@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/tools/enterprise/manage-threat-model-review.js

@@ -1,72 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const MANAGE_THREAT_MODEL_REVIEW_NAME = "zivis_manage_threat_model_review";
-export const MANAGE_THREAT_MODEL_REVIEW_DESCRIPTION = `Accept or reject pending AI-generated threat model review items.
-
-Actions:
-- accept_item: accept one pending item
-- reject_item: reject one pending item
-- accept_all: accept all pending items
-- reject_all: reject all pending items`;
-export const MANAGE_THREAT_MODEL_REVIEW_SCHEMA = {
-    threat_model_id: z
-        .string()
-        .describe("Threat model UUID (from zivis_list_threat_models)"),
-    action: z
-        .enum(["accept_item", "reject_item", "accept_all", "reject_all"])
-        .describe("Review action"),
-    item_type: z
-        .enum(["finding", "asset", "scenario", "component"])
-        .optional()
-        .describe("Required for *_item actions"),
-    item_id: z
-        .string()
-        .optional()
-        .describe("Required for *_item actions"),
-};
-export function createManageThreatModelReviewHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, action } = params;
-            let data;
-            if (action === "accept_all") {
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/review-items/accept-all`, {});
-            }
-            else if (action === "reject_all") {
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/review-items/reject-all`, {});
-            }
-            else {
-                if (!params.item_type || !params.item_id) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "Error: item_type and item_id are required for accept_item/reject_item actions",
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                const verb = action === "accept_item" ? "accept" : "reject";
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/review-items/${params.item_type}/${params.item_id}/${verb}`, {});
-            }
-            const sanitized = sanitizeResponse({
-                action,
-                threat_model_id,
-                item_type: params.item_type,
-                item_id: params.item_id,
-                result: data,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage threat model review";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/get-started.d.ts

@@ -1,18 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-import type { ZivisConfig } from "../types.js";
-export declare const GET_STARTED_NAME = "zivis_get_started";
-export declare const GET_STARTED_DESCRIPTION = "Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or \"what should I do next.\" Idempotent and safe to call repeatedly \u2014 detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.\n\nUse this when the user says any of:\n- \"what should I do for security on this app\"\n- \"uhh, where do I start\"\n- \"is my app safe\" / \"is my chatbot safe\"\n- \"I need to do security stuff before launch\"\n- \"I have an audit / pen test / customer asking about security\"\n- \"check my dependencies / libraries / repos\"\n- \"how do I use ZIVIS\"\n- \"what can ZIVIS do for me\"\n\nThis tool inspects the current project state \u2014 binding, application, scans, findings \u2014\nAND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local\nthreat library against it to surface architectural patterns ZIVIS thinks may apply\n(self-consistency without context isolation, late org filter, privilege separation, etc.).\nThe 'relevant_threats' field in the response is what makes this tool different from a\ngeneric security menu: ZIVIS is reading the user's actual codebase via the graph\nartifact and naming threats by their architectural shape.\n\nAlways speak to the user in threat-model language: components, flows, trust boundaries,\nattack scenarios. Even when they don't yet know those terms \u2014 that's how they learn.\n\nOutput is a structured JSON object. Present recommended_next_steps as a numbered list\nto the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead\nwith that \u2014 it's the most concrete thing ZIVIS knows about their repo. Use the label\nand why fields verbatim; do not invent new steps. If the user is unsure which to pick,\nrecommend the item flagged in if_user_unsure.";
-export declare const GET_STARTED_SCHEMA: {
-    concern: z.ZodOptional<z.ZodString>;
-    cwd: z.ZodOptional<z.ZodString>;
-};
-export declare function createGetStartedHandler(apiClient: ApiClient, _config: ZivisConfig): (params: {
-    concern?: string;
-    cwd?: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;

package/dist/tools/get-started.js

@@ -1,470 +0,0 @@
-import * as fs from "node:fs/promises";
-import { z } from "zod";
-import { detectProjectBinding } from "../project-binding.js";
-import { loadActivePack, findRelevantCapsules, } from "../pattern-pack/index.js";
-import { locateLatestArtifact } from "../lib/inspect-cache.js";
-export const GET_STARTED_NAME = "zivis_get_started";
-export const GET_STARTED_DESCRIPTION = `Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or "what should I do next." Idempotent and safe to call repeatedly — detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.
