@zivis/mcp 0.1.0-alpha.21 → 0.1.0-alpha.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (223) hide show
  1. package/dist/matcher/ast-eval.d.ts +27 -0
  2. package/dist/matcher/ast-eval.js +132 -0
  3. package/dist/matcher/ast-eval.js.map +1 -0
  4. package/dist/matcher/finding.d.ts +76 -0
  5. package/dist/matcher/finding.js +14 -0
  6. package/dist/matcher/finding.js.map +1 -0
  7. package/dist/matcher/index.d.ts +30 -0
  8. package/dist/matcher/index.js +255 -0
  9. package/dist/matcher/index.js.map +1 -0
  10. package/dist/matcher/inference-candidates.d.ts +54 -0
  11. package/dist/matcher/inference-candidates.js +106 -0
  12. package/dist/matcher/inference-candidates.js.map +1 -0
  13. package/dist/matcher/walker.d.ts +14 -0
  14. package/dist/matcher/walker.js +79 -0
  15. package/dist/matcher/walker.js.map +1 -0
  16. package/dist/pattern-pack/index.d.ts +154 -0
  17. package/dist/pattern-pack/index.js +224 -0
  18. package/dist/pattern-pack/index.js.map +1 -0
  19. package/dist/pattern-packs/zivis-public-0.1.0/capsules/agents/privilege-separation.yaml +224 -0
  20. package/dist/pattern-packs/zivis-public-0.1.0/capsules/prompting/self-consistency-no-isolation.yaml +237 -0
  21. package/dist/pattern-packs/zivis-public-0.1.0/capsules/security/late-org-filter.yaml +266 -0
  22. package/dist/pattern-packs/zivis-public-0.1.0/controls/external_validator_on_facts.yaml +37 -0
  23. package/dist/pattern-packs/zivis-public-0.1.0/controls/human_approval_gate.yaml +44 -0
  24. package/dist/pattern-packs/zivis-public-0.1.0/controls/langgraph_state_machine_with_per_node_tools.yaml +35 -0
  25. package/dist/pattern-packs/zivis-public-0.1.0/controls/per_sample_retrieval_diversification.yaml +38 -0
  26. package/dist/pattern-packs/zivis-public-0.1.0/controls/prisma_extension_or_middleware_attaching_org_filter.yaml +31 -0
  27. package/dist/pattern-packs/zivis-public-0.1.0/controls/row_level_security_policy.yaml +37 -0
  28. package/dist/pattern-packs/zivis-public-0.1.0/manifest.json +129 -0
  29. package/dist/pattern-packs/zivis-public-0.1.0/prompts/agents/privilege-separation/identify.md +54 -0
  30. package/dist/pattern-packs/zivis-public-0.1.0/prompts/prompting/self-consistency-no-isolation/identify.md +60 -0
  31. package/dist/pattern-packs/zivis-public-0.1.0/prompts/security/late-org-filter/identify.md +78 -0
  32. package/dist/prompts/index.d.ts +1 -1
  33. package/dist/prompts/index.js +1 -7
  34. package/dist/prompts/index.js.map +1 -1
  35. package/dist/server.js +36 -166
  36. package/dist/server.js.map +1 -1
  37. package/dist/tools/enterprise/get-threat-model-artifact.d.ts +30 -0
  38. package/dist/tools/enterprise/get-threat-model-artifact.js +80 -0
  39. package/dist/tools/enterprise/get-threat-model-artifact.js.map +1 -0
  40. package/dist/tools/enterprise/get-threat-model.d.ts +1 -1
  41. package/dist/tools/enterprise/get-threat-model.js +59 -11
  42. package/dist/tools/enterprise/get-threat-model.js.map +1 -1
  43. package/dist/tools/enterprise/list-threat-model-artifacts.d.ts +67 -0
  44. package/dist/tools/enterprise/list-threat-model-artifacts.js +121 -0
  45. package/dist/tools/enterprise/list-threat-model-artifacts.js.map +1 -0
  46. package/dist/tools/enterprise/manage-actor.d.ts +1 -1
  47. package/dist/tools/enterprise/manage-actor.js +14 -1
  48. package/dist/tools/enterprise/manage-actor.js.map +1 -1
  49. package/dist/tools/enterprise/manage-attack-scenario.d.ts +1 -1
  50. package/dist/tools/enterprise/manage-attack-scenario.js +13 -1
  51. package/dist/tools/enterprise/manage-attack-scenario.js.map +1 -1
  52. package/dist/tools/enterprise/manage-component.d.ts +1 -1
  53. package/dist/tools/enterprise/manage-component.js +20 -1
  54. package/dist/tools/enterprise/manage-component.js.map +1 -1
  55. package/dist/tools/enterprise/manage-data-asset.d.ts +2 -2
  56. package/dist/tools/enterprise/manage-data-asset.js +17 -1
  57. package/dist/tools/enterprise/manage-data-asset.js.map +1 -1
  58. package/dist/tools/enterprise/manage-data-flow.d.ts +2 -2
  59. package/dist/tools/enterprise/manage-data-flow.js +19 -1
  60. package/dist/tools/enterprise/manage-data-flow.js.map +1 -1
  61. package/dist/tools/enterprise/manage-security-control.d.ts +1 -1
  62. package/dist/tools/enterprise/manage-security-control.js +18 -1
  63. package/dist/tools/enterprise/manage-security-control.js.map +1 -1
  64. package/dist/tools/enterprise/manage-test-case.d.ts +2 -2
  65. package/dist/tools/enterprise/manage-test-case.js +8 -0
  66. package/dist/tools/enterprise/manage-test-case.js.map +1 -1
  67. package/dist/tools/get-started.d.ts +1 -1
  68. package/dist/tools/get-started.js +185 -8
  69. package/dist/tools/get-started.js.map +1 -1
  70. package/dist/tools/inspect.d.ts +38 -0
  71. package/dist/tools/inspect.js +252 -0
  72. package/dist/tools/inspect.js.map +1 -0
