@zivis/mcp 0.1.0-alpha.18 → 0.1.0-alpha.2

package/dist/tools/triage-finding.d.ts

@@ -11,7 +11,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const TRIAGE_FINDING_NAME = "zivis_triage_finding";
-export declare const TRIAGE_FINDING_DESCRIPTION = "Mark a security issue as fixed, dismissed, or accepted. Use this after the user reviews a finding and decides what to do with it.\n\nThree outcomes:\n- \"resolve\" \u2014 the bug is fixed. ZIVIS logs the fix and generates remediation documentation.\n- \"dismiss\" \u2014 the finding is wrong (false positive) or doesn't apply to this project.\n- \"accept_risk\" \u2014 the team knows about the issue and has decided to live with it.\n\nA reasoning field is REQUIRED \u2014 this creates an audit trail. Explain briefly why the action is appropriate (e.g. \"Fixed by adding input validation in auth.ts\" or \"Not applicable \u2014 we don't accept user HTML input\").\n\nAfter resolving a finding, ZIVIS will provide markdown to append to .zivis/remediations.md as an audit trail.\n\nTriage one finding at a time. Use finding_id from zivis_get_findings or zivis_get_finding_details.";
+export declare const TRIAGE_FINDING_DESCRIPTION = "Submit a triage decision for a security finding back to ZIVIS.\n\nUse this after investigating a finding to record the outcome:\n- \"resolve\" \u2014 the vulnerability has been fixed\n- \"dismiss\" \u2014 the finding is a false positive or not applicable\n- \"accept_risk\" \u2014 the risk is known and accepted\n\nA reasoning field is REQUIRED. Explain why this action is appropriate \u2014 this creates an audit trail and helps ZIVIS learn from your decisions.\n\nThis action is logged with your identity and timestamp. Bulk operations are not supported \u2014 triage one finding at a time.\n\nIMPORTANT: After resolving a finding (action=\"resolve\"), you MUST document the fix:\n1. Create .zivis/ directory if it doesn't exist\n2. Append to .zivis/remediations.md using the markdown template in the response\n3. This creates a security audit trail that stays with the project\n\nThe response includes a \"documentation\" field with pre-formatted markdown to append.";
 export declare const TRIAGE_FINDING_SCHEMA: {
     finding_id: z.ZodString;
     action: z.ZodEnum<{
@@ -33,9 +33,15 @@ export declare function createTriageFindingHandler(apiClient: ApiClient): (param
     reasoning: string;
     dismiss_reason?: string;
 }) => Promise<{
-    content: Array<{
+    content: {
         type: "text";
         text: string;
-    }>;
-    isError?: boolean;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
 }>;

package/dist/tools/triage-finding.js

@@ -9,20 +9,24 @@
  * in the dashboard.
  */
 import { z } from "zod";
-import { withNextSteps } from "../lib/next-steps.js";
 export const TRIAGE_FINDING_NAME = "zivis_triage_finding";
-export const TRIAGE_FINDING_DESCRIPTION = `Mark a security issue as fixed, dismissed, or accepted. Use this after the user reviews a finding and decides what to do with it.
+export const TRIAGE_FINDING_DESCRIPTION = `Submit a triage decision for a security finding back to ZIVIS.
 
-Three outcomes:
-- "resolve" — the bug is fixed. ZIVIS logs the fix and generates remediation documentation.
-- "dismiss" — the finding is wrong (false positive) or doesn't apply to this project.
-- "accept_risk" — the team knows about the issue and has decided to live with it.
+Use this after investigating a finding to record the outcome:
+- "resolve" — the vulnerability has been fixed
+- "dismiss" — the finding is a false positive or not applicable
+- "accept_risk" — the risk is known and accepted
 
-A reasoning field is REQUIRED — this creates an audit trail. Explain briefly why the action is appropriate (e.g. "Fixed by adding input validation in auth.ts" or "Not applicable — we don't accept user HTML input").
+A reasoning field is REQUIRED. Explain why this action is appropriate — this creates an audit trail and helps ZIVIS learn from your decisions.
 
