@zivis/mcp 0.1.0-alpha.9 → 0.1.6

package/dist/tools/discover-local-infra.js

@@ -1,20 +1,9 @@
-/**
- * zivis_discover_local_infra — Discover AI infrastructure in a local project
- *
- * Reads Docker, compose, and dependency files to understand the local AI
- * infrastructure. Returns structured recommendations for red team testing
- * via zivis_local_scan.
- *
- * This is a local-only tool — no API calls or authentication required.
- * Env values are always redacted for safety.
- */
 import { z } from "zod";
 import { readFile, readdir, stat } from "fs/promises";
 import { join } from "path";
 import { exec } from "child_process";
 import { promisify } from "util";
 const execAsync = promisify(exec);
-// ── Constants ──
 export const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
 export const DISCOVER_LOCAL_INFRA_DESCRIPTION = `Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.
 
@@ -45,7 +34,6 @@ export const DISCOVER_LOCAL_INFRA_SCHEMA = {
         .optional()
         .describe("Path to the project directory to analyze. Defaults to the current working directory."),
 };
-// ── AI Framework Detection Maps ──
 const NPM_AI_PACKAGES = [
     { package: "openai", name: "OpenAI SDK" },
     { package: "@anthropic-ai/sdk", name: "Anthropic SDK" },
@@ -128,8 +116,7 @@ const INFRA_IMAGES = [
     "jaeger",
     "memcached",
 ];
-const MAX_FILE_SIZE = 100 * 1024; // 100KB cap
-// ── Handler ──
+const MAX_FILE_SIZE = 100 * 1024;
 export function createDiscoverLocalInfraHandler() {
     return async (params) => {
         const projectDir = params.project_dir || process.cwd();
@@ -142,7 +129,6 @@ export function createDiscoverLocalInfraHandler() {
             suggestion: null,
             localScanCommand: null,
         };
-        // Step 1: Check Docker daemon
         try {
             const { stdout } = await execAsync("docker version --format '{{.Server.Version}}'", {
                 timeout: 5000,
@@ -152,7 +138,6 @@ export function createDiscoverLocalInfraHandler() {
         catch {
             result.docker = { running: false };
         }
-        // Step 2: Find and parse compose files (check root and common subdirs)
         const composeFileNames = [
             "docker-compose.yml",
             "docker-compose.yaml",
@@ -174,10 +159,8 @@ export function createDiscoverLocalInfraHandler() {
                 }
             }
         }
-        // Step 3: Check running containers
         if (result.docker.running && result.compose.found) {
             try {
-                // Use the directory containing the compose file
                 const composeDir = result.compose.file?.includes("/")
                     ? join(projectDir, result.compose.file.split("/").slice(0, -1).join("/"))
                     : projectDir;
@@ -192,12 +175,9 @@ export function createDiscoverLocalInfraHandler() {
                 }
             }
             catch {
-                // docker compose ps failed, leave statuses as unknown
             }
         }
-        // Step 4: Read dependency files and detect AI frameworks
         const detected = [];
-        // package.json
         const pkgJson = await safeReadFile(join(projectDir, "package.json"));
         if (pkgJson) {
             try {
@@ -218,17 +198,14 @@ export function createDiscoverLocalInfraHandler() {
                 }
             }
             catch {
-                // Invalid JSON, skip
             }
         }
-        // Search subdirectories (up to 2 levels deep) for dependency files
         const subdirs = await safeReaddir(projectDir);
         const searchDirs = [""];
         for (const dir of subdirs) {
             if (dir.startsWith(".") || dir === "node_modules" || dir === "vendor")
                 continue;
             searchDirs.push(dir);
-            // Also check one more level (e.g., demo-app/api/, apps/api/)
             const subSubDirs = await safeReaddir(join(projectDir, dir));
             for (const sub of subSubDirs) {
                 if (sub.startsWith(".") || sub === "node_modules" || sub === "vendor")
@@ -239,7 +216,6 @@ export function createDiscoverLocalInfraHandler() {