  73. package/dist/tools/manage-application.d.ts +1 -1
  74. package/dist/tools/security-review.js +67 -50
  75. package/dist/tools/security-review.js.map +1 -1
  76. package/dist/tools/threat-get-capsule.d.ts +25 -0
  77. package/dist/tools/threat-get-capsule.js +64 -0
  78. package/dist/tools/threat-get-capsule.js.map +1 -0
  79. package/dist/tools/threat-get-inference-prompt.d.ts +32 -0
  80. package/dist/tools/threat-get-inference-prompt.js +91 -0
  81. package/dist/tools/threat-get-inference-prompt.js.map +1 -0
  82. package/dist/tools/threat-guide.d.ts +39 -0
  83. package/dist/tools/threat-guide.js +111 -0
  84. package/dist/tools/threat-guide.js.map +1 -0
  85. package/dist/tools/threat-list-relevant-capsules.d.ts +30 -0
  86. package/dist/tools/threat-list-relevant-capsules.js +176 -0
  87. package/dist/tools/threat-list-relevant-capsules.js.map +1 -0
  88. package/dist/tools/threat-run-matcher.d.ts +27 -0
  89. package/dist/tools/threat-run-matcher.js +164 -0
  90. package/dist/tools/threat-run-matcher.js.map +1 -0
  91. package/package.json +13 -3
  92. package/dist/prompts/prep-for-launch.d.ts +0 -9
  93. package/dist/prompts/prep-for-launch.js +0 -62
  94. package/dist/prompts/prep-for-launch.js.map +0 -1
  95. package/dist/prompts/secure-my-app.d.ts +0 -9
  96. package/dist/prompts/secure-my-app.js +0 -70
  97. package/dist/prompts/secure-my-app.js.map +0 -1
  98. package/dist/prompts/weekly-check.d.ts +0 -9
  99. package/dist/prompts/weekly-check.js +0 -48
  100. package/dist/prompts/weekly-check.js.map +0 -1
  101. package/dist/tools/enterprise/capture-evidence.d.ts +0 -54
  102. package/dist/tools/enterprise/capture-evidence.js +0 -72
  103. package/dist/tools/enterprise/capture-evidence.js.map +0 -1
  104. package/dist/tools/enterprise/create-report-ticket.d.ts +0 -34
  105. package/dist/tools/enterprise/create-report-ticket.js +0 -44
  106. package/dist/tools/enterprise/create-report-ticket.js.map +0 -1
  107. package/dist/tools/enterprise/end-pentest-session.d.ts +0 -33
  108. package/dist/tools/enterprise/end-pentest-session.js +0 -42
  109. package/dist/tools/enterprise/end-pentest-session.js.map +0 -1
  110. package/dist/tools/enterprise/generate-report.d.ts +0 -55
  111. package/dist/tools/enterprise/generate-report.js +0 -111
  112. package/dist/tools/enterprise/generate-report.js.map +0 -1
  113. package/dist/tools/enterprise/get-campaign.d.ts +0 -27
  114. package/dist/tools/enterprise/get-campaign.js +0 -31
  115. package/dist/tools/enterprise/get-campaign.js.map +0 -1
  116. package/dist/tools/enterprise/get-report-status.d.ts +0 -27
  117. package/dist/tools/enterprise/get-report-status.js +0 -38
  118. package/dist/tools/enterprise/get-report-status.js.map +0 -1
  119. package/dist/tools/enterprise/list-agents.d.ts +0 -42
  120. package/dist/tools/enterprise/list-agents.js +0 -95
  121. package/dist/tools/enterprise/list-agents.js.map +0 -1
  122. package/dist/tools/enterprise/list-campaigns.d.ts +0 -37
  123. package/dist/tools/enterprise/list-campaigns.js +0 -60
  124. package/dist/tools/enterprise/list-campaigns.js.map +0 -1
  125. package/dist/tools/enterprise/list-report-issues.d.ts +0 -36
  126. package/dist/tools/enterprise/list-report-issues.js +0 -50
  127. package/dist/tools/enterprise/list-report-issues.js.map +0 -1
  128. package/dist/tools/enterprise/manage-campaign-agent-instance.d.ts +0 -42
  129. package/dist/tools/enterprise/manage-campaign-agent-instance.js +0 -68
  130. package/dist/tools/enterprise/manage-campaign-agent-instance.js.map +0 -1
  131. package/dist/tools/enterprise/manage-campaign-target.d.ts +0 -44
  132. package/dist/tools/enterprise/manage-campaign-target.js +0 -70
  133. package/dist/tools/enterprise/manage-campaign-target.js.map +0 -1
  134. package/dist/tools/enterprise/manage-campaign.d.ts +0 -62
  135. package/dist/tools/enterprise/manage-campaign.js +0 -114
  136. package/dist/tools/enterprise/manage-campaign.js.map +0 -1
  137. package/dist/tools/enterprise/manage-finding.d.ts +0 -69
  138. package/dist/tools/enterprise/manage-finding.js +0 -106
  139. package/dist/tools/enterprise/manage-finding.js.map +0 -1
  140. package/dist/tools/enterprise/promote-finding-to-issue.d.ts +0 -36
  141. package/dist/tools/enterprise/promote-finding-to-issue.js +0 -65
  142. package/dist/tools/enterprise/promote-finding-to-issue.js.map +0 -1
  143. package/dist/tools/enterprise/publish-report-version.d.ts +0 -34
  144. package/dist/tools/enterprise/publish-report-version.js +0 -75
  145. package/dist/tools/enterprise/publish-report-version.js.map +0 -1
  146. package/dist/tools/enterprise/publish-test-to-library.d.ts +0 -31
  147. package/dist/tools/enterprise/publish-test-to-library.js +0 -40
  148. package/dist/tools/enterprise/publish-test-to-library.js.map +0 -1
  149. package/dist/tools/enterprise/record-test-result.d.ts +0 -67
