@zivis/mcp 0.1.0-alpha.1

package/dist/tools/check-project.js

@@ -0,0 +1,180 @@
+/**
+ * zivis_check_project — Three-way org alignment check
+ *
+ * Answers: "am I safe to do tenant-scoped work in this project right now?"
+ *
+ * Verifies all three sources of truth agree on the org:
+ *   1. BINDING — .zivis/project.json's workosOrgId (what the project expects)
+ *   2. LOCAL JWT — the stored access token's org_id claim (what the token says)
+ *   3. API — GET /api/mcp/session (what the server resolves from the JWT)
+ *
+ * If any mismatch: returns isError=true with a concrete fix action.
+ * If no binding exists: isError=true (refuses to operate without cross-org safety).
+ */
+import { z } from "zod";
+import { detectProjectBinding } from "../project-binding.js";
+import { loadTokens } from "../auth/token-refresh.js";
+import { decodeJwtPayload } from "../auth/jwt.js";
+export const CHECK_PROJECT_NAME = "zivis_check_project";
+export const CHECK_PROJECT_DESCRIPTION = `Pre-flight: verify the project, the stored JWT, and the API ALL agree on the org.
+
+This is a defense-in-depth check that must pass before any tenant-scoped MCP
+operation (triage, create scan, manage threat model, etc.). It compares three
+independent sources of truth:
+
+  1. Project binding (.zivis/project.json workosOrgId)
+  2. Local JWT org_id claim
+  3. API's resolved org (round-trip to /api/mcp/session)
+
+Returns isError=true on ANY mismatch or missing binding. Call this at the
+start of any workflow where polluting another tenant with data would be bad.
+
+Set local_only=true to skip the API round-trip (faster, but weaker guarantee).`;
+export const CHECK_PROJECT_SCHEMA = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to check (defaults to server's working directory)"),
+    local_only: z
+        .boolean()
+        .optional()
+        .describe("Skip the API round-trip. Default false — the API check is the strongest guarantee."),
+};
+export function createCheckProjectHandler(apiClient, config) {
+    return async (params) => {
+        const cwd = params.cwd || process.cwd();
+        const currentSession = config.session || "default";
+        const skipApi = params.local_only === true;
+        const detected = detectProjectBinding(cwd);
+        if (!detected) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            ok: false,
+                            bound: false,
+                            currentSession,
+                            message: "No .zivis/project.json found for this directory. " +
+                                "Without a binding there is no cross-org safety — refusing to proceed. " +
+                                "Run: zivis auth login (auto-binds) or zivis auth init",
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
+            };
+        }
+        const { binding, filePath } = detected;
+        const sessionMatches = currentSession === binding.session;
+        // Source 2: local JWT
+        const tokens = await loadTokens(config.session);
+        const accessClaims = tokens ? decodeJwtPayload(tokens.access_token) : null;
+        const idClaims = tokens?.id_token ? decodeJwtPayload(tokens.id_token) : null;
+        const localJwtOrgId = accessClaims?.org_id;
+        const localEmail = idClaims?.email || accessClaims?.email;
+        // Source 3: API session (skip if local_only)
+        let apiSession = null;
+        let apiError = null;
+        if (!skipApi) {
+            if (!tokens) {
+                apiError = `No stored credentials for session "${currentSession}" — cannot contact API.`;
+            }
+            else {
+                try {
+                    apiSession = await apiClient.request("GET", "/api/mcp/session");
+                }
+                catch (err) {
+                    apiError = err instanceof Error ? err.message : String(err);
+                }
+            }
+        }
+        const problems = [];
+        // Session name
+        if (!sessionMatches) {
+            problems.push(`Session mismatch: project expects "${binding.session}", current is "${currentSession}". ` +
+                `Set ZIVIS_SESSION=${binding.session} in your MCP config or run: zivis mcp install --for <ide> --session ${binding.session}`);
+        }
+        // Binding vs local JWT
+        if (!binding.workosOrgId) {
+            problems.push("Binding has no workosOrgId — upgrade with: zivis auth login");