-
-Use this when the user says any of:
-- "what should I do for security on this app"
-- "uhh, where do I start"
-- "is my app safe" / "is my chatbot safe"
-- "I need to do security stuff before launch"
-- "I have an audit / pen test / customer asking about security"
-- "check my dependencies / libraries / repos"
-- "how do I use ZIVIS"
-- "what can ZIVIS do for me"
-
-This tool inspects the current project state — binding, application, scans, findings —
-AND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local
-threat library against it to surface architectural patterns ZIVIS thinks may apply
-(self-consistency without context isolation, late org filter, privilege separation, etc.).
-The 'relevant_threats' field in the response is what makes this tool different from a
-generic security menu: ZIVIS is reading the user's actual codebase via the graph
-artifact and naming threats by their architectural shape.
-
-Always speak to the user in threat-model language: components, flows, trust boundaries,
-attack scenarios. Even when they don't yet know those terms — that's how they learn.
-
-Output is a structured JSON object. Present recommended_next_steps as a numbered list
-to the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead
-with that — it's the most concrete thing ZIVIS knows about their repo. Use the label
-and why fields verbatim; do not invent new steps. If the user is unsure which to pick,
-recommend the item flagged in if_user_unsure.`;
-export const GET_STARTED_SCHEMA = {
-    concern: z
-        .string()
-        .optional()
-        .describe("Free-form sentence describing what the user wants. " +
-        "Examples: 'is my chatbot safe', 'check the libraries we use', " +
-        "'audit coming up next month', 'just deployed a new API'. " +
-        "If omitted, returns a generic getting-started menu based on project state."),
-    cwd: z
-        .string()
-        .optional()
-        .describe("Working directory to inspect (defaults to server working directory)."),
-};
-const INTENT_MAP = [
-    {
-        patterns: /chatbot|llm|ai chat|assistant|agent|prompt injection|jailbreak|openai|anthropic|langchain|llamaindex|cohere|together/i,
-        intent: "ai_red_team",
-    },
-    {
-        patterns: /librar|dependenc|package|npm|pip|repo|crate|gem|module|import|third.?party/i,
-        intent: "dep_audit",
-    },
-    {
-        patterns: /audit|compliance|soc\s*2|iso\s*27001|fedramp|vendor questionnaire|customer ask|certif/i,
-        intent: "pre_audit",
-    },
-    {
-        patterns: /launch|deploy|release|production|go\s*live|prod|ship/i,
-        intent: "pre_launch",
-    },
-    {
-        patterns: /finding|issue|vulnerabilit|vuln|bug|report|result|scan result/i,
-        intent: "view_findings",
-    },
-];
-function detectIntent(concern) {
-    if (!concern)
-        return "generic";
-    for (const { patterns, intent } of INTENT_MAP) {
-        if (patterns.test(concern))
-            return intent;
-    }
-    return "generic";
-}
-function stepCheckDeps() {
-    return {
-        id: "check_dependencies",
-        label: "Check the open source libraries you depend on",
-        tool: "zivis_check_repo_trust",
-        why: "Free, no setup. Catches risky AI SDKs and known-bad dependencies before they cause problems.",
-        estimated_time: "1 minute per repo",
-        requires_auth: false,
-    };
-}
-function stepSetupAiTarget(hint) {
-    return {
-        id: "setup_ai_target",
-        label: "Tell ZIVIS about your chatbot or AI system so it can test it",
-        tool: "zivis_setup_red_team_target",
-        args_hint: { target_type: "ai_chat", ...hint },
-        why: "ZIVIS needs to know your endpoint to run prompt-injection, jailbreak, and PII-leakage tests.",
-        estimated_time: "2 minutes",
-        requires_auth: true,
-    };
-}
-function stepSetupWebTarget(hint) {
-    return {
-        id: "setup_web_target",
-        label: "Register your web app or API with ZIVIS for testing",
-        tool: "zivis_setup_red_team_target",
-        args_hint: { target_type: "web_app", ...hint },
-        why: "ZIVIS needs to know your app URL to run security tests against it.",
-        estimated_time: "2 minutes",
-        requires_auth: true,
-    };
-}
-function stepBrowseTests() {
-    return {
-        id: "browse_test_library",
-        label: "Browse what ZIVIS can test for",