-After resolving a finding, ZIVIS will provide markdown to append to .zivis/remediations.md as an audit trail.
+This action is logged with your identity and timestamp. Bulk operations are not supported — triage one finding at a time.
 
-Triage one finding at a time. Use finding_id from zivis_get_findings or zivis_get_finding_details.`;
+IMPORTANT: After resolving a finding (action="resolve"), you MUST document the fix:
+1. Create .zivis/ directory if it doesn't exist
+2. Append to .zivis/remediations.md using the markdown template in the response
+3. This creates a security audit trail that stays with the project
+
+The response includes a "documentation" field with pre-formatted markdown to append.`;
 export const TRIAGE_FINDING_SCHEMA = {
     finding_id: z.string().describe("The finding ID to triage"),
     action: z
@@ -91,27 +95,14 @@ export function createTriageFindingHandler(apiClient) {
                     instructions: "Append the markdownToAppend to .zivis/remediations.md (create directory and file if needed). Add finding title, severity, vulnerable code description, and files changed above the reasoning.",
                 }
                 : { shouldDocument: false };
-            return withNextSteps({ ...response, documentation }, [
-                {
-                    id: "view_remaining_findings",
-                    label: "Review the remaining open findings",
-                    tool: "zivis_get_findings",
-                    args_hint: { status: "open" },
-                    why: "See what's left to triage — keep working through the queue to clear the backlog.",
-                    requires_tier: "free",
-                },
-                ...(params.action === "resolve"
-                    ? [
-                        {
-                            id: "run_new_scan",
-                            label: "Run a new scan to verify the fix held",
-                            tool: "zivis_list_test_scenarios",
-                            why: "Confirm the vulnerability is gone by re-testing after your code change.",
-                            requires_tier: "free",
-                        },
-                    ]
-                    : []),
-            ], `Finding ${params.finding_id} marked as ${statusMap[params.action]}.`);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({ ...response, documentation }, null, 2),
+                    },
+                ],
+            };
         }
         catch (err) {
             const message = err instanceof Error ? err.message : "Failed to triage finding";

