@zivis/mcp 0.1.0-alpha.9 → 0.1.6

package/dist/tools/get-signal.js

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const GET_SIGNAL_NAME = "zivis_get_signal";
+export const GET_SIGNAL_DESCRIPTION = `Get full detail on a single Signal by its id.
+
+Returns the qualified narrative — description, mitigation, attack-chain context, taxonomy (STRIDE / ATPS layer / MITRE / OWASP / compliance mappings), detected safeguards and what breaks them, and the polymorphic source-artifact reference for drilling into the native subsystem.
+
+Pass \`signal_id\` from a \`zivis_list_signals\` response.
+
+SECURITY: Display-shaped output only. No raw graph data.`;
+export const GET_SIGNAL_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json."),
+    signal_id: z
+        .string()
+        .describe("Opaque signal id (from zivis_list_signals)."),
+};
+export function createGetSignalHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        if (!params.signal_id) {
+            return {
+                content: [{ type: "text", text: "Error: signal_id is required" }],
+                isError: true,
+            };
+        }
+        const path = `/api/apps/${req.id}/signals/${encodeURIComponent(params.signal_id)}`;
+        try {
+            const s = await apiClient.get(path);
+            const result = {
+                id: s.id,
+                source: s.source,
+                severity: s.severity,
+                status: s.status,
+                confidence: s.confidence,
+                title: s.title,
+                description: s.description,
+                category: s.category,
+                attack_chain: s.attackChain
+                    ? {
+                        name: s.attackChain.chainName,
+                        step: `${s.attackChain.stepIndex}/${s.attackChain.totalSteps}`,
+                    }
+                    : null,
+                taxonomy: s.taxonomy ?? null,
+                components: s.components?.map((c) => c.name) ?? [],
+                refs: s.refs,
+                recommended_action: s.recommendedAction,
+                safeguards: s.safeguards ?? null,
+                fingerprint: s.fingerprint,
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load signal";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/get-started.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+import type { ZivisConfig } from "../types.js";
+export declare const GET_STARTED_NAME = "zivis_get_started";
+export declare const GET_STARTED_DESCRIPTION = "Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or \"what should I do next.\" Idempotent and safe to call repeatedly \u2014 detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.\n\nUse this when the user says any of:\n- \"what should I do for security on this app\"\n- \"uhh, where do I start\"\n- \"is my app safe\" / \"is my chatbot safe\"\n- \"I need to do security stuff before launch\"\n- \"I have an audit / pen test / customer asking about security\"\n- \"check my dependencies / libraries / repos\"\n- \"how do I use ZIVIS\"\n- \"what can ZIVIS do for me\"\n\nThis tool inspects the current project state \u2014 binding, application, scans, findings \u2014\nAND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local\nthreat library against it to surface architectural patterns ZIVIS thinks may apply\n(self-consistency without context isolation, late org filter, privilege separation, etc.).\nThe 'relevant_threats' field in the response is what makes this tool different from a\ngeneric security menu: ZIVIS is reading the user's actual codebase via the graph\nartifact and naming threats by their architectural shape.\n\nAlways speak to the user in threat-model language: components, flows, trust boundaries,\nattack scenarios. Even when they don't yet know those terms \u2014 that's how they learn.\n\nOutput is a structured JSON object. Present recommended_next_steps as a numbered list\nto the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead\nwith that \u2014 it's the most concrete thing ZIVIS knows about their repo. Use the label\nand why fields verbatim; do not invent new steps. If the user is unsure which to pick,\nrecommend the item flagged in if_user_unsure.";
+export declare const GET_STARTED_SCHEMA: {
+    concern: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+};
+export declare function createGetStartedHandler(apiClient: ApiClient, _config: ZivisConfig): (params: {
+    concern?: string;
+    cwd?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;

package/dist/tools/get-started.js

@@ -0,0 +1,470 @@
+import * as fs from "node:fs/promises";
+import { z } from "zod";
+import { detectProjectBinding } from "../project-binding.js";
+import { loadActivePack, findRelevantCapsules, } from "../pattern-pack/index.js";
+import { locateLatestArtifact } from "../lib/inspect-cache.js";
+export const GET_STARTED_NAME = "zivis_get_started";
+export const GET_STARTED_DESCRIPTION = `Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or "what should I do next." Idempotent and safe to call repeatedly — detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.