         for (const dir of searchDirs) {
             const base = dir ? join(projectDir, dir) : projectDir;
             const prefix = dir ? `${dir}/` : "";
-            // package.json
             const subPkgJson = await safeReadFile(join(base, "package.json"));
             if (subPkgJson) {
                 try {
@@ -257,10 +233,8 @@ export function createDiscoverLocalInfraHandler() {
                     }
                 }
                 catch {
-                    // Skip
                 }
             }
-            // requirements.txt
             const reqTxt = await safeReadFile(join(base, "requirements.txt"));
             if (reqTxt) {
                 const lines = reqTxt.toLowerCase().split("\n");
@@ -278,7 +252,6 @@ export function createDiscoverLocalInfraHandler() {
                     }
                 }
             }
-            // pyproject.toml
             const pyproject = await safeReadFile(join(base, "pyproject.toml"));
             if (pyproject) {
                 for (const ai of PIP_AI_PACKAGES) {
@@ -295,7 +268,6 @@ export function createDiscoverLocalInfraHandler() {
                     }
                 }
             }
-            // go.mod
             const goMod = await safeReadFile(join(base, "go.mod"));
             if (goMod) {
                 for (const ai of GO_AI_PACKAGES) {
@@ -312,10 +284,8 @@ export function createDiscoverLocalInfraHandler() {
             }
         }
         result.aiFrameworks.detected = detected;
-        // Step 5: Read .env files, redact values, flag AI keys
         const envFileNames = [".env", ".env.local", ".env.development"];
         const envHints = [];
-        // Check root and subdirs for .env files
         for (const dir of ["", "infra", "docker"]) {
             for (const envFile of envFileNames) {
                 const filePath = dir ? join(projectDir, dir, envFile) : join(projectDir, envFile);
@@ -335,7 +305,6 @@ export function createDiscoverLocalInfraHandler() {
             }
         }
         result.aiFrameworks.envHints = [...new Set(envHints)];
-        // Step 6: Scan for Dockerfiles (reuse searchDirs from dependency scan)
         const dockerfiles = [];
         for (const dir of searchDirs) {
             const base = dir ? join(projectDir, dir) : projectDir;
@@ -352,7 +321,6 @@ export function createDiscoverLocalInfraHandler() {
             }
         }
         result.dockerfiles = dockerfiles;
-        // Step 7: Check if local runner image exists
         if (result.docker.running) {
             try {
                 const { stdout } = await execAsync("docker images ghcr.io/zivisai/zivis-local-runner --format '{{.Tag}}'", { timeout: 5000 });
@@ -374,7 +342,6 @@ export function createDiscoverLocalInfraHandler() {
                 };
             }
         }
-        // Step 8: Generate suggestion
         result.suggestion = generateSuggestion(result.compose.services, result.aiFrameworks.detected, result.aiFrameworks.envHints, result.dockerfiles);
         if (result.suggestion) {
             const parts = [`target_url="${result.suggestion.target_url}"`];
@@ -401,7 +368,6 @@ export function createDiscoverLocalInfraHandler() {
         };
     };
 }
-// ── Helpers ──
 async function safeReadFile(filePath) {
     try {
         const stats = await stat(filePath);
@@ -423,16 +389,12 @@ async function safeReaddir(dirPath) {
         return [];
     }
 }
-/**
- * Parse a docker-compose file using line-by-line analysis.
- * Extracts service names, images, ports, environment keys, and depends_on.
- */
 function parseComposeServices(content) {
     const lines = content.split("\n");
     const services = [];
     let inServices = false;
     let currentService = null;
-    let currentSection = ""; // "ports", "environment", "depends_on", ""
+    let currentSection = "";
     let serviceIndent = -1;
     let sectionIndent = -1;
     for (const line of lines) {
@@ -441,13 +403,11 @@ function parseComposeServices(content) {
         if (trimmed === "" || trimmed.startsWith("#"))
             continue;
         const indent = raw.length - raw.trimStart().length;
-        // Top-level "services:" key (indent 0)