package/dist/tools/triage-finding.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage-finding.js","sourceRoot":"","sources":["../../src/tools/triage-finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;mGAWyD,CAAC;AAEpG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC3D,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;SAC3C,QAAQ,CAAC,iEAAiE,CAAC;IAC9E,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CACP,iHAAiH,CAClH;IACH,cAAc,EAAE,CAAC;SACd,IAAI,CAAC,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACnE,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;CACxE,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,KAAK,EAAE,MAKb,EAAE,EAAE;QACH,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4DAA4D;qBACnE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,SAAS,GAA2B;gBACxC,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,UAAU;aACxB,CAAC;YAEF,kDAAkD;YAClD,oFAAoF;YACpF,MAAM,SAAS,GAA4B;gBACzC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBAChC,IAAI,EAAE,mBAAmB,MAAM,CAAC,SAAS,EAAE;aAC5C,CAAC;YACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;YAClD,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CACnB,yBAAyB,MAAM,CAAC,UAAU,EAAE,EAC5C,SAAS,CACV,CAAC;YAEF,MAAM,QAAQ,GAAmB;gBAC/B,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,OAAO,EAAE,WAAW,MAAM,CAAC,UAAU,cAAc,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC;aAC/G,CAAC;YAEF,wDAAwD;YACxD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,aAAa,GACjB,MAAM,CAAC,MAAM,KAAK,SAAS;gBACzB,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI;oBACpB,QAAQ,EAAE,wBAAwB;oBAClC,gBAAgB,EAAE;KAC3B,KAAK,MAAM,MAAM,CAAC,UAAU;;;iBAGhB,MAAM,CAAC,SAAS;;;CAGhC;oBACa,YAAY,EACV,+LAA+L;iBAClM;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEhC,OAAO,aAAa,CAClB,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,EAC9B;gBACE;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,oCAAoC;oBAC3C,IAAI,EAAE,oBAAoB;oBAC1B,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC7B,GAAG,EAAE,kFAAkF;oBACvF,aAAa,EAAE,MAAe;iBAC/B;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;oBAC7B,CAAC,CAAC;wBACE;4BACE,EAAE,EAAE,cAAc;4BAClB,KAAK,EAAE,uCAAuC;4BAC9C,IAAI,EAAE,2BAA2B;4BACjC,GAAG,EAAE,yEAAyE;4BAC9E,aAAa,EAAE,MAAe;yBAC/B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,EACD,WAAW,MAAM,CAAC,UAAU,cAAc,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CACtE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"triage-finding.js","sourceRoot":"","sources":["../../src/tools/triage-finding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;qFAgB2C,CAAC;AAEtF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC3D,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;SAC3C,QAAQ,CAAC,iEAAiE,CAAC;IAC9E,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CACP,iHAAiH,CAClH;IACH,cAAc,EAAE,CAAC;SACd,IAAI,CAAC,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACnE,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;CACxE,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,KAAK,EAAE,MAKb,EAAE,EAAE;QACH,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4DAA4D;qBACnE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,SAAS,GAA2B;gBACxC,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,UAAU;aACxB,CAAC;YAEF,kDAAkD;YAClD,oFAAoF;YACpF,MAAM,SAAS,GAA4B;gBACzC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBAChC,IAAI,EAAE,mBAAmB,MAAM,CAAC,SAAS,EAAE;aAC5C,CAAC;YACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;YAClD,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CACnB,yBAAyB,MAAM,CAAC,UAAU,EAAE,EAC5C,SAAS,CACV,CAAC;YAEF,MAAM,QAAQ,GAAmB;gBAC/B,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,OAAO,EAAE,WAAW,MAAM,CAAC,UAAU,cAAc,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC;aAC/G,CAAC;YAEF,wDAAwD;YACxD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,aAAa,GACjB,MAAM,CAAC,MAAM,KAAK,SAAS;gBACzB,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI;oBACpB,QAAQ,EAAE,wBAAwB;oBAClC,gBAAgB,EAAE;KAC3B,KAAK,MAAM,MAAM,CAAC,UAAU;;;iBAGhB,MAAM,CAAC,SAAS;;;CAGhC;oBACa,YAAY,EACV,+LAA+L;iBAClM;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEhC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC9D;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -3,7 +3,7 @@
  */
 export interface OAuthTokens {
     access_token: string;
-    refresh_token?: string;
+    refresh_token: string;
     expires_at: number;
     id_token?: string;
 }
@@ -198,25 +198,6 @@ export interface ProjectBinding {
     applicationId?: string;
     /** Display name for that application (optional) */
     applicationName?: string;
-    /**
-     * Environment overrides — stored here so `zivis` CLI commands run from
-     * this directory automatically hit the right environment without requiring
-     * env vars to be set in the shell. Takes precedence over env vars.
-     */
-    /** ZIVIS API base URL (e.g. "https://staging.zivis.ai") */
-    apiBaseUrl?: string;
-    /** OAuth / AuthKit API URL */
-    oauthApiUrl?: string;
-    /** OAuth client ID */
-    oauthClientId?: string;
-    /** Keychain/credential storage prefix */
-    keychainPrefix?: string;
-    /** Config directory name under ~/.config/ */
-    configDir?: string;
-}
-export interface CredentialStorage {
-    keychainPrefix: string;
-    configDir: string;
 }
 export interface ZivisConfig {
     apiBaseUrl: string;
@@ -225,23 +206,6 @@ export interface ZivisConfig {
     callbackPort: number;
     /** Named session for multi-tenant isolation (from ZIVIS_SESSION env var) */
     session?: string;
-    /**
-     * Override OS keychain / encrypted-file credential namespace (default: ENV_CONFIG).
-     * MUST match MCP's ZIVIS_KEYCHAIN_PREFIX or CLI auth and MCP will read different buckets.
-     */
-    keychainPrefix?: string;
-    /**
-     * Override ~/.config subdirectory for sessions.json etc. (default: ENV_CONFIG).
-     * MUST match MCP's ZIVIS_CONFIG_DIR.
-     */
-    configDir?: string;
-    /**
-     * Absolute path to the workspace root passed via `zivis mcp serve --workspace`.
-     * When set, project binding is detected from this path instead of process.cwd().
-     * This is the primary tenant-isolation mechanism: each IDE workspace gets its own
-     * MCP process with a fixed, immutable workspace path → no runtime session switching.
-     */
-    workspacePath?: string;
 }
 interface EnvConfig {
     apiBaseUrl: string;
@@ -250,11 +214,7 @@ interface EnvConfig {
     keychainPrefix: string;
     configDir: string;
 }
+export declare const BUILD_ENV: "staging" | "production";
 export declare const ENV_CONFIG: EnvConfig;
 export declare const DEFAULT_CONFIG: ZivisConfig;
-/**
- * Resolved credential storage bucket for keychain + ~/.config/<dir>.
- * Prefer explicit ZivisConfig fields, then ENV (set by MCP IDE config).
- */
-export declare function credentialStorageFromConfig(config?: ZivisConfig): CredentialStorage;
 export {};

