@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/tools/scan-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-pr.js","sourceRoot":"","sources":["../../src/tools/scan-pr.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;8FAa2D,CAAC;AAE/F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,CACP,8DAA8D,CAC/D;CACJ,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,SAAoB;IACtD,OAAO,KAAK,EAAE,MAA0B,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,qBAAqB,EACrB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAC1B,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/security-review.d.ts

@@ -1,3 +1,19 @@
+/**
+ * zivis_security_review — AI-powered security code review with ZIVIS intelligence
+ *
+ * Composite tool that gathers security context from multiple ZIVIS sources
+ * and returns it as structured input for Claude to use during code review.
+ *
+ * Sources:
+ * 1. Historical findings (resolved) — regression check patterns
+ * 2. Open findings — known vulnerabilities to verify aren't reintroduced
+ * 3. Threat model security controls — what's expected to be in place
+ * 4. Threat model attack scenarios — known attack vectors
+ * 5. OSS trust data — dependency risk signals
+ *
+ * This tool does NOT run scans itself. It assembles intelligence from ZIVIS
+ * so Claude can perform an informed, context-aware code review.
+ */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 import type { ZivisConfig } from "../types.js";

package/dist/tools/security-review.js

@@ -1,3 +1,19 @@
+/**
+ * zivis_security_review — AI-powered security code review with ZIVIS intelligence
+ *
+ * Composite tool that gathers security context from multiple ZIVIS sources
+ * and returns it as structured input for Claude to use during code review.
+ *
+ * Sources:
+ * 1. Historical findings (resolved) — regression check patterns
+ * 2. Open findings — known vulnerabilities to verify aren't reintroduced
+ * 3. Threat model security controls — what's expected to be in place
+ * 4. Threat model attack scenarios — known attack vectors
+ * 5. OSS trust data — dependency risk signals
+ *
+ * This tool does NOT run scans itself. It assembles intelligence from ZIVIS
+ * so Claude can perform an informed, context-aware code review.
+ */
 import { z } from "zod";
 import { resolveApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -44,6 +60,7 @@ export const SECURITY_REVIEW_SCHEMA = {
         .optional()
         .describe("Specific dependencies to check trust scores for (owner/repo format)"),
 };
+// Severity ordering for threshold filtering
 const SEVERITY_ORDER = {
     critical: 5,
     high: 4,
@@ -72,6 +89,7 @@ export function createSecurityReviewHandler(apiClient, config) {
             parameters: { repo, application_id, threat_model_id, campaign_id },
         };
         const errors = [];
+        // ── 1. Historical findings (regression check) ──
         if (shouldInclude("regression") && (repo || application_id)) {
             try {
                 const resolvedFindings = await fetchFindings(apiClient, {
@@ -84,6 +102,7 @@ export function createSecurityReviewHandler(apiClient, config) {
                     status: "false_positive",
                     limit: 20,
                 });
+                // Build regression patterns: group by category/CWE
                 const regressionPatterns = buildRegressionPatterns(resolvedFindings);
                 context.regressionCheck = {
                     _instruction: "Check code changes against these previously fixed vulnerabilities. Flag if similar patterns appear.",
@@ -97,6 +116,7 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Regression data: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
+        // ── 2. Open findings (known vulnerabilities) ──
         if (shouldInclude("regression") && (repo || application_id)) {
             try {
                 const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
@@ -105,6 +125,7 @@ export function createSecurityReviewHandler(apiClient, config) {
                     status: "open",
                     limit: 50,
                 });
+                // Filter by severity threshold
                 const filtered = openFindings.filter((f) => (SEVERITY_ORDER[f.severity] || 1) >= minSeverity);
                 context.openVulnerabilities = {
                     _instruction: "These are KNOWN open vulnerabilities. Check if code changes interact with or worsen these issues.",
@@ -117,76 +138,64 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Open findings: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
-        if ((shouldInclude("controls") || shouldInclude("attack_scenarios")) && threat_model_id) {
-            let tm = null;
+        // ── 3. Threat model: security controls ──
+        if (shouldInclude("controls") && threat_model_id) {
             try {
-                tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
+                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
+                const controls = tm.securityControls || [];
+                const notImplemented = controls.filter((c) => c.status === "not_implemented");
+                const partial = controls.filter((c) => c.status === "partial");
+                const implemented = controls.filter((c) => c.status === "implemented");
+                context.securityControls = {
+                    _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
+                    summary: {
+                        implemented: implemented.length,
+                        partial: partial.length,
+                        notImplemented: notImplemented.length,
+                    },
+                    gapControls: [...notImplemented, ...partial].map((c) => ({