         if (indent === 0 && /^services:\s*$/.test(trimmed)) {
             inServices = true;
             serviceIndent = -1;
             continue;
         }
-        // Another top-level key ends the services block
         if (inServices && indent === 0) {
             inServices = false;
             if (currentService)
@@ -457,8 +417,6 @@ function parseComposeServices(content) {
         }
         if (!inServices)
             continue;
-        // Detect service names: lines at the first indent level under services
-        // that end with ":" and contain only word/dash chars
         if (serviceIndent === -1 && /^[\w][\w.-]*:\s*$/.test(trimmed)) {
             serviceIndent = indent;
         }
@@ -479,9 +437,7 @@ function parseComposeServices(content) {
         }
         if (!currentService)
             continue;
-        // Service properties (indent > serviceIndent)
         if (indent > serviceIndent) {
-            // Check for property keys
             const propMatch = trimmed.match(/^(image|ports|environment|depends_on|build):\s*(.*)/);
             if (propMatch) {
                 const key = propMatch[1];
@@ -499,7 +455,6 @@ function parseComposeServices(content) {
                 currentSection = "";
                 continue;
             }
-            // If we're at a deeper indent than section, parse items
             if (currentSection && sectionIndent >= 0 && indent > sectionIndent) {
                 if (trimmed.startsWith("-")) {
                     const value = trimmed.replace(/^-\s*/, "").replace(/["']/g, "").trim();
@@ -522,17 +477,14 @@ function parseComposeServices(content) {
                     }
                 }
                 else if (currentSection === "environment" && trimmed.includes(":")) {
-                    // Environment as mapping (KEY: value)
                     const envKey = trimmed.split(":")[0].trim();
                     if (envKey)
                         currentService.environmentKeys.push(envKey);
                 }
             }
             else if (indent <= sectionIndent) {
-                // Back to service property level, reset section
                 currentSection = "";
                 sectionIndent = -1;
-                // Re-check for property match
                 const rePropMatch = trimmed.match(/^(image|ports|environment|depends_on|build):\s*(.*)/);
                 if (rePropMatch) {
                     const key = rePropMatch[1];
@@ -554,7 +506,6 @@ function parseComposeServices(content) {
 }
 function parseDockerComposePsOutput(stdout) {
     const containers = [];
-    // docker compose ps --format json outputs one JSON object per line
     for (const line of stdout.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed)
@@ -567,7 +518,6 @@ function parseDockerComposePsOutput(stdout) {
             });
         }
         catch {
-            // Not JSON, skip
         }
     }
     return containers;
@@ -584,14 +534,12 @@ async function parseDockerfile(dir, filename) {
     };
     for (const line of content.split("\n")) {
         const trimmed = line.trim();
-        // FROM instruction
         if (/^FROM\s+/i.test(trimmed)) {
             const fromMatch = trimmed.match(/^FROM\s+(\S+)/i);
             if (fromMatch && !info.baseImage) {
                 info.baseImage = fromMatch[1];
             }
         }
-        // EXPOSE instruction
         if (/^EXPOSE\s+/i.test(trimmed)) {
             const ports = trimmed
                 .replace(/^EXPOSE\s+/i, "")
@@ -600,7 +548,6 @@ async function parseDockerfile(dir, filename) {
                 .filter((p) => !isNaN(p));
             info.exposedPorts.push(...ports);
         }
-        // AI hints from pip install / npm install
         if (trimmed.includes("pip install") || trimmed.includes("pip3 install")) {
             for (const ai of PIP_AI_PACKAGES) {
                 if (trimmed.includes(ai.package)) {
@@ -615,7 +562,6 @@ async function parseDockerfile(dir, filename) {
                 }
             }
         }
-        // Known AI base images
         if (/^FROM\s+/i.test(trimmed)) {
             const image = trimmed.replace(/^FROM\s+/i, "").split(/\s+/)[0].toLowerCase();