package/dist/types.js

@@ -1,39 +1,33 @@
 /**
  * Shared types for the ZIVIS MCP Security Server
  */
-const PRODUCTION_DEFAULTS = {
-    apiBaseUrl: "https://app.zivis.ai",
-    oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
-    oauthApiUrl: "https://api.workos.com",
-    keychainPrefix: "io.zivis.mcp",
-    configDir: "zivis",
-};
-// Runtime env vars override production defaults.
-// This enables internal staging/dev usage without shipping non-production URLs
-// in package defaults.
-export const ENV_CONFIG = {
-    apiBaseUrl: process.env.ZIVIS_API_URL || PRODUCTION_DEFAULTS.apiBaseUrl,
-    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || PRODUCTION_DEFAULTS.oauthClientId,
-    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || PRODUCTION_DEFAULTS.oauthApiUrl,
-    keychainPrefix: process.env.ZIVIS_KEYCHAIN_PREFIX || PRODUCTION_DEFAULTS.keychainPrefix,
-    configDir: process.env.ZIVIS_CONFIG_DIR || PRODUCTION_DEFAULTS.configDir,
+const ENVIRONMENT_CONFIGS = {
+    staging: {
+        apiBaseUrl: "https://staging.zivis.ai",
+        oauthClientId: "client_01KGCMZ482H9SJPKTVRCC213K0",
+        oauthApiUrl: "https://delightful-abundance-65-staging.authkit.app",
+        keychainPrefix: "io.zivis.mcp.staging",
+        configDir: "zivis-staging",
+    },
+    production: {
+        apiBaseUrl: "https://app.zivis.ai",
+        oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
+        oauthApiUrl: "https://api.workos.com",
+        keychainPrefix: "io.zivis.mcp",
+        configDir: "zivis",
+    },
 };
+// Build-time environment (defaults to staging for development)
+export const BUILD_ENV = (process.env.ZIVIS_BUILD_ENV || "staging");
+// Get the config for the current build environment
+export const ENV_CONFIG = ENVIRONMENT_CONFIGS[BUILD_ENV] || ENVIRONMENT_CONFIGS.staging;
 export const DEFAULT_CONFIG = {
-    apiBaseUrl: ENV_CONFIG.apiBaseUrl,
-    oauthClientId: ENV_CONFIG.oauthClientId,
-    oauthApiUrl: ENV_CONFIG.oauthApiUrl,
+    // Runtime env vars override build-time defaults (useful for testing)
+    apiBaseUrl: process.env.ZIVIS_API_URL || ENV_CONFIG.apiBaseUrl,
+    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || ENV_CONFIG.oauthClientId,
+    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || ENV_CONFIG.oauthApiUrl,
     callbackPort: 8741,
     // Session isolation for multi-tenant safety
     session: process.env.ZIVIS_SESSION || undefined,
 };
-/**
- * Resolved credential storage bucket for keychain + ~/.config/<dir>.
- * Prefer explicit ZivisConfig fields, then ENV (set by MCP IDE config).
- */
-export function credentialStorageFromConfig(config) {
-    return {
-        keychainPrefix: config?.keychainPrefix ?? ENV_CONFIG.keychainPrefix,
-        configDir: config?.configDir ?? ENV_CONFIG.configDir,
-    };
-}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AA2RH,MAAM,mBAAmB,GAAc;IACrC,UAAU,EAAE,sBAAsB;IAClC,aAAa,EAAE,mCAAmC;IAClD,WAAW,EAAE,wBAAwB;IACrC,cAAc,EAAE,cAAc;IAC9B,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,iDAAiD;AACjD,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,CAAC,MAAM,UAAU,GAAc;IACnC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,mBAAmB,CAAC,UAAU;IACvE,aAAa,EACX,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,mBAAmB,CAAC,aAAa;IACxE,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,WAAW;IACpE,cAAc,EACZ,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,mBAAmB,CAAC,cAAc;IACzE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,SAAS;CACzE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,aAAa,EAAE,UAAU,CAAC,aAAa;IACvC,WAAW,EAAE,UAAU,CAAC,WAAW;IACnC,YAAY,EAAE,IAAI;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;CAChD,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAoB;IAC9D,OAAO;QACL,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,UAAU,CAAC,cAAc;QACnE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,UAAU,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoPH,MAAM,mBAAmB,GAA8B;IACrD,OAAO,EAAE;QACP,UAAU,EAAE,0BAA0B;QACtC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,qDAAqD;QAClE,cAAc,EAAE,sBAAsB;QACtC,SAAS,EAAE,eAAe;KAC3B;IACD,UAAU,EAAE;QACV,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,wBAAwB;QACrC,cAAc,EAAE,cAAc;QAC9B,SAAS,EAAE,OAAO;KACnB;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAElD,CAAC;AAEjB,mDAAmD;AACnD,MAAM,CAAC,MAAM,UAAU,GACrB,mBAAmB,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC,UAAU;IAC9D,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,UAAU,CAAC,aAAa;IAC5E,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,WAAW;IACtE,YAAY,EAAE,IAAI;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;CAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.0-alpha.18",
+  "version": "0.1.0-alpha.2",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
   "type": "module",
   "bin": {

