@zivis/mcp 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/pattern-packs/zivis-public-0.1.0/capsules/security/late-org-filter.yaml

@@ -0,0 +1,266 @@
+# Capsule: Late org-filter — cross-tenant leak via presentation-time scoping
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: security.late-org-filter
+slug: late-org-filter
+version: 0.1.0
+category: security
+title: Late Org Filter
+headline: Tenant Scoping Applied After the Query, Not Inside It
+description: >
+  Detects multi-tenant code paths where org/tenant filtering happens at the
+  presentation layer (response loop, stream emit, response shaping) instead
+  of inside the data query. Any race, error path, or partial response that
+  reaches the wire before the filter fires leaks rows across tenants.
+
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+  - go
+
+relevance_filter:
+  any_of:
+    - dependency: express
+      direct_only: true
+    - dependency: fastify
+      direct_only: true
+    - dependency: hono
+      direct_only: true
+    - dependency: "@nestjs/core"
+      direct_only: true
+    - dependency: fastapi
+      direct_only: true
+    - dependency: flask
+      direct_only: true
+    - dependency: "django"
+      direct_only: true
+    - dependency: "github.com/gin-gonic/gin"
+      direct_only: true
+    - dependency: "github.com/labstack/echo/v4"
+      direct_only: true
+  none_of:
+    # If the project clearly isn't multi-tenant, skip — no benefit, lots of noise.
+    - evidence: "single_tenant_only_marker"
+
+strategies:
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          # Filter applied to a query result then sent — classic shape.
+          - pattern: $ROWS.filter($_ => $_.orgId === $$$)
+          - pattern: $ROWS.filter($_ => $_.org_id === $$$)
+          - pattern: $ROWS.filter($_ => $_.tenantId === $$$)
+          # Per-row tenant guard inside a loop — the SSE / iterator variant.
+          - pattern: |
+              if ($R.orgId === $$$) {
+                $$$
+              }
+          - pattern: |
+              if ($R.org_id === $$$) {
+                $$$
+              }
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        any:
+          - pattern: |
+              rows = $QUERY($$$)
+              filtered = [r for r in rows if r.org_id == $REQ.org_id]
+          - pattern: |
+              for row in $QUERY($$$):
+                if row.org_id == request.org_id:
+                  yield row
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: GRAPH
+    expression: |
+      query_call_returns_rows
+      AND filter_predicate_references(req_org_id OR session_org_id)
+      AND filter_executes_AFTER(query_call) IN response_handler_or_stream_emit
+      AND query_call.where_clause DOES_NOT include org_id
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.30
+
+  - code: META
+    expression:
+      none_of_controls:
+        - row_level_security_policy
+        - prisma_extension_or_middleware_attaching_org_filter
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.20
+
+  - code: INFER
+    expression: prompt_id:security.late-org-filter.identify
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 2
+
+control_negations:
+  - "presence_of(row_level_security_policy)"
+  - "presence_of(query_helper_with_implicit_org_scope)"
+  - "presence_of(prisma_extension_or_middleware_attaching_org_filter)"
+
+threats:
+  - title: Cross-tenant data leak via SSE / stream pre-filter window
+    stride: [information_disclosure, elevation_of_privilege]
+    description: >
+      In a streaming or async-iterator response, the underlying query returns
+      rows from all tenants and the per-emit filter rejects mismatches. A
+      brief window where rows are buffered, logged, traced, or partially
+      rendered before the filter executes can leak data across tenants. This
+      is the SSE / queue/stream variant of the pattern.
+    remediation: >
+      Push the org/tenant predicate into the data layer — RLS, query helpers,
+      ORM middleware. Make every query mandatorily org-scoped at the boundary;
+      treat presentation-layer filters as defense in depth, never the primary
+      barrier.
+  - title: Cross-tenant leak via error path or partial response
+    stride: [information_disclosure]
+    description: >
+      An exception inside the post-query filter loop returns the unfiltered
+      buffer or a serialization mid-state. Other tenants' rows reach the