  150. package/dist/tools/enterprise/record-test-result.js +0 -75
  151. package/dist/tools/enterprise/record-test-result.js.map +0 -1
  152. package/dist/tools/enterprise/start-pentest-session.d.ts +0 -35
  153. package/dist/tools/enterprise/start-pentest-session.js +0 -50
  154. package/dist/tools/enterprise/start-pentest-session.js.map +0 -1
  155. package/dist/tools/enterprise/sync-report-section.d.ts +0 -41
  156. package/dist/tools/enterprise/sync-report-section.js +0 -79
  157. package/dist/tools/enterprise/sync-report-section.js.map +0 -1
  158. package/dist/tools/enterprise/update-report-issue.d.ts +0 -55
  159. package/dist/tools/enterprise/update-report-issue.js +0 -69
  160. package/dist/tools/enterprise/update-report-issue.js.map +0 -1
  161. package/dist/tools/get-agent-test-results.d.ts +0 -41
  162. package/dist/tools/get-agent-test-results.js +0 -86
  163. package/dist/tools/get-agent-test-results.js.map +0 -1
  164. package/dist/tools/get-application-auth-config.d.ts +0 -27
  165. package/dist/tools/get-application-auth-config.js +0 -44
  166. package/dist/tools/get-application-auth-config.js.map +0 -1
  167. package/dist/tools/get-artifact-content.d.ts +0 -29
  168. package/dist/tools/get-artifact-content.js +0 -86
  169. package/dist/tools/get-artifact-content.js.map +0 -1
  170. package/dist/tools/get-finding-details.d.ts +0 -22
  171. package/dist/tools/get-finding-details.js +0 -61
  172. package/dist/tools/get-finding-details.js.map +0 -1
  173. package/dist/tools/get-findings.d.ts +0 -51
  174. package/dist/tools/get-findings.js +0 -124
  175. package/dist/tools/get-findings.js.map +0 -1
  176. package/dist/tools/get-recon-scan.d.ts +0 -27
  177. package/dist/tools/get-recon-scan.js +0 -46
  178. package/dist/tools/get-recon-scan.js.map +0 -1
  179. package/dist/tools/get-scan-output.d.ts +0 -27
  180. package/dist/tools/get-scan-output.js +0 -64
  181. package/dist/tools/get-scan-output.js.map +0 -1
  182. package/dist/tools/get-scenario-details.d.ts +0 -27
  183. package/dist/tools/get-scenario-details.js +0 -46
  184. package/dist/tools/get-scenario-details.js.map +0 -1
  185. package/dist/tools/get-test-case-results.d.ts +0 -37
  186. package/dist/tools/get-test-case-results.js +0 -66
  187. package/dist/tools/get-test-case-results.js.map +0 -1
  188. package/dist/tools/get-test-details.d.ts +0 -29
  189. package/dist/tools/get-test-details.js +0 -49
  190. package/dist/tools/get-test-details.js.map +0 -1
  191. package/dist/tools/list-agent-test-cases.d.ts +0 -41
  192. package/dist/tools/list-agent-test-cases.js +0 -73
  193. package/dist/tools/list-agent-test-cases.js.map +0 -1
  194. package/dist/tools/list-recon-scans.d.ts +0 -36
  195. package/dist/tools/list-recon-scans.js +0 -74
  196. package/dist/tools/list-recon-scans.js.map +0 -1
  197. package/dist/tools/list-scan-artifacts.d.ts +0 -41
  198. package/dist/tools/list-scan-artifacts.js +0 -63
  199. package/dist/tools/list-scan-artifacts.js.map +0 -1
  200. package/dist/tools/list-scans.d.ts +0 -38
  201. package/dist/tools/list-scans.js +0 -125
  202. package/dist/tools/list-scans.js.map +0 -1
  203. package/dist/tools/list-test-library.d.ts +0 -44
  204. package/dist/tools/list-test-library.js +0 -83
  205. package/dist/tools/list-test-library.js.map +0 -1
  206. package/dist/tools/list-test-scenarios.d.ts +0 -25
  207. package/dist/tools/list-test-scenarios.js +0 -94
  208. package/dist/tools/list-test-scenarios.js.map +0 -1
  209. package/dist/tools/local-scan.d.ts +0 -40
  210. package/dist/tools/local-scan.js +0 -261
  211. package/dist/tools/local-scan.js.map +0 -1
  212. package/dist/tools/run-test-scenario.d.ts +0 -37
  213. package/dist/tools/run-test-scenario.js +0 -70
  214. package/dist/tools/run-test-scenario.js.map +0 -1
  215. package/dist/tools/scan-pr.d.ts +0 -27
  216. package/dist/tools/scan-pr.js +0 -51
  217. package/dist/tools/scan-pr.js.map +0 -1
  218. package/dist/tools/setup-red-team-target.d.ts +0 -73
  219. package/dist/tools/setup-red-team-target.js +0 -461
  220. package/dist/tools/setup-red-team-target.js.map +0 -1
  221. package/dist/tools/triage-finding.d.ts +0 -41
  222. package/dist/tools/triage-finding.js +0 -125
  223. package/dist/tools/triage-finding.js.map +0 -1
@@ -1,106 +0,0 @@
1
- /**
2
- * zivis_manage_finding — Create or update findings in a threat model
3
- *
4
- * Maps to: POST/PATCH /api/threat-models/:id/findings
5
- */
6
- import { z } from "zod";
7
- import { sanitizeResponse } from "../../sanitize.js";
8
- export const MANAGE_FINDING_NAME = "zivis_manage_finding";
9
- export const MANAGE_FINDING_DESCRIPTION = `Create or update a finding (vulnerability) in a threat model.
10
-
11
- Findings represent confirmed or suspected vulnerabilities discovered during analysis or pen testing. They link to components, attack scenarios, and can be tracked through remediation.