+        }
+        else if (!tokens) {
+            problems.push(`No stored credentials for session "${currentSession}". Run: zivis auth login --session ${binding.session}`);
+        }
+        else if (!localJwtOrgId) {
+            problems.push("Stored JWT has no org_id claim — re-login to refresh: zivis auth login --session " + binding.session);
+        }
+        else if (localJwtOrgId !== binding.workosOrgId) {
+            problems.push(`CROSS-ORG RISK: local JWT org_id "${localJwtOrgId}" != binding workosOrgId "${binding.workosOrgId}"` +
+                `${binding.orgName ? ` (${binding.orgName})` : ""}. ` +
+                `Fix: zivis auth login --session ${binding.session}`);
+        }
+        // API agreement
+        if (!skipApi) {
+            if (apiError) {
+                problems.push(`API session check failed: ${apiError}`);
+            }
+            else if (apiSession) {
+                if (binding.workosOrgId && apiSession.org.workosOrgId !== binding.workosOrgId) {
+                    problems.push(`CROSS-ORG RISK: API resolved org "${apiSession.org.workosOrgId}" (${apiSession.org.name}) ` +
+                        `!= binding workosOrgId "${binding.workosOrgId}"${binding.orgName ? ` (${binding.orgName})` : ""}. ` +
+                        `The API thinks you are in a different tenant than this project. ` +
+                        `Fix: zivis auth login --session ${binding.session}`);
+                }
+                if (binding.orgId && apiSession.org.id !== binding.orgId) {
+                    problems.push(`Zivis orgId mismatch: API returned "${apiSession.org.id}", binding expects "${binding.orgId}".`);
+                }
+                if (localJwtOrgId && apiSession.jwtOrgId && localJwtOrgId !== apiSession.jwtOrgId) {
+                    problems.push(`JWT org_id drift: local token has "${localJwtOrgId}", API saw "${apiSession.jwtOrgId}". ` +
+                        "Token may have been swapped mid-flight — re-login.");
+                }
+            }
+        }
+        const ok = problems.length === 0;
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        ok,
+                        bound: true,
+                        bindingFile: filePath,
+                        currentSession,
+                        expectedSession: binding.session,
+                        sessionMatches,
+                        binding: {
+                            workosOrgId: binding.workosOrgId || null,
+                            orgId: binding.orgId || null,
+                            orgName: binding.orgName || null,
+                            applicationId: binding.applicationId || null,
+                            applicationName: binding.applicationName || null,
+                        },
+                        localJwt: {
+                            orgId: localJwtOrgId || null,
+                            email: localEmail || null,
+                        },
+                        apiSession: skipApi
+                            ? { skipped: true }
+                            : apiSession
+                                ? {
+                                    userEmail: apiSession.user.email,
+                                    orgWorkosOrgId: apiSession.org.workosOrgId,
+                                    orgId: apiSession.org.id,
+                                    orgName: apiSession.org.name,
+                                    jwtOrgId: apiSession.jwtOrgId,
+                                }
+                                : { error: apiError },
+                        problems: problems.length ? problems : undefined,
+                        message: ok
+                            ? `\u2713 Org alignment OK (${binding.orgName || binding.workosOrgId || "tenant"})${binding.applicationId
+                                ? `. Default app context: ${binding.applicationName || binding.applicationId}`
+                                : ""}.`
+                            : `\u2717 Org alignment FAILED. Do NOT proceed with tenant-scoped operations. See "problems".`,
+                    }, null, 2),
+                },
+            ],
+            isError: !ok,
+        };
+    };
+}
+//# sourceMappingURL=check-project.js.map