             if (image.includes("ollama"))
@@ -630,12 +576,10 @@ async function parseDockerfile(dir, filename) {
 }
 function generateSuggestion(services, frameworks, envHints, dockerfiles) {
     const reasons = [];
-    // Filter out infrastructure services
     const appServices = services.filter((svc) => {
         const image = (svc.image || "").toLowerCase();
         return !INFRA_IMAGES.some((infra) => image.includes(infra));
     });
-    // Determine target type
     const hasAiFrameworks = frameworks.length > 0;
     const hasAiEnvKeys = envHints.length > 0;
     const targetType = hasAiFrameworks || hasAiEnvKeys ? "ai_chat" : "api";
@@ -645,26 +589,21 @@ function generateSuggestion(services, frameworks, envHints, dockerfiles) {
     if (hasAiEnvKeys) {
         reasons.push(`Found AI-related env vars: ${envHints.join(", ")}`);
     }
-    // Find the best service to target
     let targetPort = null;
-    // Prefer running app services with ports
     const runningApps = appServices.filter((svc) => svc.status === "running" && svc.ports.length > 0);
     if (runningApps.length > 0) {
-        // Pick the first one with a port in the typical app range
         const preferred = runningApps.find((svc) => svc.ports.some((p) => p.host >= 3000 && p.host <= 9000));
         const target = preferred || runningApps[0];
         targetPort = target.ports[0].host;
         reasons.push(`Service "${target.name}" is running on port ${targetPort}`);
     }
     else if (appServices.length > 0) {
-        // Use any app service with ports
         const withPorts = appServices.find((svc) => svc.ports.length > 0);
         if (withPorts) {
             targetPort = withPorts.ports[0].host;
             reasons.push(`Service "${withPorts.name}" has port ${targetPort} mapped`);
         }
     }
-    // Fallback: check Dockerfiles for EXPOSE
     if (!targetPort) {
         for (const df of dockerfiles) {
             if (df.exposedPorts.length > 0) {
@@ -674,19 +613,15 @@ function generateSuggestion(services, frameworks, envHints, dockerfiles) {
             }
         }
     }
-    // If still no port, try common defaults
     if (!targetPort) {
         targetPort = 3000;
         reasons.push("Using default port 3000 (no port mapping found)");
     }
-    // Infer chat endpoint from frameworks
     const chatEndpoint = inferChatEndpoint(frameworks);
     if (chatEndpoint) {
         reasons.push(`Inferred endpoint ${chatEndpoint} from framework detection`);
     }
-    // Infer request template and response path
     const { requestTemplate, responsePath } = inferRequestFormat(frameworks);
-    // Calculate confidence
     let confidence = "low";
     if (hasAiFrameworks && targetPort && runningApps.length > 0) {
         confidence = "high";
@@ -718,14 +653,12 @@ function inferChatEndpoint(frameworks) {
         return "/v1/chat/completions";
     if (names.has("Gradio"))
         return "/api/predict";
-    // Default for any detected AI framework
     if (frameworks.length > 0)
         return "/api/chat";
     return undefined;
 }
 function inferRequestFormat(frameworks) {
     const names = new Set(frameworks.map((f) => f.name));
-    // OpenAI-compatible APIs
     if (names.has("OpenAI SDK") ||
         names.has("Azure OpenAI") ||
         names.has("vLLM") ||
@@ -738,16 +671,14 @@ function inferRequestFormat(frameworks) {
             responsePath: "choices[0].message.content",
         };
     }
-    // Vercel AI SDK
     if (names.has("Vercel AI SDK") || names.has("Vercel AI SDK (OpenAI)") || names.has("Vercel AI SDK (Anthropic)")) {
         return {
             requestTemplate: JSON.stringify({
                 messages: [{ role: "user", content: "{{message}}" }],
             }),
-            responsePath: undefined, // Vercel AI SDK streams by default
+            responsePath: undefined,
         };
     }
-    // Ollama
     if (names.has("Ollama")) {
         return {
             requestTemplate: JSON.stringify({
@@ -760,4 +691,3 @@ function inferRequestFormat(frameworks) {
     }
     return {};
 }
-//# sourceMappingURL=discover-local-infra.js.map