package/dist/lib/next-steps.d.ts

@@ -1,57 +0,0 @@
-/**
- * next-steps — Shared helper for the guided UX layer
- *
- * Every ZIVIS tool response can include a next_steps array so the LLM
- * organically guides the user through the funnel without them needing to
- * know which tool to call next.
- *
- * Usage:
- *   import { withNextSteps } from "../lib/next-steps.js";
- *   return withNextSteps(myResult, [
- *     { id: "...", label: "...", tool: "...", why: "..." },
- *   ], "One-line summary for the LLM to paraphrase");
- */
-export interface NextStep {
-    /** Stable, snake_case id used for referencing (e.g. "triage_finding") */
-    id: string;
-    /** Plain-English label with no security jargon */
-    label: string;
-    /** The MCP tool the LLM should call to execute this step */
-    tool: string;
-    /** Pre-filled argument suggestions the LLM should pass to the tool */
-    args_hint?: Record<string, unknown>;
-    /** One-line, plain-English reason this step is suggested */
-    why: string;
-    /** Optional tier gate — LLM should not surface if user is below this tier */
-    requires_tier?: "free" | "pro" | "enterprise";
-}
-export interface ZivisToolPayload<T> {
-    result: T;
-    next_steps?: NextStep[];
-    /** Free-form one-line summary for the LLM to paraphrase to the user */
-    summary?: string;
-}
-/**
- * Wrap any tool result with a next_steps array and optional summary.
- *
- * The LLM will read next_steps and use them to naturally suggest the
- * next action, converting discrete tool calls into a guided funnel.
- */
-export declare function withNextSteps<T>(result: T, nextSteps: NextStep[], summary?: string): {
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-};
-/**
- * Wrap an error result with next_steps guidance so even failures give users
- * a clear path forward.
- */
-export declare function withNextStepsError(message: string, nextSteps: NextStep[], summary?: string): {
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError: true;
-};