+
+Use this when the user says any of:
+- "what should I do for security on this app"
+- "uhh, where do I start"
+- "is my app safe" / "is my chatbot safe"
+- "I need to do security stuff before launch"
+- "I have an audit / pen test / customer asking about security"
+- "check my dependencies / libraries / repos"
+- "how do I use ZIVIS"
+- "what can ZIVIS do for me"
+
+This tool inspects the current project state — binding, application, scans, findings —
+AND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local
+threat library against it to surface architectural patterns ZIVIS thinks may apply
+(self-consistency without context isolation, late org filter, privilege separation, etc.).
+The 'relevant_threats' field in the response is what makes this tool different from a
+generic security menu: ZIVIS is reading the user's actual codebase via the graph
+artifact and naming threats by their architectural shape.
+
+Always speak to the user in threat-model language: components, flows, trust boundaries,
+attack scenarios. Even when they don't yet know those terms — that's how they learn.
+
+Output is a structured JSON object. Present recommended_next_steps as a numbered list
+to the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead
+with that — it's the most concrete thing ZIVIS knows about their repo. Use the label
+and why fields verbatim; do not invent new steps. If the user is unsure which to pick,
+recommend the item flagged in if_user_unsure.`;
+export const GET_STARTED_SCHEMA = {
+    concern: z
+        .string()
+        .optional()
+        .describe("Free-form sentence describing what the user wants. " +
+        "Examples: 'is my chatbot safe', 'check the libraries we use', " +
+        "'audit coming up next month', 'just deployed a new API'. " +
+        "If omitted, returns a generic getting-started menu based on project state."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to inspect (defaults to server working directory)."),
+};
+const INTENT_MAP = [
+    {
+        patterns: /chatbot|llm|ai chat|assistant|agent|prompt injection|jailbreak|openai|anthropic|langchain|llamaindex|cohere|together/i,
+        intent: "ai_red_team",
+    },
+    {
+        patterns: /librar|dependenc|package|npm|pip|repo|crate|gem|module|import|third.?party/i,
+        intent: "dep_audit",
+    },
+    {
+        patterns: /audit|compliance|soc\s*2|iso\s*27001|fedramp|vendor questionnaire|customer ask|certif/i,
+        intent: "pre_audit",
+    },
+    {
+        patterns: /launch|deploy|release|production|go\s*live|prod|ship/i,
+        intent: "pre_launch",
+    },
+    {
+        patterns: /finding|issue|vulnerabilit|vuln|bug|report|result|scan result/i,
+        intent: "view_findings",
+    },
+];
+function detectIntent(concern) {
+    if (!concern)
+        return "generic";
+    for (const { patterns, intent } of INTENT_MAP) {
+        if (patterns.test(concern))
+            return intent;
+    }
+    return "generic";
+}
+function stepCheckDeps() {
+    return {
+        id: "check_dependencies",
+        label: "Check the open source libraries you depend on",
+        tool: "zivis_check_repo_trust",
+        why: "Free, no setup. Catches risky AI SDKs and known-bad dependencies before they cause problems.",
+        estimated_time: "1 minute per repo",
+        requires_auth: false,
+    };
+}
+function stepSetupAiTarget(hint) {
+    return {
+        id: "setup_ai_target",
+        label: "Tell ZIVIS about your chatbot or AI system so it can test it",
+        tool: "zivis_setup_red_team_target",
+        args_hint: { target_type: "ai_chat", ...hint },
+        why: "ZIVIS needs to know your endpoint to run prompt-injection, jailbreak, and PII-leakage tests.",
+        estimated_time: "2 minutes",
+        requires_auth: true,
+    };
+}
+function stepSetupWebTarget(hint) {
+    return {
+        id: "setup_web_target",
+        label: "Register your web app or API with ZIVIS for testing",
+        tool: "zivis_setup_red_team_target",
+        args_hint: { target_type: "web_app", ...hint },
+        why: "ZIVIS needs to know your app URL to run security tests against it.",
+        estimated_time: "2 minutes",
+        requires_auth: true,
+    };
+}
+function stepBrowseTests() {