-        tool: "zivis_list_test_scenarios",
-        why: "See the menu of attack categories (prompt injection, auth bypass, data leakage, etc.) before committing to a scan.",
-        estimated_time: "30 seconds",
-        requires_auth: true,
-    };
-}
-function stepViewFindings(count) {
-    return {
-        id: "view_open_findings",
-        label: count
-            ? `Review the ${count} open security issue${count === 1 ? "" : "s"} ZIVIS found`
-            : "Review open security issues ZIVIS found",
-        tool: "zivis_get_findings",
-        args_hint: { status: "open" },
-        why: "Look at what's been found already before starting new scans — no point duplicating work.",
-        estimated_time: "5 minutes",
-        requires_auth: true,
-    };
-}
-function stepRunSecurityReview() {
-    return {
-        id: "run_security_review",
-        label: "Get a security readiness summary before launch or audit",
-        tool: "zivis_security_review",
-        why: "Pulls together all open findings, past fixes, and known attack scenarios into one pre-launch checklist.",
-        estimated_time: "3 minutes",
-        requires_auth: true,
-    };
-}
-function stepSetupProject() {
-    return {
-        id: "setup_project",
-        label: "Connect this project to your ZIVIS org",
-        tool: "zivis_check_project",
-        why: "ZIVIS needs to know which org this project belongs to before it can run tests or store results.",
-        estimated_time: "2 minutes (run 'zivis auth init' in your terminal)",
-        requires_auth: false,
-    };
-}
-function stepInstallGitHubApp(installUrl) {
-    return {
-        id: "install_github_app",
-        label: "Install the ZIVIS GitHub App to enable continuous monitoring",
-        tool: "external_link",
-        args_hint: { url: installUrl },
-        why: "Linking a repo unlocks deeper analysis on every push — threat model updates automatically as architecture changes. Today this org has no GitHub App installation.",
-        estimated_time: "2 minutes",
-        requires_auth: false,
-    };
-}
-async function fetchState(apiClient, cwd) {
-    const detected = detectProjectBinding(cwd);
-    if (!detected) {
-        return {
-            bound: false,
-            has_application: false,
-            has_scans: false,
-            has_findings: false,
-            open_findings_count: 0,
-        };
-    }
-    const state = {
-        bound: true,
-        org_name: detected.binding.orgName,
-        has_application: false,
-        has_scans: false,
-        has_findings: false,
-        open_findings_count: 0,
-    };
-    try {
-        const appsResp = await apiClient.get("/api/rt/applications?limit=1");
-        if ((appsResp.applications?.length ?? 0) > 0 || (appsResp.total ?? 0) > 0) {
-            state.has_application = true;
-        }
-    }
-    catch {
-    }
-    try {
-        const scansResp = await apiClient.get("/api/rt/scans?limit=1");
-        if ((scansResp.scans?.length ?? 0) > 0) {
-            state.has_scans = true;
-        }
-    }
-    catch {
-    }
-    try {
-        const findingsResp = await apiClient.get("/api/findings/unified?status=open&limit=1");
-        const total = findingsResp.summary?.total ?? findingsResp.findings?.length ?? 0;
-        if (total > 0) {
-            state.has_findings = true;
-            state.open_findings_count = total;
-        }
-    }
-    catch {
-    }
-    try {
-        const gh = await apiClient.get("/api/github-app/status");
-        state.github_app_installed = gh.installed;
-        state.github_app_install_url = gh.installUrl;
-    }
-    catch {
-        state.github_app_installed = null;
-    }
-    return state;
-}
-function buildMenu(intent, state, concern) {
-    if (!state.bound) {
-        return {
-            headline: "Welcome to ZIVIS! First, let's connect this project to your organization so results are stored and tracked.",
-            recommended_next_steps: [
-                stepSetupProject(),
-                stepCheckDeps(),
-                stepBrowseTests(),
-            ],
-            guidance_for_assistant: "Present these as a numbered list. The user should run 'zivis auth init' in their terminal to complete step 1. " +