package/dist/lib/next-steps.js

@@ -1,45 +0,0 @@
-/**
- * next-steps — Shared helper for the guided UX layer
- *
- * Every ZIVIS tool response can include a next_steps array so the LLM
- * organically guides the user through the funnel without them needing to
- * know which tool to call next.
- *
- * Usage:
- *   import { withNextSteps } from "../lib/next-steps.js";
- *   return withNextSteps(myResult, [
- *     { id: "...", label: "...", tool: "...", why: "..." },
- *   ], "One-line summary for the LLM to paraphrase");
- */
-/**
- * Wrap any tool result with a next_steps array and optional summary.
- *
- * The LLM will read next_steps and use them to naturally suggest the
- * next action, converting discrete tool calls into a guided funnel.
- */
-export function withNextSteps(result, nextSteps, summary) {
-    const payload = {
-        result,
-        next_steps: nextSteps,
-        ...(summary ? { summary } : {}),
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
-    };
-}
-/**
- * Wrap an error result with next_steps guidance so even failures give users
- * a clear path forward.
- */
-export function withNextStepsError(message, nextSteps, summary) {
-    const payload = {
-        result: { error: message },
-        next_steps: nextSteps,
-        ...(summary ? { summary } : {}),
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
-        isError: true,
-    };
-}
-//# sourceMappingURL=next-steps.js.map

package/dist/lib/next-steps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"next-steps.js","sourceRoot":"","sources":["../../src/lib/next-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwBH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAS,EACT,SAAqB,EACrB,OAAgB;IAEhB,MAAM,OAAO,GAAwB;QACnC,MAAM;QACN,UAAU,EAAE,SAAS;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAqB,EACrB,OAAgB;IAEhB,MAAM,OAAO,GAAwC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,UAAU,EAAE,SAAS;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC"}

package/dist/prompts/audit-dependencies.d.ts

@@ -1,10 +0,0 @@
-/**
- * audit-dependencies prompt
- *
- * The zero-setup, zero-auth entry point. Walks through package.json /
- * requirements.txt / go.mod and runs zivis_check_repo_trust on each dep.
- * This is the perfect "first taste" — no binding needed.
- * In Cursor: /zivis-audit-dependencies
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function registerAuditDependenciesPrompt(server: McpServer): void;

package/dist/prompts/audit-dependencies.js

@@ -1,56 +0,0 @@
-/**
- * audit-dependencies prompt
- *
- * The zero-setup, zero-auth entry point. Walks through package.json /
- * requirements.txt / go.mod and runs zivis_check_repo_trust on each dep.
- * This is the perfect "first taste" — no binding needed.
- * In Cursor: /zivis-audit-dependencies
- */
-export function registerAuditDependenciesPrompt(server) {
-    server.registerPrompt("audit-dependencies", {
-        description: "Check the open source libraries this project depends on for security risks. No account setup needed.",
-        argsSchema: {},
-    }, async () => ({
-        messages: [
-            {
-                role: "user",
-                content: {
-                    type: "text",
-                    text: `I want to check whether the open source libraries I'm using are safe.
-
-Please do the following:
-
-1. Look at the dependency files in this project. In priority order, check:
-   - package.json (look for the "dependencies" and "devDependencies" keys)
-   - requirements.txt or pyproject.toml
-   - go.mod
-   - Any other manifest files you can see
-
-2. From those files, find all external dependencies that have a GitHub repository.
-   - Skip internal packages (those starting with "@my-company/" or similar private namespaces).
-   - Skip built-in packages (e.g. node built-ins like "fs", "path").
-
-3. For each external dependency that has a public GitHub repo, call \`zivis_check_repo_trust\`
-   with the owner/repo string (e.g. "openai/openai-node").
-
-4. After checking each one, give me a summary table with columns:
-   - Package name
-   - Trust grade (A+ through F)
-   - Risk level (Safe / Low risk / Moderate / High / Critical)
-   - Any critical or high findings (one line each)
-
-5. Flag any package with grade C or below and explain in plain English why it's risky.
-
-6. At the end, suggest the two highest-priority actions to take based on the results.
-
-Ground rules:
-- Process dependencies one at a time so I can follow along.
-- If a package doesn't have a GitHub repo, skip it and say "(no GitHub repo found)".
-- Don't make up trust data — only use what zivis_check_repo_trust returns.
-- Speak in plain English. "High risk" is better than "critical severity threat vector".`,
-                },
-            },
-        ],
-    }));
-}
-//# sourceMappingURL=audit-dependencies.js.map

package/dist/prompts/audit-dependencies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-dependencies.js","sourceRoot":"","sources":["../../src/prompts/audit-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,UAAU,+BAA+B,CAAC,MAAiB;IAC/D,MAAM,CAAC,cAAc,CACnB,oBAAoB,EACpB;QACE,WAAW,EACT,sGAAsG;QACxG,UAAU,EAAE,EAAE;KACf,EACD,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAe;gBACrB,OAAO,EAAE;oBACP,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wFA+BsE;iBAC7E;aACF;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/prompts/getting-started.d.ts