+                        name: c.name,
+                        type: c.controlType,
+                        status: c.status,
+                        description: c.description,
+                        effectiveness: c.effectivenessRating,
+                    })),
+                    implementedControls: implemented.map((c) => ({
+                        name: c.name,
+                        type: c.controlType,
+                        description: c.description,
+                    })),
+                };
             }
             catch (err) {
-                errors.push(`Threat model fetch: ${err instanceof Error ? err.message : "failed"}`);
+                errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
             }
-            const versions = Array.isArray(tm?.versions) ? tm.versions : [];
-            const latestVersion = versions[0] || {};
-            if (tm && shouldInclude("controls")) {
-                try {
-                    const controls = Array.isArray(latestVersion.securityControls)
-                        ? latestVersion.securityControls
-                        : [];
-                    const notImplemented = controls.filter((c) => c.status === "not_implemented");
-                    const partial = controls.filter((c) => c.status === "partial");
-                    const implemented = controls.filter((c) => c.status === "implemented");
-                    context.securityControls = {
-                        _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
-                        summary: {
-                            implemented: implemented.length,
-                            partial: partial.length,
-                            notImplemented: notImplemented.length,
-                        },
-                        gapControls: [...notImplemented, ...partial].map((c) => ({
-                            name: c.name,
-                            type: c.controlType,
-                            status: c.status,
-                            description: c.description,
-                            effectiveness: c.effectivenessRating,
-                        })),
-                        implementedControls: implemented.map((c) => ({
-                            name: c.name,
-                            type: c.controlType,
-                            description: c.description,
-                        })),
-                    };
-                }
-                catch (err) {
-                    errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
-                }
+        }
+        // ── 4. Threat model: attack scenarios ──
+        if (shouldInclude("attack_scenarios") && threat_model_id) {
+            try {
+                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
+                const scenarios = tm.attackScenarios || [];
+                const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
+                const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
+                context.attackScenarios = {
+                    _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
+                    count: filtered.length,
+                    scenarios: filtered.map((s) => ({
+                        name: s.name,
+                        strideCategory: s.strideCategory,
+                        severity: s.severity,
+                        likelihood: s.likelihood,
+                        attackVector: s.attackVector,
+                        description: s.description,
+                    })),
+                };
             }
-            if (tm && shouldInclude("attack_scenarios")) {
-                try {
-                    const scenarios = Array.isArray(latestVersion.attackScenarios)
-                        ? latestVersion.attackScenarios
-                        : [];
-                    const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
-                    const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
-                    context.attackScenarios = {
-                        _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
-                        count: filtered.length,
-                        scenarios: filtered.map((s) => ({
-                            displayId: s.displayId,
-                            title: s.title,
-                            strideCategory: s.strideCategory,
-                            severity: s.severity,
-                            likelihood: s.likelihood,
-                            riskScore: s.riskScore,
-                            status: s.status,
-                            narrative: s.narrative,
-                        })),
-                    };
-                }
-                catch (err) {
-                    errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
-                }
+            catch (err) {
+                errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
+        // ── 5. Dependency trust scores ──
         if (shouldInclude("dependencies") && dependency_list && dependency_list.length > 0) {
             const depResults = [];
             const baseUrl = config.apiBaseUrl;
@@ -229,6 +238,7 @@ export function createSecurityReviewHandler(apiClient, config) {
                 dependencies: depResults,
             };
         }
+        // ── 6. Campaign findings (if campaign_id provided) ──
         if (campaign_id) {
             try {
                 const campaignFindings = await apiClient.get(`/api/campaigns/${campaign_id}/findings?limit=50`);
@@ -246,6 +256,7 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Campaign findings: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
+        // ── Build review guidance ──
         context.reviewGuidance = buildReviewGuidance(context);