-                "Step 2 (check_dependencies) requires no auth and can be done immediately. " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 2 (check_dependencies) — it requires no setup and gives immediate results.",
-        };
-    }
-    if (state.has_findings && intent !== "dep_audit") {
-        const steps = [
-            stepViewFindings(state.open_findings_count),
-            stepCheckDeps(),
-        ];
-        if (!state.has_application) {
-            steps.push(stepSetupWebTarget());
-        }
-        else {
-            steps.push(stepBrowseTests());
-        }
-        return {
-            headline: `ZIVIS sees your project (${state.org_name ?? "connected"}) and has found ${state.open_findings_count} open security issue${state.open_findings_count === 1 ? "" : "s"}.`,
-            recommended_next_steps: steps,
-            guidance_for_assistant: "Present these as a numbered list. Prioritize reviewing existing findings before starting new scans. " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 1 (view_open_findings) — reviewing what's already known is the best first step.",
-        };
-    }
-    if (intent === "ai_red_team") {
-        const steps = [
-            stepSetupAiTarget(),
-            stepCheckDeps(),
-            stepBrowseTests(),
-        ];
-        return {
-            headline: state.has_application
-                ? `ZIVIS sees your project (${state.org_name ?? "connected"}) and has a target configured. Ready to test your AI system.`
-                : `ZIVIS sees your project (${state.org_name ?? "connected"}) but no security testing has run yet.`,
-            recommended_next_steps: steps,
-            guidance_for_assistant: "The user wants to test an AI/chatbot system. Present these as a numbered list. " +
-                "If they already have a target URL, include it in args_hint. " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 1 (setup_ai_target) — setting up the chatbot as a test target is the fastest path to finding real issues.",
-        };
-    }
-    if (intent === "dep_audit") {
-        return {
-            headline: "Checking your dependencies is a great place to start — it's free, needs no setup, and often finds the most impactful issues.",
-            recommended_next_steps: [
-                stepCheckDeps(),
-                stepSetupWebTarget(),
-                stepBrowseTests(),
-            ],
-            guidance_for_assistant: "Present these as a numbered list. For step 1, ask the user to share which packages they want to check " +
-                "(the GitHub org/repo of the dependency, e.g. openai/openai-python). " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 1 (check_dependencies) — it works right now with no setup.",
-        };
-    }
-    if (intent === "pre_audit" || intent === "pre_launch") {
-        const steps = [
-            stepRunSecurityReview(),
-            stepCheckDeps(),
-        ];
-        if (!state.has_application) {
-            steps.push(stepSetupWebTarget());
-        }
-        else {
-            steps.push(stepBrowseTests());
-        }
-        const headline = intent === "pre_audit"
-            ? `ZIVIS can help you prepare for an audit. Let's get a security readiness picture first.`
-            : `ZIVIS can help you check security before you go live.`;
-        return {
-            headline,
-            recommended_next_steps: steps,
-            guidance_for_assistant: "The user has a deadline (audit or launch). Start with a security review to understand the current state, " +
-                "then address the highest-severity issues first. " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 1 (run_security_review) — it gives the fastest complete picture and shows what needs to be fixed before the deadline.",
-        };
-    }
-    if (intent === "view_findings") {
-        return {
-            headline: state.has_findings
-                ? `ZIVIS has ${state.open_findings_count} open finding${state.open_findings_count === 1 ? "" : "s"} for this project.`
-                : `No open findings found yet — ZIVIS may not have run a scan, or all issues are resolved.`,
-            recommended_next_steps: [
-                stepViewFindings(state.open_findings_count > 0 ? state.open_findings_count : undefined),
-                state.has_application ? stepBrowseTests() : stepSetupWebTarget(),
-                stepCheckDeps(),
-            ],
