@zivis/mcp 0.1.0-alpha.1

package/dist/types.d.ts

@@ -0,0 +1,220 @@
+/**
+ * Shared types for the ZIVIS MCP Security Server
+ */
+export interface OAuthTokens {
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+    id_token?: string;
+}
+export type AuthMethod = "oauth" | "apikey" | "none";
+export interface AuthCredentials {
+    method: AuthMethod;
+    /** OAuth access token (when method === "oauth") */
+    accessToken?: string;
+    /** WorkOS API key (when method === "apikey") */
+    apiKey?: string;
+}
+export interface AuthStatus {
+    method: AuthMethod;
+    email?: string;
+    orgName?: string;
+    orgId?: string;
+}
+export interface FindingSummary {
+    id: string;
+    title: string;
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    sourceType: string;
+    sourceSubtype?: string;
+    filePath?: string;
+    lineNumber?: number;
+    status: string;
+    cweId?: string;
+    firstDetected?: string;
+    remediationEffort?: string;
+}
+export interface FindingsSummaryStats {
+    total: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+}
+export interface GetFindingsResponse {
+    findings: FindingSummary[];
+    summary: FindingsSummaryStats;
+}
+export interface CodeFindingDetail {
+    id: string;
+    sourceType: "code";
+    title: string;
+    severity: string;
+    status: string;
+    description?: string;
+    filePath?: string;
+    startLine?: number;
+    endLine?: number;
+    codeSnippet?: string;
+    ruleId?: string;
+    cweId?: string;
+    owaspIds?: string[];
+    remediation?: string;
+    scanCount?: number;
+    firstDetected?: string;
+    lastSeen?: string;
+    history?: Array<{
+        action: string;
+        date: string;
+        scanId?: string;
+    }>;
+}
+export interface DependencyFindingDetail {
+    id: string;
+    sourceType: "dependency";
+    title: string;
+    severity: string;
+    status: string;
+    vulnerabilityId?: string;
+    packageName?: string;
+    packageType?: string;
+    installedVersion?: string;
+    fixedVersion?: string;
+    cvss?: number;
+    manifestPath?: string;
+    remediation?: string;
+}
+export type FindingDetail = CodeFindingDetail | DependencyFindingDetail;
+export interface TriageRequest {
+    findingId: string;
+    action: "resolve" | "dismiss" | "accept_risk";
+    status?: string;
+    dismissReason?: string;
+    reasoning: string;
+}
+export interface TriageResponse {
+    success: boolean;
+    findingId: string;
+    newStatus: string;
+    message: string;
+}
+export interface ScanListItem {
+    id: string;
+    targetUrl: string;
+    targetType: string;
+    status: string;
+    agentInstance?: {
+        name: string;
+        agentType: string;
+    };
+    startedAt?: string;
+    completedAt?: string;
+    findingsTotal: number;
+    findingsCritical: number;
+    findingsHigh: number;
+    findingsMedium: number;
+    findingsLow: number;
+    createdAt: string;
+}
+export interface ScanListResponse {
+    scans: ScanListItem[];
+    pagination: {
+        hasMore: boolean;
+        nextCursor: string | null;
+        limit: number;
+    };
+}
+export interface ScanDetailResponse {
+    scan: {
+        id: string;
+        status: string;
+        targetUrl: string;
+        targetType: string;
+        startedAt?: string;
+        completedAt?: string;
+        findingsTotal: number;
+        findingsCritical: number;
+        findingsHigh: number;
+        findingsMedium: number;
+        findingsLow: number;
+        output?: Record<string, unknown>;
+        reconMarkdown?: string;
+        attackSurfaceBrief?: string;
+        analysis?: string;
+        agentInstance?: {
+            name: string;
+            agentType: string;
+        };
+        [key: string]: unknown;
+    };
+}
+export interface ScanArtifact {
+    id: string;
+    scanId: string;
+    artifactType: string;
+    filename: string;
+    mimeType: string;
+    sizeBytes: number;
+    phase?: string;
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    capturedAt: string;
+    createdAt: string;
+}
+export interface TestCaseResultsResponse {
+    scanId: string;
+    stats: {
+        total: number;
+        passed: number;
+        failed: number;
+        skipped: number;
+        error: number;
+        pending: number;
+    };
+    categoryStats: Array<{
+        category: string;
+        total: number;
+        passed: number;
+        failed: number;
+    }>;
+    results: Array<Record<string, unknown>>;
+}
+export interface SessionInfo {
+    email: string;
+    createdAt: string;
+}
+export type SessionIndex = Record<string, SessionInfo>;
+export interface ProjectBinding {
+    /** Expected ZIVIS_SESSION value (e.g., "zivis", "acme-corp") */
+    session: string;
+    /** Zivis org UUID (API) */
+    orgId?: string;
+    /** WorkOS org id — OAuth login and JWT org_id use this boundary */
+    workosOrgId?: string;
+    /** Human-readable org name */
+    orgName?: string;
+    /** RT application UUID when this project is tied to a single app in the org */
+    applicationId?: string;
+    /** Display name for that application (optional) */
+    applicationName?: string;
+}
+export interface ZivisConfig {
+    apiBaseUrl: string;
+    oauthClientId: string;
+    oauthApiUrl: string;
+    callbackPort: number;
+    /** Named session for multi-tenant isolation (from ZIVIS_SESSION env var) */
+    session?: string;
+}
+interface EnvConfig {
+    apiBaseUrl: string;
+    oauthClientId: string;
+    oauthApiUrl: string;
+    keychainPrefix: string;
+    configDir: string;
+}
+export declare const BUILD_ENV: "staging" | "production";
+export declare const ENV_CONFIG: EnvConfig;
+export declare const DEFAULT_CONFIG: ZivisConfig;
+export {};