+    return {
+        id: "browse_test_library",
+        label: "Browse what ZIVIS can test for",
+        tool: "zivis_list_test_scenarios",
+        why: "See the menu of attack categories (prompt injection, auth bypass, data leakage, etc.) before committing to a scan.",
+        estimated_time: "30 seconds",
+        requires_auth: true,
+    };
+}
+function stepViewFindings(count) {
+    return {
+        id: "view_open_findings",
+        label: count
+            ? `Review the ${count} open security issue${count === 1 ? "" : "s"} ZIVIS found`
+            : "Review open security issues ZIVIS found",
+        tool: "zivis_get_findings",
+        args_hint: { status: "open" },
+        why: "Look at what's been found already before starting new scans — no point duplicating work.",
+        estimated_time: "5 minutes",
+        requires_auth: true,
+    };
+}
+function stepRunSecurityReview() {
+    return {
+        id: "run_security_review",
+        label: "Get a security readiness summary before launch or audit",
+        tool: "zivis_security_review",
+        why: "Pulls together all open findings, past fixes, and known attack scenarios into one pre-launch checklist.",
+        estimated_time: "3 minutes",
+        requires_auth: true,
+    };
+}
+function stepSetupProject() {
+    return {
+        id: "setup_project",
+        label: "Connect this project to your ZIVIS org",
+        tool: "zivis_check_project",
+        why: "ZIVIS needs to know which org this project belongs to before it can run tests or store results.",
+        estimated_time: "2 minutes (run 'zivis auth init' in your terminal)",
+        requires_auth: false,
+    };
+}
+function stepInstallGitHubApp(installUrl) {
+    return {
+        id: "install_github_app",
+        label: "Install the ZIVIS GitHub App to enable continuous monitoring",
+        tool: "external_link",
+        args_hint: { url: installUrl },
+        why: "Linking a repo unlocks deeper analysis on every push — threat model updates automatically as architecture changes. Today this org has no GitHub App installation.",
+        estimated_time: "2 minutes",
+        requires_auth: false,
+    };
+}
+async function fetchState(apiClient, cwd) {
+    const detected = detectProjectBinding(cwd);
+    if (!detected) {
+        return {
+            bound: false,
+            has_application: false,
+            has_scans: false,
+            has_findings: false,
+            open_findings_count: 0,
+        };
+    }
+    const state = {
+        bound: true,
+        org_name: detected.binding.orgName,
+        has_application: false,
+        has_scans: false,
+        has_findings: false,
+        open_findings_count: 0,
+    };
+    try {
+        const appsResp = await apiClient.get("/api/rt/applications?limit=1");
+        if ((appsResp.applications?.length ?? 0) > 0 || (appsResp.total ?? 0) > 0) {
+            state.has_application = true;
+        }
+    }
+    catch {
+    }
+    try {
+        const scansResp = await apiClient.get("/api/rt/scans?limit=1");
+        if ((scansResp.scans?.length ?? 0) > 0) {
+            state.has_scans = true;
+        }
+    }
+    catch {
+    }
+    try {
+        const findingsResp = await apiClient.get("/api/findings/unified?status=open&limit=1");
+        const total = findingsResp.summary?.total ?? findingsResp.findings?.length ?? 0;
+        if (total > 0) {
+            state.has_findings = true;
+            state.open_findings_count = total;
+        }
+    }
+    catch {
+    }
+    try {
+        const gh = await apiClient.get("/api/github-app/status");
+        state.github_app_installed = gh.installed;
+        state.github_app_install_url = gh.installUrl;
+    }
+    catch {
+        state.github_app_installed = null;
+    }
+    return state;
+}
+function buildMenu(intent, state, concern) {
+    if (!state.bound) {
+        return {
+            headline: "Welcome to ZIVIS! First, let's connect this project to your organization so results are stored and tracked.",
+            recommended_next_steps: [
+                stepSetupProject(),
+                stepCheckDeps(),
+                stepBrowseTests(),
+            ],
+            guidance_for_assistant: "Present these as a numbered list. The user should run 'zivis auth init' in their terminal to complete step 1. " +
