@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.28

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-05-15T20:22:45.915Z",
+  "built_at": "2026-05-17T13:05:28.291Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/server.js

@@ -64,6 +64,10 @@ import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createIn
 import { LIST_APPLICATIONS_NAME, LIST_APPLICATIONS_DESCRIPTION, LIST_APPLICATIONS_SCHEMA, createListApplicationsHandler, } from "./tools/list-applications.js";
 import { GET_APPLICATION_NAME, GET_APPLICATION_DESCRIPTION, GET_APPLICATION_SCHEMA, createGetApplicationHandler, } from "./tools/get-application.js";
 import { GET_APPLICATION_OVERVIEW_NAME, GET_APPLICATION_OVERVIEW_DESCRIPTION, GET_APPLICATION_OVERVIEW_SCHEMA, createGetApplicationOverviewHandler, } from "./tools/get-application-overview.js";
+import { THREAT_OVERVIEW_NAME, THREAT_OVERVIEW_DESCRIPTION, THREAT_OVERVIEW_SCHEMA, createThreatOverviewHandler, } from "./tools/threat-overview.js";
+import { LIST_SIGNALS_NAME, LIST_SIGNALS_DESCRIPTION, LIST_SIGNALS_SCHEMA, createListSignalsHandler, } from "./tools/list-signals.js";
+import { GET_SIGNAL_NAME, GET_SIGNAL_DESCRIPTION, GET_SIGNAL_SCHEMA, createGetSignalHandler, } from "./tools/get-signal.js";
+import { LIST_CHANGES_SINCE_NAME, LIST_CHANGES_SINCE_DESCRIPTION, LIST_CHANGES_SINCE_SCHEMA, createListChangesSinceHandler, } from "./tools/list-changes-since.js";
 import { LIST_ENDPOINTS_NAME, LIST_ENDPOINTS_DESCRIPTION, LIST_ENDPOINTS_SCHEMA, createListEndpointsHandler, } from "./tools/list-endpoints.js";
 import { IMPORT_OPENAPI_ENDPOINTS_NAME, IMPORT_OPENAPI_ENDPOINTS_DESCRIPTION, IMPORT_OPENAPI_ENDPOINTS_SCHEMA, createImportOpenApiEndpointsHandler, } from "./tools/import-openapi-endpoints.js";
 import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHEMA, createUpdateEndpointHandler, } from "./tools/update-endpoint.js";
@@ -187,6 +191,22 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: GET_APPLICATION_OVERVIEW_DESCRIPTION,
         inputSchema: GET_APPLICATION_OVERVIEW_SCHEMA,
     }, createGetApplicationOverviewHandler(apiClient));
+    server.registerTool(THREAT_OVERVIEW_NAME, {
+        description: THREAT_OVERVIEW_DESCRIPTION,
+        inputSchema: THREAT_OVERVIEW_SCHEMA,
+    }, createThreatOverviewHandler(apiClient));
+    server.registerTool(LIST_SIGNALS_NAME, {
+        description: LIST_SIGNALS_DESCRIPTION,
+        inputSchema: LIST_SIGNALS_SCHEMA,
+    }, createListSignalsHandler(apiClient));
+    server.registerTool(GET_SIGNAL_NAME, {
+        description: GET_SIGNAL_DESCRIPTION,
+        inputSchema: GET_SIGNAL_SCHEMA,
+    }, createGetSignalHandler(apiClient));
+    server.registerTool(LIST_CHANGES_SINCE_NAME, {
+        description: LIST_CHANGES_SINCE_DESCRIPTION,
+        inputSchema: LIST_CHANGES_SINCE_SCHEMA,
+    }, createListChangesSinceHandler(apiClient));
     server.registerTool(LIST_ENDPOINTS_NAME, {
         description: LIST_ENDPOINTS_DESCRIPTION,
         inputSchema: LIST_ENDPOINTS_SCHEMA,

package/dist/tools/get-signal.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const GET_SIGNAL_NAME = "zivis_get_signal";
+export declare const GET_SIGNAL_DESCRIPTION = "Get full detail on a single Signal by its id.\n\nReturns the qualified narrative \u2014 description, mitigation, attack-chain context, taxonomy (STRIDE / ATPS layer / MITRE / OWASP / compliance mappings), detected safeguards and what breaks them, and the polymorphic source-artifact reference for drilling into the native subsystem.\n\nPass `signal_id` from a `zivis_list_signals` response.\n\nSECURITY: Display-shaped output only. No raw graph data.";
+export declare const GET_SIGNAL_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    signal_id: z.ZodString;
+};
+export declare function createGetSignalHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    signal_id: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/get-signal.js

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const GET_SIGNAL_NAME = "zivis_get_signal";
+export const GET_SIGNAL_DESCRIPTION = `Get full detail on a single Signal by its id.