package/dist/tools/enterprise/get-org-zat.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_get_org_zat — Get your organization's latest signed attestation token
- *
- * Maps to: GET /api/zat?framework=<optional> (JWT auth required)
- */
 import { z } from "zod";
 import type { ApiClient } from "../../api-client.js";
 export declare const GET_ORG_ZAT_NAME = "zivis_get_org_zat";

package/dist/tools/enterprise/get-org-zat.js

@@ -1,8 +1,3 @@
-/**
- * zivis_get_org_zat — Get your organization's latest signed attestation token
- *
- * Maps to: GET /api/zat?framework=<optional> (JWT auth required)
- */
 import { z } from "zod";
 export const GET_ORG_ZAT_NAME = "zivis_get_org_zat";
 export const GET_ORG_ZAT_DESCRIPTION = `Get your organization's latest ZIVIS Attestation Token (ZAT) — a cryptographically signed credential capturing your compliance posture.
@@ -59,4 +54,3 @@ export function createGetOrgZatHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=get-org-zat.js.map

package/dist/tools/enterprise/get-threat-model.d.ts

@@ -1,19 +1,12 @@
-/**
- * zivis_get_threat_model — Get a threat model with all entities
- *
- * Maps to: GET /api/threat-models/:id
- */
 import { z } from "zod";
 import type { ApiClient } from "../../api-client.js";
 export declare const GET_THREAT_MODEL_NAME = "zivis_get_threat_model";
-export declare const GET_THREAT_MODEL_DESCRIPTION = "Get a threat model with ALL its entities \u2014 actors, components, data flows, attack scenarios, security controls, data assets, test cases, findings, AND any linked diagrams.\n\nReturns the complete threat model including:\n- **Actors**: Who interacts with the system (external users, attackers, internal services)\n- **Components**: System parts (APIs, databases, frontends, services) with technology and trust level\n- **Data Flows**: How data moves between components (protocol, encryption, auth mechanism)\n- **Attack Scenarios**: STRIDE-categorized threats with severity, likelihood, attack vectors\n- **Security Controls**: Existing mitigations (preventive, detective, corrective) with effectiveness\n- **Data Assets**: What sensitive data exists and how it's classified\n- **Test Cases**: Security tests with results (pass/fail/partial/not_tested)\n- **Findings**: Discovered vulnerabilities with severity and remediation recommendations\n- **Linked Diagrams**: Architecture, data flow, trust boundary, and other diagrams associated with this threat model\n\nIMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.\n\nUse this to understand the full security posture before making changes, adding entities, or running pen tests.\nAfter viewing, use zivis_manage_actor, zivis_manage_component, zivis_manage_data_flow, etc. to add or update entities.\nUse zivis_get_diagram with a diagram_id from the linked_diagrams to view full diagram details (nodes, connections, boundaries).";
+export declare const GET_THREAT_MODEL_DESCRIPTION = "Get a threat model \u2014 its metadata, status, owning application, and linked diagrams.\n\nReturns:\n- The threat model row (name, status, application association, timestamps)\n- **Linked Diagrams** (`linked_diagrams`): first-class `Diagram` entities linked to this threat model. Use `zivis_get_diagram` for full content.\n- Threat-model documents are listed via `zivis_list_documents` with `threat_model_id`.\n\nIMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.";
 export declare const GET_THREAT_MODEL_SCHEMA: {
     threat_model_id: z.ZodString;
-    include_test_cases: z.ZodDefault<z.ZodBoolean>;
 };
 export declare function createGetThreatModelHandler(apiClient: ApiClient): (params: {
     threat_model_id: string;
-    include_test_cases?: boolean;
 }) => Promise<{
     content: {
         type: "text";