package/dist/tools/check-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-project.js","sourceRoot":"","sources":["../../src/tools/check-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIlD,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;+EAasC,CAAC;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,oFAAoF,CAAC;CAClG,CAAC;AAQF,MAAM,UAAU,yBAAyB,CAAC,SAAoB,EAAE,MAAmB;IACjF,OAAO,KAAK,EAAE,MAA8C,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAE3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;4BACE,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,KAAK;4BACZ,cAAc;4BACd,OAAO,EACL,mDAAmD;gCACnD,wEAAwE;gCACxE,uDAAuD;yBAC1D,EACD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QACvC,MAAM,cAAc,GAAG,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC;QAE1D,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,MAAM,aAAa,GAAG,YAAY,EAAE,MAAM,CAAC;QAC3C,MAAM,UAAU,GAAG,QAAQ,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC;QAE1D,6CAA6C;QAC7C,IAAI,UAAU,GAA2B,IAAI,CAAC;QAC9C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,GAAG,sCAAsC,cAAc,yBAAyB,CAAC;YAC3F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAkB,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBACnF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,eAAe;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,sCAAsC,OAAO,CAAC,OAAO,kBAAkB,cAAc,KAAK;gBAC1F,qBAAqB,OAAO,CAAC,OAAO,uEAAuE,OAAO,CAAC,OAAO,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,6DAA6D,CAC9D,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CACX,sCAAsC,cAAc,sCAAsC,OAAO,CAAC,OAAO,EAAE,CAC5G,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,mFAAmF,GAAG,OAAO,CAAC,OAAO,CACtG,CAAC;QACJ,CAAC;aAAM,IAAI,aAAa,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,qCAAqC,aAAa,6BAA6B,OAAO,CAAC,WAAW,GAAG;gBACrG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;gBACrD,mCAAmC,OAAO,CAAC,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,gBAAgB;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,IAAI,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;oBAC9E,QAAQ,CAAC,IAAI,CACX,qCAAqC,UAAU,CAAC,GAAG,CAAC,WAAW,MAAM,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI;wBAC5F,2BAA2B,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;wBACpG,kEAAkE;wBAClE,mCAAmC,OAAO,CAAC,OAAO,EAAE,CACrD,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACzD,QAAQ,CAAC,IAAI,CACX,uCAAuC,UAAU,CAAC,GAAG,CAAC,EAAE,uBAAuB,OAAO,CAAC,KAAK,IAAI,CACjG,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,IAAI,UAAU,CAAC,QAAQ,IAAI,aAAa,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAClF,QAAQ,CAAC,IAAI,CACX,sCAAsC,aAAa,eAAe,UAAU,CAAC,QAAQ,KAAK;wBAC1F,oDAAoD,CACrD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAEjC,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;wBACE,EAAE;wBACF,KAAK,EAAE,IAAI;wBACX,WAAW,EAAE,QAAQ;wBACrB,cAAc;wBACd,eAAe,EAAE,OAAO,CAAC,OAAO;wBAChC,cAAc;wBACd,OAAO,EAAE;4BACP,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;4BACxC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;4BAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;4BAChC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;4BAC5C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;yBACjD;wBACD,QAAQ,EAAE;4BACR,KAAK,EAAE,aAAa,IAAI,IAAI;4BAC5B,KAAK,EAAE,UAAU,IAAI,IAAI;yBAC1B;wBACD,UAAU,EAAE,OAAO;4BACjB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;4BACnB,CAAC,CAAC,UAAU;gCACZ,CAAC,CAAC;oCACE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK;oCAChC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW;oCAC1C,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE;oCACxB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI;oCAC5B,QAAQ,EAAE,UAAU,CAAC,QAAQ;iCAC9B;gCACH,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;wBAChD,OAAO,EAAE,EAAE;4BACT,CAAC,CAAC,4BAA4B,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,QAAQ,IAC5E,OAAO,CAAC,aAAa;gCACnB,CAAC,CAAC,0BAA0B,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE;gCAC9E,CAAC,CAAC,EACN,GAAG;4BACL,CAAC,CAAC,4FAA4F;qBACjG,EACD,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,CAAC,EAAE;SACb,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/check-repo-trust.d.ts

@@ -0,0 +1,33 @@
+/**
+ * zivis_check_repo_trust — Check the OSS trust score for a GitHub repository
+ *
+ * Maps to: GET /api/oss-trust/repos/:owner/:repo (public, no auth required)
+ *          POST /api/oss-trust/scan (to trigger a new scan)
+ *          GET /api/oss-trust/repos/:owner/:repo/findings (findings list)
+ *
+ * This tool works without authentication — all OSS Trust endpoints are public.