+      wire because the only org check sits past the failure point.
+    remediation: >
+      Same control — RLS or query-time scoping. Plus: serialize the response
+      body only after filtering completes; on filter error, return a
+      structured error with no payload.
+  - title: Logged or traced rows expose other tenants
+    stride: [information_disclosure, repudiation]
+    description: >
+      Observability hooks (request logger, tracer, metrics) often capture the
+      raw query result before the presentation-layer filter runs. Other
+      tenants' identifiers, names, or PII land in logs the requesting tenant
+      should never have seen.
+    remediation: >
+      Either log only post-filter results, or — better — make the query
+      itself org-scoped so the unfiltered result never exists.
+
+fixtures:
+  positive:
+    - "fixtures/positive/late-org-filter/express_sse_post_filter_typescript"
+    - "fixtures/positive/late-org-filter/fastapi_iterator_post_filter_python"
+  negative:
+    - "fixtures/negative/late-org-filter/prisma_middleware_org_scope"
+    - "fixtures/negative/late-org-filter/postgres_rls_enabled"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - multi-tenant
+  - cross-tenant-leak
+  - data-scoping
+  - sse
+  - stream
+
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Tenant filtering applied after the query — at the response loop, the SSE
+  emit, or the stream iterator — instead of inside the query. Any error,
+  race, observability hook, or partial response that fires before the filter
+  reaches the wire leaks rows across tenants. The fix is to push org/tenant
+  scoping down to the data layer (RLS, query helpers, ORM middleware) so the
+  unfiltered set never exists in the first place.
+
+detect_when: >
+  A handler, stream, or async iterator runs a data query, then filters the
+  result by `request.orgId` (or a session org) before responding — and the
+  query itself doesn't include the org predicate. Multi-tenant routes only.
+
+risk_hints:
+  - The bug class behind a meaningful share of cross-tenant SaaS incidents
+  - SSE / queue / WebSocket variants are the hardest to spot because the filter looks "inside" the loop
+  - Logs and traces often capture the unfiltered set even when the response itself is clean
+  - Tests often pass because they only run with a single tenant in the test database
+
+architectural_signals:
+  - Query call followed by an explicit filter referencing a request/session org id
+  - SSE or async iterator that yields events conditional on a tenant match
+  - No row-level security policy, no implicit-org-scope helper, no ORM middleware
+
+model_task_prompt_ref: prompts/security/late-org-filter/identify.md
+
+expected_output_schema:
+  type: object
+  required: [verdict, scope_location, evidence_spans]
+  properties:
+    verdict:
+      type: string
+      enum: [late_filter_present, scoped_at_query, partial_scope, unclear]
+    scope_location:
+      type: string
+      enum: [data_layer, query_layer, presentation_layer, multiple, none]
+    rationale:
+      type: string
+    blast_radius:
+      type: string
+      enum: [single_endpoint, route_family, service_wide, unclear]
+    recommended_controls:
+      type: array
+      items:
+        type: string
+        enum: [row_level_security, query_helper, orm_middleware, repository_pattern_with_org_scope, none]
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 100
+  symbols:
+    - orgId
+    - org_id
+    - tenant_id
+    - filter
+    - SSE
+    - stream
+
+related_patterns:
+  - security.idor-via-direct-id
+  - security.broken-object-level-authz
+
+repair_contract:
+  allowed:
+    - Push org/tenant scoping into the query (where clause, RLS, ORM middleware)
+    - Introduce a repository wrapper that mandates org_id on every method
+    - Add a Postgres row-level security policy
+    - Keep the presentation-layer filter as defense in depth IN ADDITION TO the data-layer scope
+  forbidden:
+    - Removing the presentation-layer filter without first introducing a data-layer scope (regresses safety)
+    - Treating the patch as complete after only fixing the immediate route — the bug class is structural
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - data_layer_org_scope_present_after_patch
+    - no_unscoped_query_remains_in_route_handler
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates

package/dist/pattern-packs/zivis-public-0.1.0/controls/external_validator_on_facts.yaml