+
+Returns the qualified narrative — description, mitigation, attack-chain context, taxonomy (STRIDE / ATPS layer / MITRE / OWASP / compliance mappings), detected safeguards and what breaks them, and the polymorphic source-artifact reference for drilling into the native subsystem.
+
+Pass \`signal_id\` from a \`zivis_list_signals\` response.
+
+SECURITY: Display-shaped output only. No raw graph data.`;
+export const GET_SIGNAL_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json."),
+    signal_id: z
+        .string()
+        .describe("Opaque signal id (from zivis_list_signals)."),
+};
+export function createGetSignalHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        if (!params.signal_id) {
+            return {
+                content: [{ type: "text", text: "Error: signal_id is required" }],
+                isError: true,
+            };
+        }
+        const path = `/api/apps/${req.id}/signals/${encodeURIComponent(params.signal_id)}`;
+        try {
+            const s = await apiClient.get(path);
+            const result = {
+                id: s.id,
+                source: s.source,
+                severity: s.severity,
+                status: s.status,
+                confidence: s.confidence,
+                title: s.title,
+                description: s.description,
+                category: s.category,
+                attack_chain: s.attackChain
+                    ? {
+                        name: s.attackChain.chainName,
+                        step: `${s.attackChain.stepIndex}/${s.attackChain.totalSteps}`,
+                    }
+                    : null,
+                taxonomy: s.taxonomy ?? null,
+                components: s.components?.map((c) => c.name) ?? [],
+                refs: s.refs,
+                recommended_action: s.recommendedAction,
+                safeguards: s.safeguards ?? null,
+                fingerprint: s.fingerprint,
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load signal";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/list-changes-since.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const LIST_CHANGES_SINCE_NAME = "zivis_list_changes_since";
+export declare const LIST_CHANGES_SINCE_DESCRIPTION = "What changed in this app's threat model since the given version. Returns human-readable change cards (added / removed / edited components, scenarios, signals) \u2014 no raw graph deltas.\n\nUse this when the user asks:\n- \"what's new since I last looked\"\n- \"what changed since the last review\"\n- \"what's new since version X\"\n\nGet a `since_version_id` from `zivis_list_threat_model_versions` or from a prior overview call. Returns an empty list when nothing changed.";
+export declare const LIST_CHANGES_SINCE_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    since_version_id: z.ZodString;
+};
+export declare function createListChangesSinceHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    since_version_id: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/list-changes-since.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const LIST_CHANGES_SINCE_NAME = "zivis_list_changes_since";
+export const LIST_CHANGES_SINCE_DESCRIPTION = `What changed in this app's threat model since the given version. Returns human-readable change cards (added / removed / edited components, scenarios, signals) — no raw graph deltas.
