","sourceRoot":"","sources":["../../../src/tools/enterprise/manage-finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;mGAMyD,CAAC;AAEpG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACtG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACxF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACrG,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;SACzF,QAAQ,EAAE;SACV,QAAQ,CAAC,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC3G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACvE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAClF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAC9E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CAC3F,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,KAAK,EAAE,MAeb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YAEvD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;oBACtF,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,IAA6B,CAAC;YAElC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;wBAC/F,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CACzB,sBAAsB,eAAe,WAAW,EAChD;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,gBAAgB,EAAE,MAAM,CAAC,kBAAkB;oBAC3C,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,cAAc,EAAE,MAAM,CAAC,gBAAgB;iBACxC,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAA4B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,KAAK;oBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC5C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACrD,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACrD,IAAI,MAAM,CAAC,YAAY;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAChE,IAAI,MAAM,CAAC,kBAAkB;oBAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACjF,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;oBAAE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAEzF,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAC1B,sBAAsB,eAAe,aAAa,UAAU,EAAE,EAC9D,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/manage-security-control.d.ts

@@ -0,0 +1,59 @@
+/**
+ * zivis_manage_security_control — Create, update, or delete security controls
+ *
+ * Maps to: POST/PATCH/DELETE /api/threat-models/:id/security-controls
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const MANAGE_SECURITY_CONTROL_NAME = "zivis_manage_security_control";
+export declare const MANAGE_SECURITY_CONTROL_DESCRIPTION = "Create, update, or delete a security control in a threat model.\n\nSecurity controls are mitigations that reduce or eliminate threats (e.g., input validation, rate limiting, encryption at rest).\n\nActions:\n- create: Add a new control (requires name, control_type)\n- update: Modify an existing control (requires control_id)\n- delete: Remove a control (requires control_id)";
+export declare const MANAGE_SECURITY_CONTROL_SCHEMA: {
+    threat_model_id: z.ZodString;
+    action: z.ZodEnum<{
+        create: "create";
+        update: "update";
+        delete: "delete";
+    }>;
+    control_id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    control_type: z.ZodOptional<z.ZodEnum<{
+        preventive: "preventive";
+        detective: "detective";
+        responsive: "responsive";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        not_implemented: "not_implemented";
+        partial: "partial";
+        implemented: "implemented";
+    }>>;
+    effectiveness_rating: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        medium: "medium";
+        low: "low";
+    }>>;
+    component_id: z.ZodOptional<z.ZodString>;
+};
+export declare function createManageSecurityControlHandler(apiClient: ApiClient): (params: {
+    threat_model_id: string;
+    action: "create" | "update" | "delete";
+    control_id?: string;
+    name?: string;
+    control_type?: string;
+    description?: string;
+    status?: string;
+    effectiveness_rating?: string;
+    component_id?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/enterprise/manage-security-control.js

@@ -0,0 +1,96 @@
+/**
+ * zivis_manage_security_control — Create, update, or delete security controls
+ *
+ * Maps to: POST/PATCH/DELETE /api/threat-models/:id/security-controls
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const MANAGE_SECURITY_CONTROL_NAME = "zivis_manage_security_control";
+export const MANAGE_SECURITY_CONTROL_DESCRIPTION = `Create, update, or delete a security control in a threat model.
+
+Security controls are mitigations that reduce or eliminate threats (e.g., input validation, rate limiting, encryption at rest).
+
+Actions:
+- create: Add a new control (requires name, control_type)
+- update: Modify an existing control (requires control_id)
+- delete: Remove a control (requires control_id)`;
+export const MANAGE_SECURITY_CONTROL_SCHEMA = {
+    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
+    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
+    control_id: z.string().optional().describe("Control UUID (required for update/delete)"),
+    name: z.string().optional().describe("Control name (e.g., 'Input Validation', 'Rate Limiting')"),
+    control_type: z
+        .enum(["preventive", "detective", "responsive"])
+        .optional()
+        .describe("Type of security control"),
+    description: z.string().optional().describe("Description of how the control works"),
+    status: z
+        .enum(["not_implemented", "partial", "implemented"])
+        .optional()
+        .describe("Current implementation status"),
+    effectiveness_rating: z
+        .enum(["high", "medium", "low"])
+        .optional()
+        .describe("Estimated effectiveness of the control"),
+    component_id: z.string().optional().describe("Component UUID this control applies to"),
+};
+export function createManageSecurityControlHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { threat_model_id, action, control_id } = params;
+            if ((action === "update" || action === "delete") && !control_id) {
+                return {
+                    content: [{ type: "text", text: "Error: control_id is required for update/delete" }],
+                    isError: true,
+                };
+            }
+            let data;
+            if (action === "create") {
+                if (!params.name || !params.control_type) {
+                    return {
+                        content: [{ type: "text", text: "Error: name and control_type are required for create" }],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post(`/api/threat-models/${threat_model_id}/security-controls`, {
+                    name: params.name,
+                    controlType: params.control_type,
+                    description: params.description,
+                    status: params.status,
+                    effectivenessRating: params.effectiveness_rating,
+                    componentId: params.component_id,
+                });
+            }
+            else if (action === "update") {
+                const body = {};
+                if (params.name)
+                    body.name = params.name;
+                if (params.control_type)
+                    body.controlType = params.control_type;
+                if (params.description !== undefined)
+                    body.description = params.description;
+                if (params.status)
+                    body.status = params.status;
+                if (params.effectiveness_rating)
+                    body.effectivenessRating = params.effectiveness_rating;
+                if (params.component_id)
+                    body.componentId = params.component_id;
+                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/security-controls/${control_id}`, body);
+            }
+            else {
+                data = await apiClient.del(`/api/threat-models/${threat_model_id}/security-controls/${control_id}`);
+            }
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage security control";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=manage-security-control.js.map