@@ -1,12 +0,0 @@
-/**
- * getting-started prompt
- *
- * The front-door slash command for new users who don't know what to do.
- * In Cursor: /zivis-getting-started
- * In Claude Code: /mcp__zivis-security__getting-started
- *
- * Instructs the LLM to call zivis_check_project and zivis_get_started
- * and present the results as a numbered list — no jargon, no assumptions.
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function registerGettingStartedPrompt(server: McpServer): void;

package/dist/prompts/getting-started.js

@@ -1,48 +0,0 @@
-/**
- * getting-started prompt
- *
- * The front-door slash command for new users who don't know what to do.
- * In Cursor: /zivis-getting-started
- * In Claude Code: /mcp__zivis-security__getting-started
- *
- * Instructs the LLM to call zivis_check_project and zivis_get_started
- * and present the results as a numbered list — no jargon, no assumptions.
- */
-export function registerGettingStartedPrompt(server) {
-    server.registerPrompt("getting-started", {
-        description: "Walk me through ZIVIS for this project. Use this if you're new or unsure what to test.",
-        argsSchema: {},
-    }, async () => ({
-        messages: [
-            {
-                role: "user",
-                content: {
-                    type: "text",
-                    text: `I want to use ZIVIS for security on this project but I'm not sure where to start.
-
-Please do the following, in order:
-
-1. Call \`zivis_check_project\` (no arguments) to confirm the project is connected correctly.
-   - If it returns any problems, explain them in plain English and tell me the exact terminal command to run to fix them. Stop here and wait for me.
-   - If it's OK, continue to step 2.
-
-2. Call \`zivis_get_started\` (no arguments).
-
-3. Present the \`recommended_next_steps\` from the response as a numbered list.
-   - Use the \`label\` as the item text.
-   - Add one sentence from the \`why\` field below each item.
-   - Do NOT invent additional steps or add security advice of your own.
-
-4. Ask me which number I want to do. Wait for my answer before calling anything else.
-
-Ground rules for this conversation:
-- I'm a developer, not a security person. Speak plainly.
-- Avoid these words unless I use them first: "actor", "attack vector", "threat model", "STRIDE", "kill chain", "TTPs".
-- Use plain alternatives: "tester", "how someone might break in", "security plan", "types of attacks".
-- If I seem unsure which option to pick, suggest the one flagged as \`if_user_unsure\` in the response.`,
-                },
-            },
-        ],
-    }));
-}
-//# sourceMappingURL=getting-started.js.map

package/dist/prompts/getting-started.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getting-started.js","sourceRoot":"","sources":["../../src/prompts/getting-started.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,UAAU,4BAA4B,CAAC,MAAiB;IAC5D,MAAM,CAAC,cAAc,CACnB,iBAAiB,EACjB;QACE,WAAW,EACT,wFAAwF;QAC1F,UAAU,EAAE,EAAE;KACf,EACD,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAe;gBACrB,OAAO,EAAE;oBACP,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;wGAqBsF;iBAC7F;aACF;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/prompts/index.d.ts