12
-
13
- Actions:
14
- - create: Add a new finding (requires title, severity)
15
- - update: Modify an existing finding (requires finding_id) — use to update status, add notes, etc.`;
16
- export const MANAGE_FINDING_SCHEMA = {
17
- threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
18
- action: z.enum(["create", "update"]).describe("Action to perform"),
19
- finding_id: z.string().optional().describe("Finding UUID (required for update)"),
20
- title: z.string().optional().describe("Finding title (e.g., 'SQL Injection in user search endpoint')"),
21
- description: z.string().optional().describe("Detailed description of the vulnerability"),
22
- severity: z.enum(["critical", "high", "medium", "low", "info"]).optional().describe("Severity level"),
23
- status: z
24
- .enum(["open", "in_progress", "mitigated", "verified", "accepted_risk", "false_positive"])
25
- .optional()
26
- .describe("Finding status"),
27
- category: z.string().optional().describe("Category (e.g., 'injection', 'authentication', 'authorization')"),
28
- component_id: z.string().optional().describe("Affected component UUID"),
29
- attack_scenario_id: z.string().optional().describe("Related attack scenario UUID"),
30
- cwe_id: z.string().optional().describe("CWE identifier (e.g., 'CWE-89')"),
31
- cvss_score: z.number().min(0).max(10).optional().describe("CVSS score (0-10)"),
32
- remediation: z.string().optional().describe("Recommended remediation steps"),
33
- proof_of_concept: z.string().optional().describe("Proof of concept or reproduction steps"),
34
- };
35
- export function createManageFindingHandler(apiClient) {
36
- return async (params) => {
37
- try {
38
- const { threat_model_id, action, finding_id } = params;
39
- if (action === "update" && !finding_id) {
40
- return {
41
- content: [{ type: "text", text: "Error: finding_id is required for update" }],
42
- isError: true,
43
- };
44
- }
45
- let data;
46
- if (action === "create") {
47
- if (!params.title || !params.severity) {
48
- return {
49
- content: [{ type: "text", text: "Error: title and severity are required for create" }],
50
- isError: true,
51
- };
52
- }
53
- data = await apiClient.post(`/api/threat-models/${threat_model_id}/findings`, {
54
- title: params.title,
55
- description: params.description,
56
- severity: params.severity,
57
- status: params.status || "open",
58
- category: params.category,
59
- componentId: params.component_id,
60
- attackScenarioId: params.attack_scenario_id,
61
- cweId: params.cwe_id,
62
- cvssScore: params.cvss_score,
63
- remediation: params.remediation,
64
- proofOfConcept: params.proof_of_concept,
65
- });
66
- }
67
- else {
68
- const body = {};
69
- if (params.title)
70
- body.title = params.title;
71
- if (params.description !== undefined)
72
- body.description = params.description;
73
- if (params.severity)
74
- body.severity = params.severity;
75
- if (params.status)
76
- body.status = params.status;
77
- if (params.category)
78
- body.category = params.category;
79
- if (params.component_id)
80
- body.componentId = params.component_id;
81
- if (params.attack_scenario_id)
82
- body.attackScenarioId = params.attack_scenario_id;
83
- if (params.cwe_id)
84
- body.cweId = params.cwe_id;
85
- if (params.cvss_score !== undefined)
86
- body.cvssScore = params.cvss_score;
87
- if (params.remediation !== undefined)
88
- body.remediation = params.remediation;
89
- if (params.proof_of_concept !== undefined)
90
- body.proofOfConcept = params.proof_of_concept;
91
- data = await apiClient.patch(`/api/threat-models/${threat_model_id}/findings/${finding_id}`, body);
92
- }
93
- return {
94
- content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
95
- };
96
- }
97
- catch (err) {
98
- const message = err instanceof Error ? err.message : "Failed to manage finding";
99
- return {
100
- content: [{ type: "text", text: `Error: ${message}` }],
101
- isError: true,
102
- };
103
- }
104
- };
105
- }
106
- //# sourceMappingURL=manage-finding.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"manage-finding.js","sourceRoot":"","sources":["../../../src/tools/enterprise/manage-finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;mGAMyD,CAAC;AAEpG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACtG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACxF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACrG,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;SACzF,QAAQ,EAAE;SACV,QAAQ,CAAC,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC3G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACvE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAClF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAC9E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CAC3F,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,KAAK,EAAE,MAeb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YAEvD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;oBACtF,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,IAA6B,CAAC;YAElC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;wBAC/F,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CACzB,sBAAsB,eAAe,WAAW,EAChD;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;oBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,gBAAgB,EAAE,MAAM,CAAC,kBAAkB;oBAC3C,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,cAAc,EAAE,MAAM,CAAC,gBAAgB;iBACxC,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAA4B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,KAAK;oBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC5C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACrD,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACrD,IAAI,MAAM,CAAC,YAAY;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAChE,IAAI,MAAM,CAAC,kBAAkB;oBAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACjF,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;oBAAE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAEzF,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAC1B,sBAAsB,eAAe,aAAa,UAAU,EAAE,EAC9D,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
@@ -1,36 +0,0 @@
1
- /**
2
- * zivis_promote_finding_to_issue — Promote campaign findings to report issues
3
- *
4
- * Maps to: POST /api/reports/:reportId/issues/promote
5
- * Also uses: POST /api/reports/for-campaign/:campaignId to auto-create report
6
- */
7
- import { z } from "zod";
8
- import type { ApiClient } from "../../api-client.js";
9
- export declare const PROMOTE_FINDING_TO_ISSUE_NAME = "zivis_promote_finding_to_issue";
10
- export declare const PROMOTE_FINDING_TO_ISSUE_DESCRIPTION = "Promote one or more campaign findings to a report issue for the remediation checklist.\n\nCreates a curated report issue from raw scan findings. Multiple findings can be grouped into a single issue (e.g., same root cause across different URLs). The issue gets its own title, description, and recommendation that can differ from the raw finding.\n\nIf no report exists for the campaign yet, one is automatically created.\n\nUse this after reviewing findings to build the official pen test report.";