+                "Step 2 (check_dependencies) requires no auth and can be done immediately. " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 2 (check_dependencies) — it requires no setup and gives immediate results.",
+        };
+    }
+    if (state.has_findings && intent !== "dep_audit") {
+        const steps = [
+            stepViewFindings(state.open_findings_count),
+            stepCheckDeps(),
+        ];
+        if (!state.has_application) {
+            steps.push(stepSetupWebTarget());
+        }
+        else {
+            steps.push(stepBrowseTests());
+        }
+        return {
+            headline: `ZIVIS sees your project (${state.org_name ?? "connected"}) and has found ${state.open_findings_count} open security issue${state.open_findings_count === 1 ? "" : "s"}.`,
+            recommended_next_steps: steps,
+            guidance_for_assistant: "Present these as a numbered list. Prioritize reviewing existing findings before starting new scans. " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 1 (view_open_findings) — reviewing what's already known is the best first step.",
+        };
+    }
+    if (intent === "ai_red_team") {
+        const steps = [
+            stepSetupAiTarget(),
+            stepCheckDeps(),
+            stepBrowseTests(),
+        ];
+        return {
+            headline: state.has_application
+                ? `ZIVIS sees your project (${state.org_name ?? "connected"}) and has a target configured. Ready to test your AI system.`
+                : `ZIVIS sees your project (${state.org_name ?? "connected"}) but no security testing has run yet.`,
+            recommended_next_steps: steps,
+            guidance_for_assistant: "The user wants to test an AI/chatbot system. Present these as a numbered list. " +
+                "If they already have a target URL, include it in args_hint. " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 1 (setup_ai_target) — setting up the chatbot as a test target is the fastest path to finding real issues.",
+        };
+    }
+    if (intent === "dep_audit") {
+        return {
+            headline: "Checking your dependencies is a great place to start — it's free, needs no setup, and often finds the most impactful issues.",
+            recommended_next_steps: [
+                stepCheckDeps(),
+                stepSetupWebTarget(),
+                stepBrowseTests(),
+            ],
+            guidance_for_assistant: "Present these as a numbered list. For step 1, ask the user to share which packages they want to check " +
+                "(the GitHub org/repo of the dependency, e.g. openai/openai-python). " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 1 (check_dependencies) — it works right now with no setup.",
+        };
+    }
+    if (intent === "pre_audit" || intent === "pre_launch") {
+        const steps = [
+            stepRunSecurityReview(),
+            stepCheckDeps(),
+        ];
+        if (!state.has_application) {
+            steps.push(stepSetupWebTarget());
+        }
+        else {
+            steps.push(stepBrowseTests());
+        }
+        const headline = intent === "pre_audit"
+            ? `ZIVIS can help you prepare for an audit. Let's get a security readiness picture first.`
+            : `ZIVIS can help you check security before you go live.`;
+        return {
+            headline,
+            recommended_next_steps: steps,
+            guidance_for_assistant: "The user has a deadline (audit or launch). Start with a security review to understand the current state, " +
+                "then address the highest-severity issues first. " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 1 (run_security_review) — it gives the fastest complete picture and shows what needs to be fixed before the deadline.",
+        };
+    }
+    if (intent === "view_findings") {
+        return {
+            headline: state.has_findings
+                ? `ZIVIS has ${state.open_findings_count} open finding${state.open_findings_count === 1 ? "" : "s"} for this project.`
+                : `No open findings found yet — ZIVIS may not have run a scan, or all issues are resolved.`,
+            recommended_next_steps: [