@@ -1,14 +0,0 @@
-/**
- * MCP Prompts — guided slash commands for non-security engineers
- *
- * These prompts appear as slash commands in IDEs:
- *   Cursor:      /zivis-getting-started, /zivis-secure-my-app, etc.
- *   Claude Code: /mcp__zivis-security__getting-started, etc.
- *   Cline:       Listed in the Prompts picker
- *
- * Each prompt injects a detailed instruction set as a "user" message,
- * telling the LLM exactly how to orchestrate the ZIVIS tools in
- * plain English — no security vocabulary required.
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function registerAllPrompts(server: McpServer): void;

package/dist/prompts/index.js

@@ -1,25 +0,0 @@
-/**
- * MCP Prompts — guided slash commands for non-security engineers
- *
- * These prompts appear as slash commands in IDEs:
- *   Cursor:      /zivis-getting-started, /zivis-secure-my-app, etc.
- *   Claude Code: /mcp__zivis-security__getting-started, etc.
- *   Cline:       Listed in the Prompts picker
- *
- * Each prompt injects a detailed instruction set as a "user" message,
- * telling the LLM exactly how to orchestrate the ZIVIS tools in
- * plain English — no security vocabulary required.
- */
-import { registerGettingStartedPrompt } from "./getting-started.js";
-import { registerSecureMyAppPrompt } from "./secure-my-app.js";
-import { registerAuditDependenciesPrompt } from "./audit-dependencies.js";
-import { registerPrepForLaunchPrompt } from "./prep-for-launch.js";
-import { registerWeeklyCheckPrompt } from "./weekly-check.js";
-export function registerAllPrompts(server) {
-    registerGettingStartedPrompt(server);
-    registerSecureMyAppPrompt(server);
-    registerAuditDependenciesPrompt(server);
-    registerPrepForLaunchPrompt(server);
-    registerWeeklyCheckPrompt(server);
-}
-//# sourceMappingURL=index.js.map

package/dist/prompts/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClC,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACxC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/prompts/prep-for-launch.d.ts

@@ -1,9 +0,0 @@
-/**
- * prep-for-launch prompt
- *
- * Pre-deploy checklist: dependency audit + open findings review + scan status.
- * Returns a go / no-go summary based on severity counts.
- * In Cursor: /zivis-prep-for-launch
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function registerPrepForLaunchPrompt(server: McpServer): void;

package/dist/prompts/prep-for-launch.js

@@ -1,62 +0,0 @@
-/**
- * prep-for-launch prompt
- *
- * Pre-deploy checklist: dependency audit + open findings review + scan status.
- * Returns a go / no-go summary based on severity counts.
- * In Cursor: /zivis-prep-for-launch
- */
-export function registerPrepForLaunchPrompt(server) {
-    server.registerPrompt("prep-for-launch", {
-        description: "Run a pre-launch security checklist. Checks open findings, recent scans, and dependency risks. Returns a go / no-go recommendation.",
-        argsSchema: {},
-    }, async () => ({
-        messages: [
-            {
-                role: "user",
-                content: {
-                    type: "text",
-                    text: `I'm about to launch / deploy to production and I want to make sure there are no known security issues.
-
-Please run through this checklist and give me a go / no-go recommendation at the end.
-
-**Step 1 — Check open findings**
-Call \`zivis_get_findings\` with status="open". 
-- If there are any critical or high findings, list them by title and severity.
-- Note how many medium and low findings exist (don't list them all — just the count).
-
-**Step 2 — Check recent scans**
-Call \`zivis_list_scans\` with limit=5.
-- Tell me when the most recent scan ran and whether it completed successfully.
-- If no scan has run in the last 7 days, flag this as a gap.
-
-**Step 3 — Check dependency risks (if time permits)**
-If the project has a package.json, requirements.txt, or go.mod, identify the 3-5 most important AI or security-sensitive dependencies and call \`zivis_check_repo_trust\` for each.
-- Flag any with grade C or below.
-
-**Step 4 — Go / No-go recommendation**
-Based on the above, give me a clear recommendation:
-
-🔴 NO-GO if:
-- Any critical open findings exist
-- No scan has run (ever)
-- Any dependency has grade D or F
-
-🟡 PROCEED WITH CAUTION if:
-- Any high-severity open findings exist
-- Last scan ran more than 7 days ago
-- Any dependency has grade C
-
-🟢 GO if:
-- No critical or high open findings
-- A scan ran within the last 7 days
-- No high-risk dependencies
-
-After the recommendation, list the top 3 things I should fix before or immediately after launch, in priority order.
-
-Speak in plain English. I'm a developer, not a security engineer.`,
-                },
-            },
-        ],
-    }));
-}
-//# sourceMappingURL=prep-for-launch.js.map