package/dist/types.js

@@ -0,0 +1,33 @@
+/**
+ * Shared types for the ZIVIS MCP Security Server
+ */
+const ENVIRONMENT_CONFIGS = {
+    staging: {
+        apiBaseUrl: "https://staging.zivis.ai",
+        oauthClientId: "client_01KGCMZ482H9SJPKTVRCC213K0",
+        oauthApiUrl: "https://delightful-abundance-65-staging.authkit.app",
+        keychainPrefix: "io.zivis.mcp.staging",
+        configDir: "zivis-staging",
+    },
+    production: {
+        apiBaseUrl: "https://app.zivis.ai",
+        oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
+        oauthApiUrl: "https://api.workos.com",
+        keychainPrefix: "io.zivis.mcp",
+        configDir: "zivis",
+    },
+};
+// Build-time environment (defaults to staging for development)
+export const BUILD_ENV = (process.env.ZIVIS_BUILD_ENV || "staging");
+// Get the config for the current build environment
+export const ENV_CONFIG = ENVIRONMENT_CONFIGS[BUILD_ENV] || ENVIRONMENT_CONFIGS.staging;
+export const DEFAULT_CONFIG = {
+    // Runtime env vars override build-time defaults (useful for testing)
+    apiBaseUrl: process.env.ZIVIS_API_URL || ENV_CONFIG.apiBaseUrl,
+    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || ENV_CONFIG.oauthClientId,
+    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || ENV_CONFIG.oauthApiUrl,
+    callbackPort: 8741,
+    // Session isolation for multi-tenant safety
+    session: process.env.ZIVIS_SESSION || undefined,
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoPH,MAAM,mBAAmB,GAA8B;IACrD,OAAO,EAAE;QACP,UAAU,EAAE,0BAA0B;QACtC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,qDAAqD;QAClE,cAAc,EAAE,sBAAsB;QACtC,SAAS,EAAE,eAAe;KAC3B;IACD,UAAU,EAAE;QACV,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,wBAAwB;QACrC,cAAc,EAAE,cAAc;QAC9B,SAAS,EAAE,OAAO;KACnB;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAElD,CAAC;AAEjB,mDAAmD;AACnD,MAAM,CAAC,MAAM,UAAU,GACrB,mBAAmB,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC,UAAU;IAC9D,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,UAAU,CAAC,aAAa;IAC5E,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,WAAW;IACtE,YAAY,EAAE,IAAI;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;CAChD,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@zivis/mcp",
+  "version": "0.1.0-alpha.1",
+  "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
+  "type": "module",
+  "bin": {
+    "zivis-mcp": "./dist/index.js"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./auth": "./dist/auth/index.js",
+    "./auth/jwt": "./dist/auth/jwt.js",
+    "./auth/token-refresh": "./dist/auth/token-refresh.js",
+    "./api-client": "./dist/api-client.js",
+    "./project-binding": "./dist/project-binding.js",
+    "./server": "./dist/server.js",
+    "./types": "./dist/types.js",
+    "./cli": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "package.json"
+  ],
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "open": "^10.1.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "husky": "^9.1.7",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/ensure-symlink.cjs",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "tsc --noEmit",
+    "build:installer": "bash scripts/build-installer.sh"
+  }
+}