+                stepViewFindings(state.open_findings_count > 0 ? state.open_findings_count : undefined),
+                state.has_application ? stepBrowseTests() : stepSetupWebTarget(),
+                stepCheckDeps(),
+            ],
+            guidance_for_assistant: "Present these as a numbered list. If the user wants to see findings, call zivis_get_findings directly. " +
+                "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+            if_user_unsure: "Recommend option 1 (view_open_findings) — let's see what ZIVIS already knows.",
+        };
+    }
+    const steps = [];
+    if (!state.has_application) {
+        steps.push(stepSetupWebTarget());
+    }
+    steps.push(stepCheckDeps());
+    if (state.has_findings) {
+        steps.push(stepViewFindings(state.open_findings_count));
+    }
+    else {
+        steps.push(stepBrowseTests());
+    }
+    if (steps.length < 3)
+        steps.push(stepBrowseTests());
+    return {
+        headline: state.has_application
+            ? `ZIVIS is connected to your project (${state.org_name ?? "org"}). Here are the most useful things to do next.`
+            : `ZIVIS is connected to your project (${state.org_name ?? "org"}) but no app has been registered for testing yet.`,
+        recommended_next_steps: steps.slice(0, 4),
+        guidance_for_assistant: "Present these as a numbered list. Ask the user to pick one before taking any action. " +
+            "If they ask 'why' something matters, expand on the 'why' field — do not make new claims.",
+        if_user_unsure: "Recommend option 2 (check_dependencies) — it's free, fast, and shows value without setup.",
+    };
+}
+async function findRelevantThreats(cwd) {
+    const located = await locateLatestArtifact(cwd);
+    if (!located) {
+        return {
+            threats: [],
+            reason: "No 'zivis inspect' artifact found in user cache. Run 'zivis inspect' from the repo to populate the threat library against this codebase.",
+        };
+    }
+    const artifactPath = located.path;
+    let artifact;
+    try {
+        const raw = await fs.readFile(artifactPath, "utf8");
+        artifact = JSON.parse(raw);
+    }
+    catch {
+        return { threats: [], reason: `Failed to read artifact at ${artifactPath}.` };
+    }
+    let handle;
+    try {
+        handle = await loadActivePack();
+    }
+    catch {
+        return {
+            threats: [],
+            artifact_path: artifactPath,
+            reason: "Pattern pack not available — run 'pnpm build' to bundle the public pack.",
+        };
+    }
+    const relevant = await findRelevantCapsules(handle, artifact);
+    return {
+        threats: relevant.map((cap) => summarizeCapsule(cap, artifact)),
+        artifact_path: artifactPath,
+    };
+}
+function summarizeCapsule(cap, artifact) {
+    const matched = [];
+    const pkgs = new Set();
+    for (const node of artifact.nodes) {
+        if (node.type === "external_dependency" && node.attributes?.package) {
+            pkgs.add(node.attributes.package);
+        }
+    }
+    const langs = new Set(artifact.scope.languages ?? []);
+    const f = cap.relevance_filter;
+    if (f) {
+        for (const term of [...(f.any_of ?? []), ...(f.all_of ?? [])]) {
+            if (term.dependency && pkgs.has(term.dependency))
+                matched.push(`dep:${term.dependency}`);
+            if (term.language && langs.has(term.language))
+                matched.push(`language:${term.language}`);
+        }
+    }
+    if (matched.length === 0)
+        matched.push("language match only");
+    return {
+        pattern_id: cap.id,
+        title: cap.title,
+        category: cap.category,
+        safe_summary: cap.safe_summary,
+        matched_on: matched,
+        next_action_tool: "zivis_threat_run_matcher",
+    };
+}
+export function createGetStartedHandler(apiClient, _config) {
+    return async (params) => {
+        const cwd = params.cwd ?? process.cwd();
+        const intent = detectIntent(params.concern);
+        const state = await fetchState(apiClient, cwd);
+        const menu = buildMenu(intent, state, params.concern);
+        let threatHit = { threats: [] };
+        try {
+            threatHit = await findRelevantThreats(cwd);