-            guidance_for_assistant: "Present these as a numbered list. If the user wants to see findings, call zivis_get_findings directly. " +
-                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-            if_user_unsure: "Recommend option 1 (view_open_findings) — let's see what ZIVIS already knows.",
-        };
-    }
-    const steps = [];
-    if (!state.has_application) {
-        steps.push(stepSetupWebTarget());
-    }
-    steps.push(stepCheckDeps());
-    if (state.has_findings) {
-        steps.push(stepViewFindings(state.open_findings_count));
-    }
-    else {
-        steps.push(stepBrowseTests());
-    }
-    if (steps.length < 3)
-        steps.push(stepBrowseTests());
-    return {
-        headline: state.has_application
-            ? `ZIVIS is connected to your project (${state.org_name ?? "org"}). Here are the most useful things to do next.`
-            : `ZIVIS is connected to your project (${state.org_name ?? "org"}) but no app has been registered for testing yet.`,
-        recommended_next_steps: steps.slice(0, 4),
-        guidance_for_assistant: "Present these as a numbered list. Ask the user to pick one before taking any action. " +
-            "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
-        if_user_unsure: "Recommend option 2 (check_dependencies) — it's free, fast, and shows value without setup.",
-    };
-}
-async function findRelevantThreats(cwd) {
-    const located = await locateLatestArtifact(cwd);
-    if (!located) {
-        return {
-            threats: [],
-            reason: "No 'zivis inspect' artifact found in user cache. Run 'zivis inspect' from the repo to populate the threat library against this codebase.",
-        };
-    }
-    const artifactPath = located.path;
-    let artifact;
-    try {
-        const raw = await fs.readFile(artifactPath, "utf8");
-        artifact = JSON.parse(raw);
-    }
-    catch {
-        return { threats: [], reason: `Failed to read artifact at ${artifactPath}.` };
-    }
-    let handle;
-    try {
-        handle = await loadActivePack();
-    }
-    catch {
-        return {
-            threats: [],
-            artifact_path: artifactPath,
-            reason: "Pattern pack not available — run 'pnpm build' to bundle the public pack.",
-        };
-    }
-    const relevant = await findRelevantCapsules(handle, artifact);
-    return {
-        threats: relevant.map((cap) => summarizeCapsule(cap, artifact)),
-        artifact_path: artifactPath,
-    };
-}
-function summarizeCapsule(cap, artifact) {
-    const matched = [];
-    const pkgs = new Set();
-    for (const node of artifact.nodes) {
-        if (node.type === "external_dependency" && node.attributes?.package) {
-            pkgs.add(node.attributes.package);
-        }
-    }
-    const langs = new Set(artifact.scope.languages ?? []);
-    const f = cap.relevance_filter;
-    if (f) {
-        for (const term of [...(f.any_of ?? []), ...(f.all_of ?? [])]) {
-            if (term.dependency && pkgs.has(term.dependency))
-                matched.push(`dep:${term.dependency}`);
-            if (term.language && langs.has(term.language))
-                matched.push(`language:${term.language}`);
-        }
-    }
-    if (matched.length === 0)
-        matched.push("language match only");
-    return {
-        pattern_id: cap.id,
-        title: cap.title,
-        category: cap.category,
-        safe_summary: cap.safe_summary,
-        matched_on: matched,
-        next_action_tool: "zivis_threat_run_matcher",
-    };
-}
-export function createGetStartedHandler(apiClient, _config) {
-    return async (params) => {
-        const cwd = params.cwd ?? process.cwd();
-        const intent = detectIntent(params.concern);
-        const state = await fetchState(apiClient, cwd);
-        const menu = buildMenu(intent, state, params.concern);
-        let threatHit = { threats: [] };
-        try {
-            threatHit = await findRelevantThreats(cwd);
-        }
-        catch (err) {
-            threatHit = {
-                threats: [],
-                reason: `threat-library lookup failed: ${err.message}`,
-            };
-        }
-        if (threatHit.threats.length > 0) {
-            menu.recommended_next_steps = [
-                {
-                    id: "review_relevant_threats",