package/dist/tools/enterprise/get-threat-model.js

@@ -1,51 +1,30 @@
-/**
- * zivis_get_threat_model — Get a threat model with all entities
- *
- * Maps to: GET /api/threat-models/:id
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../../sanitize.js";
 export const GET_THREAT_MODEL_NAME = "zivis_get_threat_model";
-export const GET_THREAT_MODEL_DESCRIPTION = `Get a threat model with ALL its entities — actors, components, data flows, attack scenarios, security controls, data assets, test cases, findings, AND any linked diagrams.
+export const GET_THREAT_MODEL_DESCRIPTION = `Get a threat model — its metadata, status, owning application, and linked diagrams.
 
-Returns the complete threat model including:
-- **Actors**: Who interacts with the system (external users, attackers, internal services)
-- **Components**: System parts (APIs, databases, frontends, services) with technology and trust level
-- **Data Flows**: How data moves between components (protocol, encryption, auth mechanism)
-- **Attack Scenarios**: STRIDE-categorized threats with severity, likelihood, attack vectors
-- **Security Controls**: Existing mitigations (preventive, detective, corrective) with effectiveness
-- **Data Assets**: What sensitive data exists and how it's classified
-- **Test Cases**: Security tests with results (pass/fail/partial/not_tested)
-- **Findings**: Discovered vulnerabilities with severity and remediation recommendations
-- **Linked Diagrams**: Architecture, data flow, trust boundary, and other diagrams associated with this threat model
+Returns:
+- The threat model row (name, status, application association, timestamps)
+- **Linked Diagrams** (\`linked_diagrams\`): first-class \`Diagram\` entities linked to this threat model. Use \`zivis_get_diagram\` for full content.
+- Threat-model documents are listed via \`zivis_list_documents\` with \`threat_model_id\`.
 
-IMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.
-
-Use this to understand the full security posture before making changes, adding entities, or running pen tests.
-After viewing, use zivis_manage_actor, zivis_manage_component, zivis_manage_data_flow, etc. to add or update entities.
-Use zivis_get_diagram with a diagram_id from the linked_diagrams to view full diagram details (nodes, connections, boundaries).`;
+IMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.`;
 export const GET_THREAT_MODEL_SCHEMA = {
     threat_model_id: z
         .string()
         .describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-    include_test_cases: z
-        .boolean()
-        .default(true)
-        .describe("Whether to include test cases in the response"),
 };
 export function createGetThreatModelHandler(apiClient) {
     return async (params) => {
         try {
-            // Fetch threat model and linked diagrams in parallel
             const [threatModelData, diagramsData] = await Promise.all([
-                apiClient.get(`/api/threat-models/${params.threat_model_id}?include=all`),
+                apiClient.get(`/api/threat-models/${params.threat_model_id}`),
                 apiClient
                     .get(`/api/diagrams?linkedThreatModelId=${params.threat_model_id}&take=50`)
                     .catch(() => ({ diagrams: [], total: 0 })),
             ]);
             const sanitized = sanitizeResponse(threatModelData);
-            // Attach linked diagrams summary to the response
-            const diagrams = Array.isArray(diagramsData.diagrams)
+            const linkedDiagrams = Array.isArray(diagramsData.diagrams)
                 ? diagramsData.diagrams.map((d) => ({
                     diagram_id: d.id,
                     name: d.name,
@@ -59,7 +38,7 @@ export function createGetThreatModelHandler(apiClient) {
                 : [];
             const result = {
                 ...sanitized,
-                linked_diagrams: diagrams,
+                linked_diagrams: linkedDiagrams,
                 linked_diagrams_count: diagramsData.total,
             };
             return {
@@ -80,4 +59,3 @@ export function createGetThreatModelHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=get-threat-model.js.map