+
+Use this when the user asks:
+- "what's new since I last looked"
+- "what changed since the last review"
+- "what's new since version X"
+
+Get a \`since_version_id\` from \`zivis_list_threat_model_versions\` or from a prior overview call. Returns an empty list when nothing changed.`;
+export const LIST_CHANGES_SINCE_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json."),
+    since_version_id: z
+        .string()
+        .describe("Opaque version token (from zivis_threat_overview or zivis_list_threat_model_versions)."),
+};
+export function createListChangesSinceHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        if (!params.since_version_id) {
+            return {
+                content: [
+                    { type: "text", text: "Error: since_version_id is required" },
+                ],
+                isError: true,
+            };
+        }
+        const path = `/api/apps/${req.id}/change-digest?since=${encodeURIComponent(params.since_version_id)}`;
+        try {
+            const data = await apiClient.get(path);
+            const result = {
+                total: data.length,
+                items: data.map((c) => ({
+                    kind: c.kind,
+                    title: c.title,
+                    narrative: c.narrative,
+                    component: c.componentName,
+                })),
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load change digest";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/list-signals.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const LIST_SIGNALS_NAME = "zivis_list_signals";
+export declare const LIST_SIGNALS_DESCRIPTION = "List the application's current Signals \u2014 the unified \"needs attention\" stream.\n\nA Signal is ZIVIS's promoted artifact that crosses source families (threat-model Observations, red-team / pen-test Findings, behavior-monitoring Behaviors / Patterns). Each Signal carries severity, status, the chain reference when applicable, and the source family discriminator.\n\nUse this when the user asks:\n- \"what are the open security issues\" / \"what threats does ZIVIS show\"\n- \"what's high or critical\" (filter by severity)\n- \"what's still open\" (filter by status)\n\nReturns display-shaped DTOs. `id` is an opaque token \u2014 pass to `zivis_get_signal` for detail.\n\nSECURITY: This is a low-cost read. Caller must be authorized for the application; cross-org reads return empty.";
+export declare const LIST_SIGNALS_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        open: "open";
+        in_progress: "in_progress";
+        resolved: "resolved";
+        dismissed: "dismissed";
+    }>>;
+};
+export declare function createListSignalsHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    severity?: string;
+    status?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/list-signals.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const LIST_SIGNALS_NAME = "zivis_list_signals";
+export const LIST_SIGNALS_DESCRIPTION = `List the application's current Signals — the unified "needs attention" stream.
+
+A Signal is ZIVIS's promoted artifact that crosses source families (threat-model Observations, red-team / pen-test Findings, behavior-monitoring Behaviors / Patterns). Each Signal carries severity, status, the chain reference when applicable, and the source family discriminator.
+
+Use this when the user asks:
+- "what are the open security issues" / "what threats does ZIVIS show"
+- "what's high or critical" (filter by severity)
+- "what's still open" (filter by status)
+
+Returns display-shaped DTOs. \`id\` is an opaque token — pass to \`zivis_get_signal\` for detail.