11
- export declare const PROMOTE_FINDING_TO_ISSUE_SCHEMA: {
12
- campaign_id: z.ZodString;
13
- finding_ids: z.ZodArray<z.ZodString>;
14
- title: z.ZodOptional<z.ZodString>;
15
- description: z.ZodOptional<z.ZodString>;
16
- recommendation: z.ZodOptional<z.ZodString>;
17
- };
18
- export declare function createPromoteFindingToIssueHandler(apiClient: ApiClient): (params: {
19
- campaign_id: string;
20
- finding_ids: string[];
21
- title?: string;
22
- description?: string;
23
- recommendation?: string;
24
- }) => Promise<{
25
- content: {
26
- type: "text";
27
- text: string;
28
- }[];
29
- isError: boolean;
30
- } | {
31
- content: {
32
- type: "text";
33
- text: string;
34
- }[];
35
- isError?: undefined;
36
- }>;
@@ -1,65 +0,0 @@
1
- /**
2
- * zivis_promote_finding_to_issue — Promote campaign findings to report issues
3
- *
4
- * Maps to: POST /api/reports/:reportId/issues/promote
5
- * Also uses: POST /api/reports/for-campaign/:campaignId to auto-create report
6
- */
7
- import { z } from "zod";
8
- import { sanitizeResponse } from "../../sanitize.js";
9
- export const PROMOTE_FINDING_TO_ISSUE_NAME = "zivis_promote_finding_to_issue";
10
- export const PROMOTE_FINDING_TO_ISSUE_DESCRIPTION = `Promote one or more campaign findings to a report issue for the remediation checklist.
11
-
12
- Creates a curated report issue from raw scan findings. Multiple findings can be grouped into a single issue (e.g., same root cause across different URLs). The issue gets its own title, description, and recommendation that can differ from the raw finding.
13
-
14
- If no report exists for the campaign yet, one is automatically created.
15
-
16
- Use this after reviewing findings to build the official pen test report.`;
17
- export const PROMOTE_FINDING_TO_ISSUE_SCHEMA = {
18
- campaign_id: z.string().describe("Campaign UUID — used to find or create the campaign report"),
19
- finding_ids: z.array(z.string()).min(1).describe("Array of CampaignFinding UUIDs to promote"),
20
- title: z.string().optional().describe("Custom issue title (defaults to finding title)"),
21
- description: z.string().optional().describe("Custom issue description"),
22
- recommendation: z.string().optional().describe("Custom remediation recommendation"),
23
- };
24
- export function createPromoteFindingToIssueHandler(apiClient) {
25
- return async (params) => {
26
- try {
27
- // Step 1: Get or create the report for this campaign
28
- const reportData = await apiClient.post(`/api/reports/for-campaign/${params.campaign_id}`, {});
29
- const reportId = reportData.reportId;
30
- if (!reportId) {
31
- return {
32
- content: [{ type: "text", text: "Error: Could not get or create report for campaign" }],
33
- isError: true,
34
- };
35
- }
36
- // Step 2: Promote findings to an issue
37
- const issue = await apiClient.post(`/api/reports/${reportId}/issues/promote`, {
38
- campaignFindingIds: params.finding_ids,
39
- title: params.title,
40
- description: params.description,
41
- recommendation: params.recommendation,
42
- });
43
- const result = sanitizeResponse({
44
- issue,
45
- reportId,
46
- nextSteps: [
47
- "Issue added to remediation checklist.",
48
- "Use zivis_list_report_issues to see all issues.",
49
- "Use zivis_update_report_issue to change status (open → in_progress → done).",
50
- ],
51
- });
52
- return {
53
- content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
54
- };
55
- }
56
- catch (err) {
57
- const message = err instanceof Error ? err.message : "Failed to promote finding to issue";
58
- return {
59
- content: [{ type: "text", text: `Error: ${message}` }],
60
- isError: true,
61
- };
62
- }
63
- };
64
- }
65
- //# sourceMappingURL=promote-finding-to-issue.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"promote-finding-to-issue.js","sourceRoot":"","sources":["../../../src/tools/enterprise/promote-finding-to-issue.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AAE9E,MAAM,CAAC,MAAM,oCAAoC,GAAG;;;;;;yEAMqB,CAAC;AAE1E,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAC9F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CACpF,CAAC;AAEF,MAAM,UAAU,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,MAMb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CACrC,6BAA6B,MAAM,CAAC,WAAW,EAAE,EACjD,EAAE,CACH,CAAC;YAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,oDAAoD,EAAE,CAAC;oBAChG,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAChC,gBAAgB,QAAQ,iBAAiB,EACzC;gBACE,kBAAkB,EAAE,MAAM,CAAC,WAAW;gBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CACF,CAAC;YAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,KAAK;gBACL,QAAQ;gBACR,SAAS,EAAE;oBACT,uCAAuC;oBACvC,iDAAiD;oBACjD,6EAA6E;iBAC9E;aACF,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC1F,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
@@ -1,34 +0,0 @@
1
- /**
2
- * zivis_publish_report_version — Publish a report version and optionally export PDF
3
- *
4
- * Maps to: POST /api/reports/:reportId/publish
5
- * + POST /api/reports/:reportId/export (optional)
6
- */
7
- import { z } from "zod";
8
- import type { ApiClient } from "../../api-client.js";
9
- export declare const PUBLISH_REPORT_VERSION_NAME = "zivis_publish_report_version";
10
- export declare const PUBLISH_REPORT_VERSION_DESCRIPTION = "Publish a new version of the campaign report and optionally export as PDF.\n\nPublishing creates an immutable snapshot of the current report state (all sections, issues, remediation status). Each version gets a version number and optional changelog.\n\nUse this when the report is ready for delivery or when you want to checkpoint progress.\n\nWorkflow: Write sections \u2192 promote findings \u2192 publish version \u2192 export PDF.";
11
- export declare const PUBLISH_REPORT_VERSION_SCHEMA: {
12
- campaign_id: z.ZodOptional<z.ZodString>;
13
- report_id: z.ZodOptional<z.ZodString>;
14
- changelog: z.ZodOptional<z.ZodString>;
15
- export_pdf: z.ZodDefault<z.ZodBoolean>;
16
- };
17
- export declare function createPublishReportVersionHandler(apiClient: ApiClient): (params: {
18
- campaign_id?: string;
19
- report_id?: string;
20
- changelog?: string;
21
- export_pdf?: boolean;
22
- }) => Promise<{
23
- content: {
24
- type: "text";
25
- text: string;
26
- }[];
27
- isError: boolean;
28
- } | {
29
- content: {
30
- type: "text";
31
- text: string;
32
- }[];
33
- isError?: undefined;
34
- }>;
@@ -1,75 +0,0 @@
1
- /**
2
- * zivis_publish_report_version — Publish a report version and optionally export PDF
3
- *
4
- * Maps to: POST /api/reports/:reportId/publish
5
- * + POST /api/reports/:reportId/export (optional)
6
- */
7
- import { z } from "zod";
8
- import { sanitizeResponse } from "../../sanitize.js";
9
- export const PUBLISH_REPORT_VERSION_NAME = "zivis_publish_report_version";
10
- export const PUBLISH_REPORT_VERSION_DESCRIPTION = `Publish a new version of the campaign report and optionally export as PDF.