package/dist/tools/enterprise/list-attack-scenarios.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const LIST_ATTACK_SCENARIOS_NAME = "zivis_list_attack_scenarios";
+export declare const LIST_ATTACK_SCENARIOS_DESCRIPTION = "List attack scenarios for a threat model, including their path steps.\n\nUse this when you need scenario IDs or attack path step IDs for follow-up tools (for example, step-level library test mappings).\n\nIMPORTANT: threat_model_id must be a threat model UUID (from zivis_list_threat_models), not a scan ID.";
+export declare const LIST_ATTACK_SCENARIOS_SCHEMA: {
+    threat_model_id: z.ZodString;
+    limit: z.ZodDefault<z.ZodNumber>;
+};
+export declare function createListAttackScenariosHandler(apiClient: ApiClient): (params: {
+    threat_model_id: string;
+    limit?: number;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;

package/dist/tools/enterprise/list-attack-scenarios.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const LIST_ATTACK_SCENARIOS_NAME = "zivis_list_attack_scenarios";
+export const LIST_ATTACK_SCENARIOS_DESCRIPTION = `List attack scenarios for a threat model, including their path steps.
+
+Use this when you need scenario IDs or attack path step IDs for follow-up tools (for example, step-level library test mappings).
+
+IMPORTANT: threat_model_id must be a threat model UUID (from zivis_list_threat_models), not a scan ID.`;
+export const LIST_ATTACK_SCENARIOS_SCHEMA = {
+    threat_model_id: z
+        .string()
+        .describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID)"),
+    limit: z
+        .number()
+        .min(1)
+        .max(200)
+        .default(50)
+        .describe("Maximum scenarios to return (1-200, default 50)"),
+};
+export function createListAttackScenariosHandler(apiClient) {
+    return async (params) => {
+        try {
+            const data = await apiClient.get(`/api/threat-models/${params.threat_model_id}/attack-scenarios`);
+            const limit = params.limit ?? 50;
+            const scenarios = (data.attackScenarios || []).slice(0, limit).map((scenario) => ({
+                scenario_id: scenario.id,
+                display_id: scenario.displayId,
+                title: scenario.title,
+                severity: scenario.severity,
+                likelihood: scenario.likelihood,
+                status: scenario.status,
+                review_status: scenario.reviewStatus,
+                risk_score: scenario.riskScore,
+                test_case_count: scenario._count?.testCases ?? 0,
+                step_count: scenario.pathSteps?.length ?? 0,
+                path_steps: (scenario.pathSteps || []).map((step) => ({
+                    step_id: step.id,
+                    step_order: step.stepOrder,
+                    action: step.action,
+                    library_test_count: step._count?.libraryTests ?? 0,
+                })),
+                created_at: scenario.createdAt,
+                updated_at: scenario.updatedAt,
+            }));
+            const sanitized = sanitizeResponse({
+                is_analyzing: data.isAnalyzing ?? false,
+                is_fallback_version: data.isFallback ?? false,
+                total_returned: scenarios.length,
+                scenarios,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to list attack scenarios";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/enterprise/list-threat-models.d.ts