@@ -0,0 +1,37 @@
+# Control: external_validator_on_facts
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#
+# An external (non-LLM) check that the aggregated answer is factually
+# consistent — a SQL query, an API call, a regex against ground truth, etc.
+
+id: external_validator_on_facts
+description: >
+  An external, non-LLM check applied to the aggregated answer before it's
+  acted on. Common shapes: factCheck()/validateFacts() helpers, schema
+  validation, lookup against a trusted store.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        - pattern: factCheck($$$)
+        - pattern: validateFacts($$$)
+        - pattern: validateAnswer($$$)
+        - pattern: $_.factCheck($$$)
+        - pattern: $_.validate($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: fact_check($$$)
+        - pattern: validate_facts($$$)
+        - pattern: validate_answer($$$)
+        - pattern: $_.validate_against_ground_truth($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/controls/human_approval_gate.yaml

@@ -0,0 +1,44 @@
+# Control: human_approval_gate
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#   - agents.privilege-separation (potential — high-impact tool dispatch)
+#
+# Defines what "the codebase has a human-in-the-loop approval before
+# committing a high-impact action" looks like. Detection is intentionally
+# fuzzy — we'd rather over-detect approval gates (and miss firing META)
+# than under-detect (and fire false-positive findings).
+
+id: human_approval_gate
+description: >
+  Detects code that pauses execution to wait for human approval before
+  committing a high-impact action. Common shapes: humanInTheLoop helpers,
+  LangGraph interrupts, await-on-approval queue reads, request-confirmation
+  prompts.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        - pattern: humanInTheLoop($$$)
+        - pattern: humanApproval($$$)
+        - pattern: requireApproval($$$)
+        - pattern: await $_.waitForApproval($$$)
+        - pattern: await $_.awaitApproval($$$)
+        - pattern: $_.interrupt($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: human_in_the_loop($$$)
+        - pattern: human_approval($$$)
+        - pattern: require_approval($$$)
+        - pattern: wait_for_user($$$)
+        - pattern: await_approval($$$)
+        - pattern: $_.interrupt($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/controls/langgraph_state_machine_with_per_node_tools.yaml

@@ -0,0 +1,35 @@
+# Control: langgraph_state_machine_with_per_node_tools
+# Referenced by:
+#   - agents.privilege-separation (META: none_of_controls)
+#
+# LangGraph's idiom for privilege separation: a StateGraph with multiple
+# nodes, each binding a different (smaller) tool set. When present, the
+# capsule's anti-pattern (one shared tool list) is mitigated.
+
+id: langgraph_state_machine_with_per_node_tools
+description: >
+  LangGraph StateGraph with multiple add_node calls — each node typically
+  binds its own tools. Even imperfect detection of LangGraph node-graph
+  construction is enough to suppress the capsule's META rule, since the
+  customer is clearly using the right idiom.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: python
+    rule:
+      any:
+        - pattern: $_.add_node($$$)
+        - pattern: StateGraph($$$)
+        - pattern: builder.add_node($$$)
+  - language: typescript
+    rule:
+      any:
+        - pattern: $_.addNode($$$)
+        - pattern: new StateGraph($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/controls/per_sample_retrieval_diversification.yaml

@@ -0,0 +1,38 @@
+# Control: per_sample_retrieval_diversification
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#
+# Different samples in a self-consistency loop pull from different
+# retrieval queries / different stores / different rerank seeds, instead
+# of all sharing the same RAG context.
+
+id: per_sample_retrieval_diversification
+description: >
+  When a self-consistency aggregator pulls retrieval per-sample from
+  varied queries (i.e. retrieval is INSIDE the per-sample lambda, not
+  hoisted above the loop). The shape is a .map over generation function
+  that itself contains a similaritySearch / vectorStore call.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      pattern: $_.similaritySearch($$$)
+      inside:
+        stopBy: end
+        any:
+          - pattern: $_.map($$$)
+          - kind: for_statement
+  - language: python
+    rule:
+      pattern: $_.similarity_search($$$)
+      inside:
+        stopBy: end
+        kind: for_statement
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/controls/prisma_extension_or_middleware_attaching_org_filter.yaml