11
-
12
- Publishing creates an immutable snapshot of the current report state (all sections, issues, remediation status). Each version gets a version number and optional changelog.
13
-
14
- Use this when the report is ready for delivery or when you want to checkpoint progress.
15
-
16
- Workflow: Write sections → promote findings → publish version → export PDF.`;
17
- export const PUBLISH_REPORT_VERSION_SCHEMA = {
18
- campaign_id: z.string().optional().describe("Campaign UUID — auto-resolves to report"),
19
- report_id: z.string().optional().describe("Report UUID (alternative to campaign_id)"),
20
- changelog: z.string().optional().describe("What changed in this version (e.g., 'Added SQL injection findings')"),
21
- export_pdf: z.boolean().default(false).describe("Also trigger PDF export after publishing"),
22
- };
23
- export function createPublishReportVersionHandler(apiClient) {
24
- return async (params) => {
25
- try {
26
- let reportId = params.report_id;
27
- // Resolve campaign → report if needed
28
- if (!reportId && params.campaign_id) {
29
- const reportData = await apiClient.post(`/api/reports/for-campaign/${params.campaign_id}`, {});
30
- reportId = reportData.reportId;
31
- }
32
- if (!reportId) {
33
- return {
34
- content: [{ type: "text", text: "Error: Provide either campaign_id or report_id" }],
35
- isError: true,
36
- };
37
- }
38
- // Publish version
39
- const version = await apiClient.post(`/api/reports/${reportId}/publish`, { changelog: params.changelog });
40
- // Optionally export PDF
41
- let pdfExport = null;
42
- if (params.export_pdf) {
43
- try {
44
- pdfExport = await apiClient.post(`/api/reports/${reportId}/export`, {});
45
- }
46
- catch (pdfErr) {
47
- console.error("PDF export failed:", pdfErr);
48
- }
49
- }
50
- const result = sanitizeResponse({
51
- version,
52
- pdfExport,
53
- reportId,
54
- nextSteps: [
55
- "Version published successfully.",
56
- pdfExport
57
- ? "PDF export triggered. Check status with zivis_get_report_status."
58
- : "Use export_pdf: true to generate a PDF.",
59
- "View the report at the campaign's Report tab in the platform.",
60
- ],
61
- });
62
- return {
63
- content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
64
- };
65
- }
66
- catch (err) {
67
- const message = err instanceof Error ? err.message : "Failed to publish report version";
68
- return {
69
- content: [{ type: "text", text: `Error: ${message}` }],
70
- isError: true,
71
- };
72
- }
73
- };
74
- }
75
- //# sourceMappingURL=publish-report-version.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"publish-report-version.js","sourceRoot":"","sources":["../../../src/tools/enterprise/publish-report-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAE1E,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;4EAM0B,CAAC;AAE7E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;IAChH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC5F,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,OAAO,KAAK,EAAE,MAKb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,IAAI,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;YAEhC,sCAAsC;YACtC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CACrC,6BAA6B,MAAM,CAAC,WAAW,EAAE,EACjD,EAAE,CACH,CAAC;gBACF,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YACjC,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC;oBAC5F,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAClC,gBAAgB,QAAQ,UAAU,EAClC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAChC,CAAC;YAEF,wBAAwB;YACxB,IAAI,SAAS,GAAmC,IAAI,CAAC;YACrD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,gBAAgB,QAAQ,SAAS,EACjC,EAAE,CACH,CAAC;gBACJ,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,SAAS,EAAE;oBACT,iCAAiC;oBACjC,SAAS;wBACP,CAAC,CAAC,kEAAkE;wBACpE,CAAC,CAAC,yCAAyC;oBAC7C,+DAA+D;iBAChE;aACF,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC;YACxF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
@@ -1,31 +0,0 @@
1
- /**
2
- * zivis_publish_test_to_library — Publish a manual test to the agent test case library
3
- *
4
- * Maps to: POST /api/pentest-sessions/:id/results/:resultId/publish
5
- */
6
- import { z } from "zod";
7
- import type { ApiClient } from "../../api-client.js";
8
- export declare const PUBLISH_TEST_TO_LIBRARY_NAME = "zivis_publish_test_to_library";
9
- export declare const PUBLISH_TEST_TO_LIBRARY_DESCRIPTION = "Publish a manual test result to the ZIVIS agent test case library.\n\nWhen you discover a good test case during manual pen testing, use this to make it available to automated ZIVIS agents (pen test agent, red team agent). The test case will be added to the specified agent instance's test library with source=\"user\".";
10
- export declare const PUBLISH_TEST_TO_LIBRARY_SCHEMA: {
11
- session_id: z.ZodString;
12
- result_id: z.ZodString;
13
- agent_instance_id: z.ZodString;
14
- };
15
- export declare function createPublishTestToLibraryHandler(apiClient: ApiClient): (params: {
16
- session_id: string;
17
- result_id: string;
18
- agent_instance_id: string;
19
- }) => Promise<{
20
- content: {
21
- type: "text";
22
- text: string;
23
- }[];
24
- isError?: undefined;
25
- } | {
26
- content: {
27
- type: "text";
28
- text: string;
29
- }[];
30
- isError: boolean;
31
- }>;
@@ -1,40 +0,0 @@
1
- /**
2
- * zivis_publish_test_to_library — Publish a manual test to the agent test case library
3
- *
4
- * Maps to: POST /api/pentest-sessions/:id/results/:resultId/publish
5
- */
6
- import { z } from "zod";
7
- import { sanitizeResponse } from "../../sanitize.js";
8
- export const PUBLISH_TEST_TO_LIBRARY_NAME = "zivis_publish_test_to_library";
9
- export const PUBLISH_TEST_TO_LIBRARY_DESCRIPTION = `Publish a manual test result to the ZIVIS agent test case library.