-                    label: `Review the ${threatHit.threats.length} architectural pattern${threatHit.threats.length === 1 ? "" : "s"} ZIVIS sees in this repo`,
-                    tool: "zivis_threat_run_matcher",
-                    why: "ZIVIS read your codebase via the inspect artifact and identified threat-model patterns that match your architecture. Run the matcher to see exactly which lines fire each pattern.",
-                    estimated_time: "30 seconds",
-                    requires_auth: false,
-                },
-                ...menu.recommended_next_steps,
-            ];
-            menu.headline =
-                `ZIVIS read this repo's threat library and sees ${threatHit.threats.length} architectural pattern${threatHit.threats.length === 1 ? "" : "s"} that may apply. ` +
-                    menu.headline;
-            menu.if_user_unsure = `Recommend option 1 (review_relevant_threats) — that's the most repo-specific thing ZIVIS knows.`;
-        }
-        if (state.bound &&
-            state.github_app_installed === false &&
-            state.github_app_install_url) {
-            menu.recommended_next_steps = [
-                ...menu.recommended_next_steps,
-                stepInstallGitHubApp(state.github_app_install_url),
-            ];
-        }
-        const payload = {
-            current_state: state,
-            intent_detected: intent,
-            concern_received: params.concern ?? null,
-            ...menu,
-            relevant_threats: threatHit.threats,
-            threat_library: {
-                artifact_used: threatHit.artifact_path ?? null,
-                reason_no_threats: threatHit.threats.length === 0 ? threatHit.reason ?? null : null,
-            },
-        };
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(payload, null, 2),
-                },
-            ],
-        };
-    };
-}

package/dist/tools/inspect.d.ts

@@ -1,21 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-import type { ZivisConfig } from "../types.js";
-export declare const INSPECT_NAME = "zivis_inspect";
-export declare const INSPECT_DESCRIPTION = "Build a local repo graph and run the local pattern matcher to emit threat-model findings. The threat-model-first conversion event.\n\nPrefer zivis_get_started or zivis_threat_guide first \u2014 they read the local inspect cache and only call this tool when a fresh artifact is missing. Calling zivis_inspect directly always re-runs (no idempotency at this layer); reach for it when the user explicitly says \"re-inspect\" / \"rebuild the graph\" / \"/inspect\" or when an entry tool tells you to.\n\nUse this when the user says any of:\n- \"model this app\" / \"threat model this repo\"\n- \"what should we be worried about in this code\"\n- \"set up security for this project\" (after auth/binding is done)\n- \"/inspect\"\n\nWhat it does, all locally (no source code leaves the machine):\n  1. Spawns 'zivis inspect' to walk the repo and produce a typed graph artifact\n     (services, endpoints, external dependencies; auth boundaries + dataflow are Phase 1.5)\n  2. Runs the local matcher against the public pattern pack:\n     - AST strategies fire via @ast-grep/napi for TS/JS/Python/Go\n     - META strategies fire via the controls library (when no defending control is present)\n     - INFER strategies emit candidates the host LLM picks up via zivis_threat_get_inference_prompt\n  3. Returns normalized findings with lane (trusted/inferred), confidence, and evidence spans\n\nTrusted-lane findings are evidence-backed (deterministic strategies fired) and ready for the threat model. Inferred-lane findings need host-LLM confirmation via zivis_threat_get_inference_prompt before promotion. Proprietary platform-side eval (Phase 4 cloud upload) and trust-promoted aggregation are separate steps.\n\nThis is the conversion moment for the threat-model-first sidekick \u2014 the user sees specific patterns naming specific files in their repo, in their IDE, in under 30 seconds.";
-export declare const INSPECT_SCHEMA: {
-    cwd: z.ZodOptional<z.ZodString>;
-    application_id: z.ZodOptional<z.ZodString>;
-    skip_matcher: z.ZodOptional<z.ZodBoolean>;
-};
-export declare function createInspectHandler(_apiClient: ApiClient, _config: ZivisConfig): (params: {
-    cwd?: string;
-    application_id?: string;
-    skip_matcher?: boolean;
-}) => Promise<{
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-}>;