@@ -0,0 +1,31 @@
+# Control: prisma_extension_or_middleware_attaching_org_filter
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# A Prisma extension (or legacy $use middleware) that automatically appends
+# a where-clause scoping every query by org/tenant. When present, the
+# late-filter pattern is defense in depth, not the primary control.
+
+id: prisma_extension_or_middleware_attaching_org_filter
+description: >
+  Prisma client extension (post-5.x) or legacy $use middleware that injects
+  org/tenant scoping into every query. Detected by the call shape that
+  registers the extension/middleware referencing org_id, orgId, or tenant_id.
+
+applicable_languages:
+  - typescript
+  - javascript
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Modern Prisma client extension intercepting query operations
+        - pattern: "$_.$$extends({ query: $$$ })"
+        - pattern: "prisma.$$extends($$$)"
+        # Legacy Prisma middleware
+        - pattern: "$_.$$use($$$)"
+        - pattern: "prisma.$$use($$$)"
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/controls/row_level_security_policy.yaml

@@ -0,0 +1,37 @@
+# Control: row_level_security_policy
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# Detection of Postgres RLS policies in the codebase — either authored as
+# SQL migration text inside a string literal, or invoked via session GUC
+# setters that scope the connection by tenant.
+
+id: row_level_security_policy
+description: >
+  Postgres row-level security policy authored in the codebase, or session
+  GUCs that scope a connection by tenant for the duration of a request.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # SET LOCAL app.org_id pattern (per-request connection scoping)
+        - pattern: $_.$$queryRaw`SET LOCAL $$$`
+        - pattern: $_.$$executeRaw`SET LOCAL $$$`
+        # Common helpers
+        - pattern: setRlsContext($$$)
+        - pattern: setOrgContext($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: $_.execute("SET LOCAL $$$")
+        - pattern: set_rls_context($$$)
+        - pattern: set_org_context($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.1.0/manifest.json