+        }
+        catch (err) {
+            threatHit = {
+                threats: [],
+                reason: `threat-library lookup failed: ${err.message}`,
+            };
+        }
+        if (threatHit.threats.length > 0) {
+            menu.recommended_next_steps = [
+                {
+                    id: "review_relevant_threats",
+                    label: `Review the ${threatHit.threats.length} architectural pattern${threatHit.threats.length === 1 ? "" : "s"} ZIVIS sees in this repo`,
+                    tool: "zivis_threat_run_matcher",
+                    why: "ZIVIS read your codebase via the inspect artifact and identified threat-model patterns that match your architecture. Run the matcher to see exactly which lines fire each pattern.",
+                    estimated_time: "30 seconds",
+                    requires_auth: false,
+                },
+                ...menu.recommended_next_steps,
+            ];
+            menu.headline =
+                `ZIVIS read this repo's threat library and sees ${threatHit.threats.length} architectural pattern${threatHit.threats.length === 1 ? "" : "s"} that may apply. ` +
+                    menu.headline;
+            menu.if_user_unsure = `Recommend option 1 (review_relevant_threats) — that's the most repo-specific thing ZIVIS knows.`;
+        }
+        if (state.bound &&
+            state.github_app_installed === false &&
+            state.github_app_install_url) {
+            menu.recommended_next_steps = [
+                ...menu.recommended_next_steps,
+                stepInstallGitHubApp(state.github_app_install_url),
+            ];
+        }
+        const payload = {
+            current_state: state,
+            intent_detected: intent,
+            concern_received: params.concern ?? null,
+            ...menu,
+            relevant_threats: threatHit.threats,
+            threat_library: {
+                artifact_used: threatHit.artifact_path ?? null,
+                reason_no_threats: threatHit.threats.length === 0 ? threatHit.reason ?? null : null,
+            },
+        };
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(payload, null, 2),
+                },
+            ],
+        };
+    };
+}

package/dist/tools/get-trust-keys.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_get_trust_keys — Retrieve JWKS public keys for signature verification
- *
- * Maps to: GET /.well-known/jwks.json (public, no auth required)
- */
 import type { ZivisConfig } from "../types.js";
 export declare const GET_TRUST_KEYS_NAME = "zivis_get_trust_keys";
 export declare const GET_TRUST_KEYS_DESCRIPTION = "Retrieve the ZIVIS public signing keys (JWKS) for independent cryptographic verification of trust marks and ZATs.\n\nReturns a JWKS (JSON Web Key Set) containing two keys:\n\n1. **ML-DSA-65 key** (post-quantum, FIPS-204):\n   - Algorithm: CRYSTALS-Dilithium Level 3\n   - NIST Security Category 3 (128-bit quantum security)\n   - Used to verify the full digital signature on ZATs and trust marks\n   - Key type: \"PQ-LWE\" (proposed post-quantum JWK key type)\n   - The \"x\" field is the base64url-encoded public key bytes\n\n2. **Ed25519 key** (RFC 8032):\n   - Used to verify compact trust tokens (shorter, URL-safe format)\n   - Standard JWK format (kty: \"OKP\", crv: \"Ed25519\")\n\nThese keys enable third-party, offline verification without trusting ZIVIS infrastructure.\nThis is critical for ATNP (Agent Trust Negotiation Protocol) where agents must independently verify trust marks.\n\nVerification workflow:\n1. Get a ZAT (from zivis_get_oss_zat or zivis_get_org_zat)\n2. Get the public keys (this tool)\n3. Verify the signature using ML-DSA-65 or Ed25519 library of your choice\n4. Check expiration and claims\n\nNo parameters required. No authentication required.";

package/dist/tools/get-trust-keys.js

@@ -1,8 +1,3 @@
-/**
- * zivis_get_trust_keys — Retrieve JWKS public keys for signature verification
- *
- * Maps to: GET /.well-known/jwks.json (public, no auth required)
- */
 export const GET_TRUST_KEYS_NAME = "zivis_get_trust_keys";
 export const GET_TRUST_KEYS_DESCRIPTION = `Retrieve the ZIVIS public signing keys (JWKS) for independent cryptographic verification of trust marks and ZATs.