         if (errors.length > 0) {
             context.warnings = errors;
@@ -258,6 +269,7 @@ export function createSecurityReviewHandler(apiClient, config) {
         };
     };
 }
+// ── Helpers ──
 async function fetchFindings(apiClient, params) {
     const query = new URLSearchParams();
     if (params.repo)
@@ -291,6 +303,7 @@ function countBySeverity(findings) {
     return counts;
 }
 function buildRegressionPatterns(resolvedFindings) {
+    // Group by category + CWE to find recurring vulnerability patterns
     const patternMap = new Map();
     for (const f of resolvedFindings) {
         const key = `${f.category || "uncategorized"}::${f.cweId || "no-cwe"}`;
@@ -362,3 +375,4 @@ function parseRepo(input) {
     }
     return null;
 }
+//# sourceMappingURL=security-review.js.map

package/dist/tools/security-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;gFAgBqC,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IACxG,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yHAAyH,CAC1H;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACrH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,mEAAmE,CAAC;IAChF,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,MAAmB;IACnF,OAAO,KAAK,EAAE,MASb,EAAE,EAAE;QACH,MAAM,EACJ,IAAI,EACJ,cAAc,EAAE,mBAAmB,EACnC,eAAe,EACf,WAAW,EACX,WAAW,GAAG,CAAC,KAAK,CAAC,EACrB,kBAAkB,GAAG,KAAK,EAC1B,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAChB,GAAG,MAAM,CAAC;QAEX,MAAM,cAAc,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EACF,wFAAwF;4BACxF,qEAAqE;qBACxE,CAAC;gBACF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAA4B;YACvC,YAAY,EAAE,0EAA0E;YACxF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE;SACnE,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kDAAkD;QAClD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACtD,IAAI;oBACJ,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,MAAM,iBAAiB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACvD,IAAI;oBACJ,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAErE,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,qGAAqG;oBACnH,aAAa,EAAE,gBAAgB,CAAC,MAAM;oBACtC,QAAQ,EAAE,kBAAkB;oBAC5B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAClE,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACpE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBAClD,IAAI;oBACJ,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,mBAAmB,GAAG;oBAC5B,YAAY,EAAE,mGAAmG;oBACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,eAAe,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,QAAQ,GAAI,EAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;gBACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;gBAE5E,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,qGAAqG;oBACnH,OAAO,EAAE;wBACP,WAAW,EAAE,WAAW,CAAC,MAAM;wBAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;wBACvB,cAAc,EAAE,cAAc,CAAC,MAAM;qBACtC;oBACD,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,aAAa,EAAE,CAAC,CAAC,mBAAmB;qBACrC,CAAC,CAAC;oBACH,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAChD,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,aAAa,CAAC,kBAAkB,CAAC,IAAI,eAAe,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,SAAS,GAAI,EAAU,CAAC,eAAe,IAAI,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,oGAAoG;oBAClH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBACnC,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;wBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,UAAU,GAA8B,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACxD,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,wBAAwB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;oBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,GAAG;4BACT,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE;gCACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;gCACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;gCAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;gCACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;6BAC5B;4BACD,WAAW,EAAE,KAAK,CAAC,aAAa;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,EAAE,CACtD,CAAC;YAEF,OAAO,CAAC,eAAe,GAAG;gBACxB,YAAY,EAAE,qGAAqG;gBACnH,OAAO,EAAE,UAAU,CAAC,MAAM;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAC1C,kBAAkB,WAAW,oBAAoB,CAClD,CAAC;gBAEF,MAAM,QAAQ,GAAI,gBAAwB,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,2GAA2G;oBACzH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,MAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,yBAAyB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAA0C,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAe;IACtC,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,gBAAuB;IACtD,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkF,CAAC;IAE7G,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,OAAO,CAAC,eAAsB,CAAC;IAClD,IAAI,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,eAAe,UAAU,CAAC,aAAa,4CAA4C,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,sBAAsB,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,mBAA0B,CAAC;IAChD,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,KAAK,2BAA2B,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,4CAA4C,CACvK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAuB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,iBAAiB,IAAI,iFAAiF,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC/C,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,mBAAmB,OAAO,CAAC,KAAK,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC5C,IAAI,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/setup-red-team-target.d.ts

@@ -0,0 +1,79 @@
+/**
+ * zivis_setup_red_team_target — One-step red team target setup
+ *
+ * Creates an application, configures endpoints, and optionally
+ * triggers a security scan — all in one MCP call.