10
-
11
- When you discover a good test case during manual pen testing, use this to make it available to automated ZIVIS agents (pen test agent, red team agent). The test case will be added to the specified agent instance's test library with source="user".`;
12
- export const PUBLISH_TEST_TO_LIBRARY_SCHEMA = {
13
- session_id: z.string().describe("Pen test session UUID"),
14
- result_id: z.string().describe("Test result UUID to publish"),
15
- agent_instance_id: z.string().describe("Agent instance UUID to add the test case to"),
16
- };
17
- export function createPublishTestToLibraryHandler(apiClient) {
18
- return async (params) => {
19
- try {
20
- const data = await apiClient.post(`/api/pentest-sessions/${params.session_id}/results/${params.result_id}/publish`, { agentInstanceId: params.agent_instance_id });
21
- const sanitized = sanitizeResponse(data);
22
- return {
23
- content: [
24
- {
25
- type: "text",
26
- text: JSON.stringify(sanitized, null, 2),
27
- },
28
- ],
29
- };
30
- }
31
- catch (err) {
32
- const message = err instanceof Error ? err.message : "Failed to publish test to library";
33
- return {
34
- content: [{ type: "text", text: `Error: ${message}` }],
35
- isError: true,
36
- };
37
- }
38
- };
39
- }
40
- //# sourceMappingURL=publish-test-to-library.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"publish-test-to-library.js","sourceRoot":"","sources":["../../../src/tools/enterprise/publish-test-to-library.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E,MAAM,CAAC,MAAM,mCAAmC,GAAG;;uPAEoM,CAAC;AAExP,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC7D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACtF,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,OAAO,KAAK,EAAE,MAIb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,yBAAyB,MAAM,CAAC,UAAU,YAAY,MAAM,CAAC,SAAS,UAAU,EAChF,EAAE,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAC9C,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC;YACzF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
@@ -1,67 +0,0 @@
1
- /**
2
- * zivis_record_test_result — Record a test result in a pen test session
3
- *
4
- * Maps to: POST /api/pentest-sessions/:id/results
5
- */
6
- import { z } from "zod";
7
- import type { ApiClient } from "../../api-client.js";
8
- export declare const RECORD_TEST_RESULT_NAME = "zivis_record_test_result";
9
- export declare const RECORD_TEST_RESULT_DESCRIPTION = "Record the result of a specific test within a pen test session.\n\nAfter running a manual test (e.g., SQL injection attempt, auth bypass), use this tool to log the outcome. If the test is linked to a threat model test case, the test case result will be updated automatically.\n\nInclude evidence IDs from zivis_capture_evidence to link screenshots or terminal output to the result.";
10
- export declare const RECORD_TEST_RESULT_SCHEMA: {
11
- session_id: z.ZodString;
12
- test_name: z.ZodString;
13
- result: z.ZodEnum<{
14
- partial: "partial";
15
- not_tested: "not_tested";
16
- pass: "pass";
17
- fail: "fail";
18
- blocked: "blocked";
19
- }>;
20
- test_description: z.ZodOptional<z.ZodString>;
21
- severity: z.ZodOptional<z.ZodEnum<{
22
- critical: "critical";
23
- high: "high";
24
- medium: "medium";
25
- low: "low";
26
- info: "info";
27
- }>>;
28
- findings: z.ZodOptional<z.ZodString>;
29
- steps_performed: z.ZodOptional<z.ZodArray<z.ZodObject<{
30
- step: z.ZodNumber;
31
- action: z.ZodString;
32
- expected: z.ZodString;
33
- actual: z.ZodOptional<z.ZodString>;
34
- }, z.core.$strip>>>;
35
- evidence_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
36
- test_case_id: z.ZodOptional<z.ZodString>;
37
- threat_finding_id: z.ZodOptional<z.ZodString>;
38
- };
39
- export declare function createRecordTestResultHandler(apiClient: ApiClient): (params: {
40
- session_id: string;
41
- test_name: string;
42
- result: string;
43
- test_description?: string;
44
- severity?: string;
45
- findings?: string;
46
- steps_performed?: Array<{
47
- step: number;
48
- action: string;
49
- expected: string;
50
- actual?: string;
51
- }>;
52
- evidence_ids?: string[];
53
- test_case_id?: string;
54
- threat_finding_id?: string;
55
- }) => Promise<{
56
- content: {
57
- type: "text";
58
- text: string;
59
- }[];
60
- isError?: undefined;
61
- } | {
62
- content: {
63
- type: "text";
64
- text: string;
65
- }[];
66
- isError: boolean;
67
- }>;
@@ -1,75 +0,0 @@
1
- /**
2
- * zivis_record_test_result — Record a test result in a pen test session
3
- *
4
- * Maps to: POST /api/pentest-sessions/:id/results
5
- */
6
- import { z } from "zod";
7
- import { sanitizeResponse } from "../../sanitize.js";
8
- export const RECORD_TEST_RESULT_NAME = "zivis_record_test_result";
9
- export const RECORD_TEST_RESULT_DESCRIPTION = `Record the result of a specific test within a pen test session.