package/dist/tools/enterprise/manage-security-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-security-control.js","sourceRoot":"","sources":["../../../src/tools/enterprise/manage-security-control.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E,MAAM,CAAC,MAAM,mCAAmC,GAAG;;;;;;;iDAOF,CAAC;AAElD,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACjF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACvF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAChG,YAAY,EAAE,CAAC;SACZ,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;SAC/C,QAAQ,EAAE;SACV,QAAQ,CAAC,0BAA0B,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,+BAA+B,CAAC;IAC5C,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;SAC/B,QAAQ,EAAE;SACV,QAAQ,CAAC,wCAAwC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvF,CAAC;AAEF,MAAM,UAAU,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,MAUb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YAEvD,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;oBAC7F,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,IAA6B,CAAC;YAElC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAAC;wBAClG,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CACzB,sBAAsB,eAAe,oBAAoB,EACzD;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,mBAAmB,EAAE,MAAM,CAAC,oBAAoB;oBAChD,WAAW,EAAE,MAAM,CAAC,YAAY;iBACjC,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAA4B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzC,IAAI,MAAM,CAAC,YAAY;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAChE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/C,IAAI,MAAM,CAAC,oBAAoB;oBAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,oBAAoB,CAAC;gBACxF,IAAI,MAAM,CAAC,YAAY;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEhE,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAC1B,sBAAsB,eAAe,sBAAsB,UAAU,EAAE,EACvE,IAAI,CACL,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CACxB,sBAAsB,eAAe,sBAAsB,UAAU,EAAE,CACxE,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC;YACzF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/manage-test-case.d.ts

@@ -0,0 +1,88 @@
+/**
+ * zivis_manage_test_case — Create, update, or delete test cases in a threat model
+ *
+ * Maps to: POST/PATCH/DELETE /api/threat-models/:id/test-cases
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const MANAGE_TEST_CASE_NAME = "zivis_manage_test_case";
+export declare const MANAGE_TEST_CASE_DESCRIPTION = "Create, update, or delete a test case in a threat model.\n\nTest cases define specific security tests to validate whether vulnerabilities exist. They link to attack scenarios and can be automated or manual. Test case IDs follow the TC-X.Y format.\n\nActions:\n- create: Add a new test case (requires name, description, success_criteria)\n- update: Modify an existing test case (requires test_case_id) \u2014 use this to record test results\n- delete: Remove a test case (requires test_case_id)";
+export declare const MANAGE_TEST_CASE_SCHEMA: {
+    threat_model_id: z.ZodString;
+    action: z.ZodEnum<{
+        create: "create";
+        update: "update";
+        delete: "delete";
+    }>;
+    test_case_id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    attack_scenario_id: z.ZodOptional<z.ZodString>;
+    preconditions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    test_steps: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        step: z.ZodNumber;
+        action: z.ZodString;
+        expected: z.ZodString;
+        actual: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    success_criteria: z.ZodOptional<z.ZodString>;
+    evidence_type: z.ZodOptional<z.ZodEnum<{
+        code_snippet: "code_snippet";
+        video: "video";
+        screenshot: "screenshot";
+        http_request: "http_request";
+        log_entry: "log_entry";
+        manual_notes: "manual_notes";
+    }>>;
+    result: z.ZodOptional<z.ZodEnum<{
+        partial: "partial";
+        not_tested: "not_tested";
+        pass: "pass";
+        fail: "fail";
+        blocked: "blocked";
+    }>>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    findings: z.ZodOptional<z.ZodString>;
+    automatable: z.ZodOptional<z.ZodBoolean>;
+    automation_tool: z.ZodOptional<z.ZodString>;
+};
+export declare function createManageTestCaseHandler(apiClient: ApiClient): (params: {
+    threat_model_id: string;
+    action: "create" | "update" | "delete";
+    test_case_id?: string;
+    name?: string;
+    description?: string;
+    attack_scenario_id?: string;
+    preconditions?: string[];
+    test_steps?: Array<{
+        step: number;
+        action: string;
+        expected: string;
+        actual?: string;
+    }>;
+    success_criteria?: string;
+    evidence_type?: string;
+    result?: string;
+    severity?: string;
+    findings?: string;
+    automatable?: boolean;
+    automation_tool?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;