+ */
+import { z } from "zod";
+import type { ZivisConfig } from "../types.js";
+export declare const CHECK_REPO_TRUST_NAME = "zivis_check_repo_trust";
+export declare const CHECK_REPO_TRUST_DESCRIPTION = "Check the AI/LLM security trust score for a GitHub repository using the ZIVIS OSS Trust Registry.\n\nUse this tool BEFORE pulling code from, merging PRs from, or depending on an open source repository. It scans for:\n- Prompt injection vulnerabilities (instruction overrides, jailbreaks)\n- Unsafe AI/LLM patterns (unvalidated tool calls, model output injection)\n- Agentic security issues (privilege escalation, lack of human-in-the-loop)\n- Hardcoded secrets and API keys\n- Suspicious code patterns\n\nAccepts a GitHub URL (https://github.com/owner/repo) or owner/repo string.\n\nReturns the trust grade (A+ through F), score (0-100), and detailed findings.\nIf the repo hasn't been scanned yet, it will trigger a scan automatically.\n\nNo authentication required \u2014 works with any public GitHub repository.\n\nFor the cryptographically signed attestation token (ZAT) suitable for machine verification, supply chain trust gates, and ATNP agent-to-agent trust negotiation, use zivis_get_oss_zat instead.";
+export declare const CHECK_REPO_TRUST_SCHEMA: {
+    repo: z.ZodString;
+    trigger_scan: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+};
+export declare function createCheckRepoTrustHandler(config: ZivisConfig): (params: {
+    repo: string;
+    trigger_scan?: boolean;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/check-repo-trust.js

@@ -0,0 +1,212 @@
+/**
+ * zivis_check_repo_trust — Check the OSS trust score for a GitHub repository
+ *
+ * Maps to: GET /api/oss-trust/repos/:owner/:repo (public, no auth required)
+ *          POST /api/oss-trust/scan (to trigger a new scan)
+ *          GET /api/oss-trust/repos/:owner/:repo/findings (findings list)
+ *
+ * This tool works without authentication — all OSS Trust endpoints are public.
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../sanitize.js";
+export const CHECK_REPO_TRUST_NAME = "zivis_check_repo_trust";
+export const CHECK_REPO_TRUST_DESCRIPTION = `Check the AI/LLM security trust score for a GitHub repository using the ZIVIS OSS Trust Registry.
+
+Use this tool BEFORE pulling code from, merging PRs from, or depending on an open source repository. It scans for:
+- Prompt injection vulnerabilities (instruction overrides, jailbreaks)
+- Unsafe AI/LLM patterns (unvalidated tool calls, model output injection)
+- Agentic security issues (privilege escalation, lack of human-in-the-loop)
+- Hardcoded secrets and API keys
+- Suspicious code patterns
+
+Accepts a GitHub URL (https://github.com/owner/repo) or owner/repo string.
+
+Returns the trust grade (A+ through F), score (0-100), and detailed findings.
+If the repo hasn't been scanned yet, it will trigger a scan automatically.
+
+No authentication required — works with any public GitHub repository.
+
+For the cryptographically signed attestation token (ZAT) suitable for machine verification, supply chain trust gates, and ATNP agent-to-agent trust negotiation, use zivis_get_oss_zat instead.`;
+export const CHECK_REPO_TRUST_SCHEMA = {
+    repo: z
+        .string()
+        .describe("GitHub repo URL (https://github.com/owner/repo) or owner/repo string"),
+    trigger_scan: z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe("If true (default), trigger a scan when no results exist yet"),
+};
+/** Parse GitHub URL or owner/repo into components */
+function parseRepo(input) {
+    const trimmed = input.trim();
+    // URL: https://github.com/owner/repo[.git][/...]