@@ -1,12 +1,7 @@
-/**
- * zivis_list_threat_models — List threat models for the org
- *
- * Maps to: GET /api/threat-models
- */
 import { z } from "zod";
 import type { ApiClient } from "../../api-client.js";
 export declare const LIST_THREAT_MODELS_NAME = "zivis_list_threat_models";
-export declare const LIST_THREAT_MODELS_DESCRIPTION = "List all threat models for your organization. Returns name, status, summary info, and linked diagram counts for each threat model.\n\nAlso fetches any diagrams linked to each threat model, so you can see which threat models have associated architecture, data flow, or trust boundary diagrams. Use zivis_get_threat_model to see full diagram details.\n\nIMPORTANT: Threat models are NOT scans and NOT agents. They are separate entities:\n- A **threat model** (returned here) has its own UUID and contains components, data flows, actors, findings, etc.\n- A **scan** is an agent execution run (from zivis_list_scans) \u2014 scans may CREATE or UPDATE threat models, but scan IDs \u2260 threat model IDs.\n- An **agent instance** is a configured agent (from the UI) \u2014 agents RUN scans which produce threat models.\n\nUse the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_component, zivis_manage_finding, etc. Do NOT pass scan IDs or agent instance IDs to those tools.";
+export declare const LIST_THREAT_MODELS_DESCRIPTION = "List all threat models for your organization. Returns name, status, summary info, and linked diagram counts for each threat model.\n\nAlso fetches any diagrams linked to each threat model, so you can see which threat models have associated architecture, data flow, or trust boundary diagrams. Use zivis_get_threat_model to see full diagram details.\n\nIMPORTANT: Threat models are NOT scans and NOT agents. They are separate entities:\n- A **threat model** (returned here) has its own UUID and contains components, data flows, actors, findings, etc.\n- A **scan** is an agent execution run (from zivis_list_scans) \u2014 scans may CREATE or UPDATE threat models, but scan IDs \u2260 threat model IDs.\n- An **agent instance** is a configured agent (from the UI) \u2014 agents RUN scans which produce threat models.\n\nUse the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_actor, zivis_manage_attack_scenario, etc. Do NOT pass scan IDs or agent instance IDs to those tools.";
 export declare const LIST_THREAT_MODELS_SCHEMA: {
     status: z.ZodOptional<z.ZodEnum<{
         draft: "draft";

package/dist/tools/enterprise/list-threat-models.js

@@ -1,8 +1,3 @@
-/**
- * zivis_list_threat_models — List threat models for the org
- *
- * Maps to: GET /api/threat-models
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../../sanitize.js";
 export const LIST_THREAT_MODELS_NAME = "zivis_list_threat_models";
@@ -15,7 +10,7 @@ IMPORTANT: Threat models are NOT scans and NOT agents. They are separate entitie
 - A **scan** is an agent execution run (from zivis_list_scans) — scans may CREATE or UPDATE threat models, but scan IDs ≠ threat model IDs.
 - An **agent instance** is a configured agent (from the UI) — agents RUN scans which produce threat models.
 
-Use the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_component, zivis_manage_finding, etc. Do NOT pass scan IDs or agent instance IDs to those tools.`;
+Use the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_actor, zivis_manage_attack_scenario, etc. Do NOT pass scan IDs or agent instance IDs to those tools.`;
 export const LIST_THREAT_MODELS_SCHEMA = {
     status: z
         .enum(["draft", "analyzing", "analyzed", "reviewed", "approved", "archived"])
@@ -40,13 +35,11 @@ export function createListThreatModelsHandler(apiClient) {
             const path = `/api/threat-models${queryStr ? `?${queryStr}` : ""}`;
             const data = await apiClient.get(path);
             const sanitized = sanitizeResponse(data);
-            // Fetch diagram counts for each threat model in parallel
             const threatModels = Array.isArray(sanitized) ? sanitized : [];
             const diagramCounts = await Promise.all(threatModels.map((tm) => apiClient
                 .get(`/api/diagrams?linkedThreatModelId=${tm.id}&take=1`)
                 .then((res) => res.total ?? 0)
                 .catch(() => 0)));
-            // Format with clear ID labeling to prevent confusion with scan/agent IDs
             const summary = Array.isArray(sanitized)
                 ? sanitized.map((tm, i) => ({
                     threat_model_id: tm.id,
@@ -79,4 +72,3 @@ export function createListThreatModelsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=list-threat-models.js.map