@@ -0,0 +1,129 @@
+{
+  "schema_version": "1.0.0",
+  "pack_id": "zivis-public",
+  "pack_name": "ZIVIS Public Pattern Pack",
+  "version": "0.1.0",
+  "built_at": "2026-05-07T12:24:59.867Z",
+  "tier": "customer_safe",
+  "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
+  "capsules": [
+    {
+      "id": "agents.privilege-separation",
+      "version": "0.1.0",
+      "path": "capsules/agents/privilege-separation.yaml",
+      "sha256": "716f9c766add6f51eac2568eefc328a030901520cf0d3098ed577651c98773ea",
+      "category": "agents",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prompting.self-consistency-no-isolation",
+      "version": "0.1.0",
+      "path": "capsules/prompting/self-consistency-no-isolation.yaml",
+      "sha256": "e1b11e02f7d13cfaeb8ed7f8ae7cae05062bcf8e6fbb226eed75e8bf7fa6e8d1",
+      "category": "prompting",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "security.late-org-filter",
+      "version": "0.1.0",
+      "path": "capsules/security/late-org-filter.yaml",
+      "sha256": "aeb9b327be936770ea6d208f6e687ae095a79976770e47b27ce5c97df3e43a3b",
+      "category": "security",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python",
+        "go"
+      ]
+    }
+  ],
+  "prompts": [
+    {
+      "path": "prompts/agents/privilege-separation/identify.md",
+      "sha256": "eda7d288f9d1c6f7dfc18d2856300df76e8c4fdb5f18f3490f39ddf7117853e4",
+      "capsule_id": "agents.privilege-separation"
+    },
+    {
+      "path": "prompts/prompting/self-consistency-no-isolation/identify.md",
+      "sha256": "e05ffb777550a2a79b3c5b8e75d3e3c7fb2da2cd43ab0fcf202a9eda0f29c10f",
+      "capsule_id": "prompting.self-consistency-no-isolation"
+    },
+    {
+      "path": "prompts/security/late-org-filter/identify.md",
+      "sha256": "8e602179572ace5d457f8582b67e9d6ab29c675e82964481848c95e5ccb83e1e",
+      "capsule_id": "security.late-org-filter"
+    }
+  ],
+  "controls": [
+    {
+      "id": "external_validator_on_facts",
+      "path": "controls/external_validator_on_facts.yaml",
+      "sha256": "17ec428bf4cfc55b9f464d5c34e7a1ccc854a6c5822e1a4f6848db53ab3bccce",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "human_approval_gate",
+      "path": "controls/human_approval_gate.yaml",
+      "sha256": "ccafcb0bbf0fc68bb02fd018f87a870471fa4653363459293a24f0a65dc53b99",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "langgraph_state_machine_with_per_node_tools",
+      "path": "controls/langgraph_state_machine_with_per_node_tools.yaml",
+      "sha256": "29b46ad213173c52b5d96f744d74179193e61a6dc9c43e6b0b94b013ec94a32c",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "per_sample_retrieval_diversification",
+      "path": "controls/per_sample_retrieval_diversification.yaml",
+      "sha256": "9b4db7c6d620f46e93887f793a3e77bdabe280521b5ce0320d84d0c6b31ae653",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prisma_extension_or_middleware_attaching_org_filter",
+      "path": "controls/prisma_extension_or_middleware_attaching_org_filter.yaml",
+      "sha256": "196676bebd107c4345a5f9227380982e5e2da0f2a8ad87e48517b5bd924abc31",
+      "applicable_languages": [
+        "typescript",
+        "javascript"
+      ]
+    },
+    {
+      "id": "row_level_security_policy",
+      "path": "controls/row_level_security_policy.yaml",
+      "sha256": "42d2a6f561a89b6dae80f04e25c65081fb22b660a59920e1f5c0ed438f394c68",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    }
+  ]
+}

package/dist/pattern-packs/zivis-public-0.1.0/prompts/agents/privilege-separation/identify.md

@@ -0,0 +1,54 @@
+# Inference prompt: agents.privilege-separation — identify
+
+You are assisting with secure agentic-AI architecture review. The user is
+working on a codebase that has been flagged by deterministic detectors as
+*possibly* lacking privilege separation between agents. Your job is to
+look at the attached code context and produce a structured verdict.
+
+## Pattern definition
+
+**Privilege separation** means each agent in a multi-agent system is bound
+only to the minimum tools required for its role. The anti-pattern is a
+single shared tool registry that every agent inherits.
+
+## What you are evaluating
+
+1. Does the code construct two or more agents (or two or more entry points
+   that invoke the same agent factory) with a **shared** tool array?
+2. Is there a per-agent capability filter, authorization layer, or
+   capability-token check between an agent and its tool dispatch? If so,
+   the pattern does *not* fire even when tools appear shared.
+3. If LangGraph is used: are tools bound per node (good), or is one tool
+   list passed to a top-level `create_react_agent` covering every node
+   (anti-pattern)?
+
+## What does NOT count as privilege separation
+
+- Comments mentioning least privilege without code enforcing it.
+- A shared tool list with one agent renamed at runtime.
+- Defensive prompt instructions ("don't use the database tool unless…")
+  — prompts are not authorization.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "absent | present | unclear",
+  "confidence": 0.0,
+  "rationale": "one paragraph",
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `verdict: absent` — the anti-pattern fires (shared registry, no scoping).
+- `verdict: present` — privilege separation is correctly implemented.
+- `verdict: unclear` — the available context is ambiguous; do not guess.
+
+Cite line numbers from the snippet only. Do not invent files. Do not
+fabricate evidence. If a concept (e.g. "authorization layer") is mentioned
+but you cannot identify the line that implements it, mark `unclear` and
+explain.