+    const urlMatch = trimmed.match(/^https?:\/\/(?:www\.)?github\.com\/([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)/);
+    if (urlMatch) {
+        return { owner: urlMatch[1], repo: urlMatch[2].replace(/\.git$/, "") };
+    }
+    // owner/repo
+    const slashMatch = trimmed.match(/^([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)$/);
+    if (slashMatch) {
+        return { owner: slashMatch[1], repo: slashMatch[2] };
+    }
+    return null;
+}
+export function createCheckRepoTrustHandler(config) {
+    return async (params) => {
+        try {
+            const parsed = parseRepo(params.repo);
+            if (!parsed) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error: Invalid repo format "${params.repo}". Use "owner/repo" or a GitHub URL.`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            const { owner, repo } = parsed;
+            const baseUrl = config.apiBaseUrl;
+            // Step 1: Check if repo has existing trust data
+            const repoRes = await fetch(`${baseUrl}/api/oss-trust/repos/${owner}/${repo}`);
+            if (repoRes.status === 404 || (repoRes.ok && (await repoRes.clone().json()).trustScore == null)) {
+                // No scan results yet
+                if (params.trigger_scan !== false) {
+                    // Trigger a scan
+                    const scanRes = await fetch(`${baseUrl}/api/oss-trust/scan`, {
+                        method: "POST",
+                        headers: { "Content-Type": "application/json" },
+                        body: JSON.stringify({ owner, repo }),
+                    });
+                    if (scanRes.ok) {
+                        const scanData = await scanRes.json();
+                        if (scanData.deduplicated && scanData.status === "completed") {
+                            // There's a completed scan but the entry wasn't found? Rare edge case.
+                            // Re-fetch the entry
+                        }
+                        else {
+                            return {
+                                content: [
+                                    {
+                                        type: "text",
+                                        text: formatScanPending(owner, repo, scanData, baseUrl),
+                                    },
+                                ],
+                            };
+                        }
+                    }
+                    else {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: `No trust data found for ${owner}/${repo} and failed to trigger scan.`,
+                                },
+                            ],
+                            isError: true,
+                        };
+                    }
+                }
+                else {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `No trust data found for ${owner}/${repo}. Set trigger_scan=true to request a scan.`,
+                            },
+                        ],
+                    };
+                }
+            }
+            // Step 2: Fetch trust entry data
+            const entryRes = await fetch(`${baseUrl}/api/oss-trust/repos/${owner}/${repo}`);
+            if (!entryRes.ok) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error fetching trust data: HTTP ${entryRes.status}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            const entry = await entryRes.json();
+            // Step 3: Fetch findings if scan is complete
+            let findings = [];
+            if (entry.trustScore != null) {
+                const findingsRes = await fetch(`${baseUrl}/api/oss-trust/repos/${owner}/${repo}/findings?limit=25`);
+                if (findingsRes.ok) {
+                    const findingsData = await findingsRes.json();
+                    findings = findingsData.findings || [];
+                }
+            }
+            const result = sanitizeResponse({
+                repository: `${owner}/${repo}`,
+                trustGrade: entry.trustGrade,
+                trustScore: entry.trustScore,
+                lastScannedAt: entry.lastScannedAt,
+                lastCommitSha: entry.lastCommitSha,
+                findings: {
+                    critical: entry.findingsCritical ?? 0,
+                    high: entry.findingsHigh ?? 0,
+                    medium: entry.findingsMedium ?? 0,
+                    low: entry.findingsLow ?? 0,
+                    total: (entry.findingsCritical ?? 0) +
+                        (entry.findingsHigh ?? 0) +
+                        (entry.findingsMedium ?? 0) +
+                        (entry.findingsLow ?? 0),
+                },
+                verdict: getVerdict(entry.trustScore, entry.trustGrade),