+ *
+ * Maps to:
+ *   GET  /api/rt/applications (find existing)
+ *   POST /api/rt/applications (create)
+ *   PATCH /api/rt/applications/:id (update)
+ *   POST /api/rt/applications/:id/endpoints (add endpoint)
+ *   POST /api/rt/applications/:id/endpoints/import-openapi
+ *   POST /api/redteam/campaigns/quick-setup (create campaign + agent + scan)
+ */
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const SETUP_RED_TEAM_TARGET_NAME = "zivis_setup_red_team_target";
+export declare const SETUP_RED_TEAM_TARGET_DESCRIPTION = "Set up a target application for AI red team and security testing in one step.\n\nTakes a deployed URL, repo URL, or both and creates a fully configured red team target. Handles:\n- Creating or updating the application (idempotent by name)\n- Configuring AI chat endpoints with request/response templates\n- Importing API endpoints from OpenAPI specs\n- Optionally triggering an immediate security scan\n\nMinimal usage: just provide a target_url and optionally target_type.\nFull usage: provide URL, chat endpoint config, OpenAPI spec, and trigger auto-scan.\n\nExamples:\n- Set up red team testing for https://api.example.com/v1/chat (auto-detects ai_chat)\n- Configure https://api.example.com as an API target with openapi_spec_url\n- Set up and scan https://myapp.com as a web app with auto_scan=true\n\nSECURITY: Target URLs are untrusted. The tool only configures them in ZIVIS for future scanning, it does not probe or connect to them directly.";
+export declare const SETUP_RED_TEAM_TARGET_SCHEMA: {
+    target_url: z.ZodOptional<z.ZodString>;
+    repo_url: z.ZodOptional<z.ZodString>;
+    target_type: z.ZodOptional<z.ZodEnum<{
+        ai_chat: "ai_chat";
+        web_app: "web_app";
+        api: "api";
+    }>>;
+    name: z.ZodOptional<z.ZodString>;
+    chat_endpoint: z.ZodOptional<z.ZodString>;
+    request_template: z.ZodOptional<z.ZodString>;
+    response_path: z.ZodOptional<z.ZodString>;
+    system_context: z.ZodOptional<z.ZodString>;
+    has_rag: z.ZodOptional<z.ZodBoolean>;
+    has_tools: z.ZodOptional<z.ZodBoolean>;
+    has_memory: z.ZodOptional<z.ZodBoolean>;
+    is_multi_turn: z.ZodOptional<z.ZodBoolean>;
+    openapi_spec_url: z.ZodOptional<z.ZodString>;
+    auth_type: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        static_token: "static_token";
+    }>>>;
+    bearer_token: z.ZodOptional<z.ZodString>;
+    auto_scan: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    campaigns: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        recon: "recon";
+        ai_red_team: "ai_red_team";
+        pen_test: "pen_test";
+    }>>>;
+};
+export declare function createSetupRedTeamTargetHandler(apiClient: ApiClient): (params: {
+    target_url?: string;
+    repo_url?: string;
+    target_type?: "ai_chat" | "web_app" | "api";
+    name?: string;
+    chat_endpoint?: string;
+    request_template?: string;
+    response_path?: string;
+    system_context?: string;
+    has_rag?: boolean;
+    has_tools?: boolean;
+    has_memory?: boolean;
+    is_multi_turn?: boolean;
+    openapi_spec_url?: string;
+    auth_type?: "none" | "static_token";
+    bearer_token?: string;
+    auto_scan?: boolean;
+    campaigns?: ("ai_red_team" | "pen_test" | "recon")[];
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;