+
+SECURITY: This is a low-cost read. Caller must be authorized for the application; cross-org reads return empty.`;
+export const LIST_SIGNALS_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID (from zivis_list_applications). If omitted, uses applicationId from .zivis/project.json when set."),
+    severity: z
+        .enum(["critical", "high", "medium", "low", "info"])
+        .optional()
+        .describe("Filter by severity. Omit to return all."),
+    status: z
+        .enum(["open", "in_progress", "resolved", "dismissed"])
+        .optional()
+        .describe("Filter by wire status. Omit to return all."),
+};
+export function createListSignalsHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        const application_id = req.id;
+        const qs = new URLSearchParams();
+        if (params.severity)
+            qs.set("severity", params.severity);
+        if (params.status)
+            qs.set("status", params.status);
+        const path = `/api/apps/${application_id}/signals${qs.toString() ? `?${qs}` : ""}`;
+        try {
+            const data = await apiClient.get(path);
+            const result = {
+                total: data.length,
+                items: data.map((s) => ({
+                    id: s.id,
+                    source: s.source,
+                    severity: s.severity,
+                    status: s.status,
+                    confidence: s.confidence,
+                    title: s.title,
+                    category: s.category,
+                    attack_chain: s.attackChain
+                        ? {
+                            name: s.attackChain.chainName,
+                            step: `${s.attackChain.stepIndex}/${s.attackChain.totalSteps}`,
+                        }
+                        : null,
+                    components: s.components?.map((c) => c.name) ?? [],
+                    recommended_action: s.recommendedAction,
+                })),
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to list signals";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/threat-overview.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const THREAT_OVERVIEW_NAME = "zivis_threat_overview";
+export declare const THREAT_OVERVIEW_DESCRIPTION = "Get the application's current threat-model overview \u2014 severity counts, node counts by type (components / actors / attack scenarios / controls), and the most recent analysis-run metadata.\n\nThis is the \"ZIVIS, what did you find?\" entry point. Use it:\n- right after `zivis_check_repo` to confirm SIGNAL data landed\n- when the user asks \"what threats does ZIVIS know about?\" or \"what's the security state?\"\n- as the first call after a server-side analysis run completes\n\nReturns display-shaped data \u2014 no graph IDs, no enum strings. Versions are opaque tokens; pass them to `zivis_list_changes_since` to diff.\n\nSECURITY: This is a low-cost read. Safe to call repeatedly. The graph itself never leaves the platform; only the display projection does.";
+export declare const THREAT_OVERVIEW_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    version_id: z.ZodOptional<z.ZodString>;
+};
+export declare function createThreatOverviewHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    version_id?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/threat-overview.js

@@ -0,0 +1,81 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const THREAT_OVERVIEW_NAME = "zivis_threat_overview";
+export const THREAT_OVERVIEW_DESCRIPTION = `Get the application's current threat-model overview — severity counts, node counts by type (components / actors / attack scenarios / controls), and the most recent analysis-run metadata.
+
+This is the "ZIVIS, what did you find?" entry point. Use it:
+- right after \`zivis_check_repo\` to confirm SIGNAL data landed
+- when the user asks "what threats does ZIVIS know about?" or "what's the security state?"
+- as the first call after a server-side analysis run completes
+
+Returns display-shaped data — no graph IDs, no enum strings. Versions are opaque tokens; pass them to \`zivis_list_changes_since\` to diff.
+
+SECURITY: This is a low-cost read. Safe to call repeatedly. The graph itself never leaves the platform; only the display projection does.`;
+export const THREAT_OVERVIEW_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID (from zivis_list_applications). If omitted, uses applicationId from .zivis/project.json when set."),
+    version_id: z
+        .string()
+        .optional()
+        .describe("Optional opaque version token. When set, returns the overview as-of that captured GraphVersion. When omitted, returns current state."),
+};
+export function createThreatOverviewHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        const application_id = req.id;
+        const qs = params.version_id
+            ? `?versionId=${encodeURIComponent(params.version_id)}`
+            : "";
+        const path = `/api/apps/${application_id}/threat-model/overview${qs}`;
+        try {
+            const data = await apiClient.get(path);
+            const result = {
+                application_id: data.appId,
+                threat_model_id: data.threatModelId,
+                version: data.versionId
+                    ? {
+                        id: data.versionId,
+                        label: data.versionLabel,
+                        captured_at: data.capturedAt,
+                        analysis_status: data.analysisStatus,
+                        analyzed_at: data.analyzedAt,
+                    }
+                    : null,
+                node_counts: {
+                    components: data.componentCount,
+                    actors: data.actorCount,
+                    attack_scenarios: data.attackScenarioCount,
+                    controls: data.controlCount,
+                },
+                threat_counts: {
+                    total: data.totalThreats,
+                    critical: data.criticalCount,
+                    high: data.highCount,
+                    medium: data.mediumCount,
+                    low: data.lowCount,
+                },
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load threat overview";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.0-alpha.26",
+  "version": "0.1.0-alpha.28",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",