 
@@ -64,4 +59,3 @@ export function createGetTrustKeysHandler(config) {
         }
     };
 }
-//# sourceMappingURL=get-trust-keys.js.map

package/dist/tools/import-openapi-endpoints.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_import_openapi_endpoints — Import endpoints from an OpenAPI/Swagger spec
- *
- * Maps to: POST /api/rt/applications/:id/endpoints/import-openapi
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const IMPORT_OPENAPI_ENDPOINTS_NAME = "zivis_import_openapi_endpoints";

package/dist/tools/import-openapi-endpoints.js

@@ -1,8 +1,3 @@
-/**
- * zivis_import_openapi_endpoints — Import endpoints from an OpenAPI/Swagger spec
- *
- * Maps to: POST /api/rt/applications/:id/endpoints/import-openapi
- */
 import { z } from "zod";
 import { requireApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -90,4 +85,3 @@ export function createImportOpenApiEndpointsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=import-openapi-endpoints.js.map

package/dist/tools/inspect-zat.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_inspect_zat — Parse and explain a ZAT token
- *
- * No API call — client-side parsing and human-readable interpretation.
- */
 import { z } from "zod";
 export declare const INSPECT_ZAT_NAME = "zivis_inspect_zat";
 export declare const INSPECT_ZAT_DESCRIPTION = "Parse a ZIVIS Attestation Token (ZAT) JSON and produce a human-readable explanation of all fields.\n\nThis tool does NOT make any API calls \u2014 it parses the ZAT locally and explains what each field means.\n\nUse this after retrieving a ZAT from zivis_get_oss_zat or zivis_get_org_zat to understand:\n- What the claims mean (Z-Score, trust tiers, coverage, findings)\n- Whether signatures are present and which algorithms were used\n- Token validity and expiration\n- Evidence manifest integrity\n- Framework and methodology details\n- Lens-level scores (for OSS ZATs)\n\nAccepts either:\n- A JSON string (the raw ZAT output)\n- A JSON object with a \"zat\" field (the wrapper returned by the API)\n\nZAT Field Reference:\n- **iss**: Issuer (always \"zivis.ai\")\n- **sub**: Subject \u2014 \"org:<slug>\" for enterprise, \"github:<owner>/<repo>\" for OSS\n- **mark_id**: Unique identifier (ztm_...) \u2014 references the trust mark\n- **issued_at / expires_at**: ISO 8601 timestamps \u2014 ZATs are short-lived (48h)\n- **frameworks[]**: Which security frameworks were assessed (NIST IR 8596, ISO 42001, OWASP LLM Top 10, etc.)\n  - basis: \"tested\" | \"mapped\" | \"self-attested\" | \"third-party\" \u2014 how the assessment was performed\n  - csf_version: Present if framework is NIST CSF 2.0 derived (enables cross-framework comparison)\n- **claims**: The actual trust posture\n  - For enterprise: z_score_raw (0-1), z_score_display (0-1000), tier (0-3), tier_label, coverage_pct, mapped_outcomes\n  - For OSS: score (0-100), grade (A+ to F), check_types, findings by severity, commit SHA\n  - Tier meanings: 0=Commitment, 1=Foundational Trust (600+), 2=Operational Trust (700+), 3=Systemic Trust (800+)\n- **evidence_manifest**: SHA-256 hash of the evidence bundle \u2014 proves the assessment data hasn't been tampered with\n- **methodology**: How the assessment was performed (model version, scoring algorithm, evaluator type)\n- **sig**: Cryptographic signatures\n  - alg: \"ML-DSA-65\" (FIPS-204, post-quantum CRYSTALS-Dilithium Level 3)\n  - compact: Ed25519 (RFC 8032) compact token for lightweight verification\n- **ver**: ZAT spec version (e.g., \"0.3.0\")";