10
-
11
- After running a manual test (e.g., SQL injection attempt, auth bypass), use this tool to log the outcome. If the test is linked to a threat model test case, the test case result will be updated automatically.
12
-
13
- Include evidence IDs from zivis_capture_evidence to link screenshots or terminal output to the result.`;
14
- export const RECORD_TEST_RESULT_SCHEMA = {
15
- session_id: z.string().describe("Pen test session UUID"),
16
- test_name: z.string().describe("Name of the test performed"),
17
- result: z
18
- .enum(["pass", "fail", "partial", "blocked", "not_tested"])
19
- .describe("Test result (pass = no vulnerability found, fail = vulnerability confirmed)"),
20
- test_description: z.string().optional().describe("Description of what was tested"),
21
- severity: z
22
- .enum(["critical", "high", "medium", "low", "info"])
23
- .optional()
24
- .describe("Severity if vulnerability found (typically set when result is 'fail')"),
25
- findings: z.string().optional().describe("Description of what was discovered"),
26
- steps_performed: z
27
- .array(z.object({
28
- step: z.number(),
29
- action: z.string(),
30
- expected: z.string(),
31
- actual: z.string().optional(),
32
- }))
33
- .optional()
34
- .describe("Steps performed during the test"),
35
- evidence_ids: z
36
- .array(z.string())
37
- .optional()
38
- .describe("Evidence UUIDs to link to this result (from zivis_capture_evidence)"),
39
- test_case_id: z.string().optional().describe("Threat model test case UUID (auto-updates the test case result)"),
40
- threat_finding_id: z.string().optional().describe("Existing threat finding UUID to link this result to"),
41
- };
42
- export function createRecordTestResultHandler(apiClient) {
43
- return async (params) => {
44
- try {
45
- const data = await apiClient.post(`/api/pentest-sessions/${params.session_id}/results`, {
46
- testName: params.test_name,
47
- result: params.result,
48
- testDescription: params.test_description,
49
- severity: params.severity,
50
- findings: params.findings,
51
- stepsPerformed: params.steps_performed,
52
- evidenceIds: params.evidence_ids,
53
- testCaseId: params.test_case_id,
54
- threatFindingId: params.threat_finding_id,
55
- });
56
- const sanitized = sanitizeResponse(data);
57
- return {
58
- content: [
59
- {
60
- type: "text",
61
- text: JSON.stringify(sanitized, null, 2),
62
- },
63
- ],
64
- };
65
- }
66
- catch (err) {
67
- const message = err instanceof Error ? err.message : "Failed to record test result";
68
- return {
69
- content: [{ type: "text", text: `Error: ${message}` }],
70
- isError: true,
71
- };
72
- }
73
- };
74
- }
75
- //# sourceMappingURL=record-test-result.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"record-test-result.js","sourceRoot":"","sources":["../../../src/tools/enterprise/record-test-result.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;uGAIyD,CAAC;AAExG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC5D,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;SAC1D,QAAQ,CAAC,6EAA6E,CAAC;IAC1F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAClF,QAAQ,EAAE,CAAC;SACR,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC9E,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC;SACF,QAAQ,EAAE;SACV,QAAQ,CAAC,iCAAiC,CAAC;IAC9C,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC/G,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACzG,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,SAAoB;IAChE,OAAO,KAAK,EAAE,MAWb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,yBAAyB,MAAM,CAAC,UAAU,UAAU,EACpD;gBACE,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,gBAAgB;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,UAAU,EAAE,MAAM,CAAC,YAAY;gBAC/B,eAAe,EAAE,MAAM,CAAC,iBAAiB;aAC1C,CACF,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACpF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
@@ -1,35 +0,0 @@
1
- /**
2
- * zivis_start_pentest_session — Start a manual pen test session
3
- *
4
- * Maps to: POST /api/pentest-sessions
5
- */
6
- import { z } from "zod";
7
- import type { ApiClient } from "../../api-client.js";
8
- export declare const START_PENTEST_SESSION_NAME = "zivis_start_pentest_session";
9
- export declare const START_PENTEST_SESSION_DESCRIPTION = "Start a new manual pen test session. This creates a tracking record for your pen testing work in Claude Code.\n\nOptionally link the session to a threat model and/or campaign for organizational context. Test results recorded during this session will be tracked and can be published to the agent test case library.\n\nReturns the session ID which you'll need for recording test results and ending the session.";
10
- export declare const START_PENTEST_SESSION_SCHEMA: {
11
- name: z.ZodString;
12
- tester_name: z.ZodString;
13
- description: z.ZodOptional<z.ZodString>;
14
- threat_model_id: z.ZodOptional<z.ZodString>;
15
- campaign_id: z.ZodOptional<z.ZodString>;
16
- };
17
- export declare function createStartPentestSessionHandler(apiClient: ApiClient): (params: {
18
- name: string;
19
- tester_name: string;
20
- description?: string;
21
- threat_model_id?: string;
22
- campaign_id?: string;
23
- }) => Promise<{
24
- content: {
25
- type: "text";
26
- text: string;
27
- }[];
28
- isError?: undefined;
29
- } | {
30
- content: {
31
- type: "text";
32
- text: string;
33
- }[];
34
- isError: boolean;
35
- }>;