+                details: findings,
+                viewUrl: `${baseUrl}/oss-trust/${owner}/${repo}`,
+            });
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(result, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to check repo trust";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+function getVerdict(score, grade) {
+    if (score == null || grade == null)
+        return "No scan data available";
+    if (score >= 90)
+        return "SAFE — No significant AI/LLM security issues detected";
+    if (score >= 75)
+        return "LOW RISK — Minor issues found, generally safe to use";
+    if (score >= 60)
+        return "MODERATE RISK — Review findings before depending on this code";
+    if (score >= 40)
+        return "HIGH RISK — Significant security issues found, proceed with caution";
+    return "CRITICAL RISK — Major security vulnerabilities detected, avoid using without remediation";
+}
+function formatScanPending(owner, repo, scanData, baseUrl) {
+    const lines = [
+        `## Scan Requested: ${owner}/${repo}`,
+        "",
+        `A security scan has been queued for this repository.`,
+        `- **Scan ID:** ${scanData.scanId}`,
+        `- **Status:** ${scanData.status}`,
+        "",
+        `The scan typically takes 1-3 minutes. You can check results at:`,
+        `${baseUrl}/oss-trust/${owner}/${repo}`,
+        "",
+        `Run this tool again in a few minutes to see the results.`,
+    ];
+    return lines.join("\n");
+}
+//# sourceMappingURL=check-repo-trust.js.map

package/dist/tools/check-repo-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-repo-trust.js","sourceRoot":"","sources":["../../src/tools/check-repo-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;gMAgBoJ,CAAC;AAEjM,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CACP,sEAAsE,CACvE;IACH,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,6DAA6D,CAC9D;CACJ,CAAC;AAEF,qDAAqD;AACrD,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,aAAa;IACb,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAmB;IAC7D,OAAO,KAAK,EAAE,MAAgD,EAAE,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,+BAA+B,MAAM,CAAC,IAAI,sCAAsC;yBACvF;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,GAAG,OAAO,wBAAwB,KAAK,IAAI,IAAI,EAAE,CAClD,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC;gBAChG,sBAAsB;gBACtB,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;oBAClC,iBAAiB;oBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,qBAAqB,EAAE;wBAC3D,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;qBACtC,CAAC,CAAC;oBAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;wBACf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;wBACtC,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;4BAC7D,uEAAuE;4BACvE,qBAAqB;wBACvB,CAAC;6BAAM,CAAC;4BACN,OAAO;gCACL,OAAO,EAAE;oCACP;wCACE,IAAI,EAAE,MAAe;wCACrB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;qCACxD;iCACF;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO;4BACL,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,2BAA2B,KAAK,IAAI,IAAI,8BAA8B;iCAC7E;6BACF;4BACD,OAAO,EAAE,IAAI;yBACd,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,2BAA2B,KAAK,IAAI,IAAI,4CAA4C;6BAC3F;yBACF;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,wBAAwB,KAAK,IAAI,IAAI,EAAE,CAClD,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE;yBAC3D;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEpC,6CAA6C;YAC7C,IAAI,QAAQ,GAAc,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,MAAM,KAAK,CAC7B,GAAG,OAAO,wBAAwB,KAAK,IAAI,IAAI,oBAAoB,CACpE,CAAC;gBACF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;oBACnB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;oBAC9C,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACzC,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,QAAQ,EAAE;oBACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;oBACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;oBACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;oBAC3B,KAAK,EACH,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;wBAC7B,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;wBACzB,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;wBAC3B,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;iBAC3B;gBACD,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;gBACvD,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,GAAG,OAAO,cAAc,KAAK,IAAI,IAAI,EAAE;aACjD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBACtC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,KAAoB,EACpB,KAAoB;IAEpB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,wBAAwB,CAAC;IACpE,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,uDAAuD,CAAC;IAChF,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,sDAAsD,CAAC;IAC/E,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,+DAA+D,CAAC;IACxF,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,qEAAqE,CAAC;IAC9F,OAAO,0FAA0F,CAAC;AACpG,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,IAAY,EACZ,QAAiC,EACjC,OAAe;IAEf,MAAM,KAAK,GAAG;QACZ,sBAAsB,KAAK,IAAI,IAAI,EAAE;QACrC,EAAE;QACF,sDAAsD;QACtD,kBAAkB,QAAQ,CAAC,MAAM,EAAE;QACnC,iBAAiB,QAAQ,CAAC,MAAM,EAAE;QAClC,EAAE;QACF,iEAAiE;QACjE,GAAG,OAAO,cAAc,KAAK,IAAI,IAAI,EAAE;QACvC,EAAE;QACF,0DAA0D;KAC3D,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/create-diagram.d.ts

@@ -0,0 +1,114 @@
+/**
+ * zivis_create_diagram — Create a new diagram with nodes, connections, and boundaries
+ *
+ * Maps to: POST /api/diagrams + optional POST /api/diagrams/:id/link
+ */
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
+export declare const CREATE_DIAGRAM_DESCRIPTION = "Create a new canvas diagram with nodes, connections, and boundaries in a single call.\n\nUse this to build system architecture diagrams, data flow diagrams, attack chains, etc. from code analysis.\n\n**Temp IDs:** When creating nodes and connections together, assign each node a temp_id (e.g., \"node_0\", \"node_1\") and reference them in connections via source_temp_id / target_temp_id. Similarly, assign boundaries a temp_id and reference them in nodes via boundary_temp_id.\n\n**Positioning:** Nodes default to (0,0). For readable layouts, space nodes apart (e.g., 250px horizontal, 150px vertical gaps). Default node size is 200x100px. Boundaries should be sized to contain their child nodes with padding.\n\n**Tags:** Use tags to annotate nodes with metadata (e.g., [\"database\", \"postgres\", \"port:5432\", \"pii\"]). These are searchable and displayed in the UI.\n\n**Colors:** Use hex colors (e.g., \"#336791\" for databases, \"#DC382D\" for caches, \"#009639\" for proxies).";
+export declare const CREATE_DIAGRAM_SCHEMA: {
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    diagram_type: z.ZodEnum<{
+        custom: "custom";
+        deployment: "deployment";
+        architecture: "architecture";
+        data_flow: "data_flow";
+        attack_chain: "attack_chain";
+        sequence: "sequence";
+        trust_boundary: "trust_boundary";
+        network: "network";
+    }>;
+    nodes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        temp_id: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        icon: z.ZodOptional<z.ZodString>;
+        color: z.ZodOptional<z.ZodString>;
+        position_x: z.ZodOptional<z.ZodNumber>;
+        position_y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        step_order: z.ZodOptional<z.ZodNumber>;
+        boundary_temp_id: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    connections: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_temp_id: z.ZodOptional<z.ZodString>;
+        target_temp_id: z.ZodOptional<z.ZodString>;
+        source_node_id: z.ZodOptional<z.ZodString>;
+        target_node_id: z.ZodOptional<z.ZodString>;
+        label: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bidirectional: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    boundaries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        temp_id: z.ZodOptional<z.ZodString>;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        color: z.ZodOptional<z.ZodString>;
+        position_x: z.ZodOptional<z.ZodNumber>;
+        position_y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    linked_threat_model_id: z.ZodOptional<z.ZodString>;
+};
+export declare function createCreateDiagramHandler(apiClient: ApiClient): (params: {
+    name: string;
+    description?: string;
+    diagram_type: string;
+    nodes?: Array<{
+        temp_id?: string;
+        name: string;
+        description?: string;
+        tags?: string[];
+        icon?: string;
+        color?: string;
+        position_x?: number;
+        position_y?: number;
+        width?: number;
+        height?: number;
+        step_order?: number;
+        boundary_temp_id?: string;
+        metadata?: Record<string, unknown>;
+    }>;
+    connections?: Array<{
+        source_temp_id?: string;
+        target_temp_id?: string;
+        source_node_id?: string;
+        target_node_id?: string;
+        label?: string;
+        description?: string;
+        tags?: string[];
+        bidirectional?: boolean;
+        metadata?: Record<string, unknown>;
+    }>;
+    boundaries?: Array<{
+        temp_id?: string;
+        label: string;
+        description?: string;
+        color?: string;
+        position_x?: number;
+        position_y?: number;
+        width?: number;
+        height?: number;
+    }>;
+    linked_threat_model_id?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;