@zivis/mcp 0.1.0-alpha.9 → 0.1.6

package/dist/tools/manage-application.js

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const MANAGE_APPLICATION_NAME = "zivis_manage_application";
+export const MANAGE_APPLICATION_DESCRIPTION = `Create, update, or delete a target application.
+
+Actions:
+- create: requires at least name, base_url, auth_type
+- update: patch an existing application (requires application_id)
+- delete: remove an application (requires application_id)`;
+export const MANAGE_APPLICATION_SCHEMA = {
+    action: z.enum(["create", "update", "delete"]).describe("CRUD action"),
+    application_id: z
+        .string()
+        .optional()
+        .describe("Required for update/delete. Optional for create."),
+    name: z.string().optional().describe("Application name"),
+    description: z.string().optional().describe("Application description"),
+    base_url: z.string().optional().describe("Base URL, e.g. https://api.example.com"),
+    api_url: z.string().optional().describe("Explicit API URL"),
+    auth_type: z
+        .enum(["none", "oauth_pkce", "static_token", "client_credentials", "bearer_refresh"])
+        .optional()
+        .describe("Application auth type (required for create)"),
+    has_rag: z.boolean().optional().describe("LLM capability flag"),
+    has_tools: z.boolean().optional().describe("LLM capability flag"),
+    has_memory: z.boolean().optional().describe("LLM capability flag"),
+    is_multi_turn: z.boolean().optional().describe("LLM capability flag"),
+    system_context: z.string().optional().describe("System context/prompt context"),
+    type: z
+        .enum(["api", "chat", "sse", "validation", "web"])
+        .optional()
+        .describe("Application type"),
+    use_ephemeral_creds: z
+        .boolean()
+        .optional()
+        .describe("Whether ephemeral credentials are enabled"),
+};
+export function createManageApplicationHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { action } = params;
+            let data;
+            if (action === "create") {
+                if (!params.name || !params.base_url || !params.auth_type) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Error: create requires name, base_url, and auth_type",
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post("/api/rt/applications", {
+                    name: params.name,
+                    description: params.description,
+                    baseUrl: params.base_url,
+                    apiUrl: params.api_url,
+                    authType: params.auth_type,
+                    hasRag: params.has_rag,
+                    hasTools: params.has_tools,
+                    hasMemory: params.has_memory,
+                    isMultiTurn: params.is_multi_turn,
+                    systemContext: params.system_context,
+                    type: params.type,
+                    useEphemeralCreds: params.use_ephemeral_creds,
+                });
+            }
+            else {
+                const req = requireApplicationId(params.application_id);
+                if (!req.ok) {
+                    return {
+                        content: [{ type: "text", text: `Error: ${req.message}` }],
+                        isError: true,
+                    };
+                }
+                if (action === "delete") {
+                    data = await apiClient.del(`/api/rt/applications/${req.id}`);
+                }
+                else {
+                    const body = {};
+                    if (params.name !== undefined)
+                        body.name = params.name;
+                    if (params.description !== undefined)
+                        body.description = params.description;
+                    if (params.base_url !== undefined)
+                        body.baseUrl = params.base_url;
+                    if (params.api_url !== undefined)
+                        body.apiUrl = params.api_url;
+                    if (params.auth_type !== undefined)
+                        body.authType = params.auth_type;
+                    if (params.has_rag !== undefined)
+                        body.hasRag = params.has_rag;
+                    if (params.has_tools !== undefined)
+                        body.hasTools = params.has_tools;
+                    if (params.has_memory !== undefined)
+                        body.hasMemory = params.has_memory;
+                    if (params.is_multi_turn !== undefined)
+                        body.isMultiTurn = params.is_multi_turn;
+                    if (params.system_context !== undefined)
+                        body.systemContext = params.system_context;
+                    if (params.type !== undefined)
+                        body.type = params.type;
+                    if (params.use_ephemeral_creds !== undefined) {
+                        body.useEphemeralCreds = params.use_ephemeral_creds;
+                    }
+                    data = await apiClient.patch(`/api/rt/applications/${req.id}`, body);
+                }
+            }
+            const sanitized = sanitizeResponse({
+                action,
+                application_id: params.application_id,
+                result: data,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage application";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/manage-diagram.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_manage_diagram — Update, delete, or modify diagram content
- *
- * Maps to: PATCH/DELETE /api/diagrams/:id and sub-resource endpoints
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const MANAGE_DIAGRAM_NAME = "zivis_manage_diagram";

package/dist/tools/manage-diagram.js

@@ -1,8 +1,3 @@
-/**
- * zivis_manage_diagram — Update, delete, or modify diagram content
- *
- * Maps to: PATCH/DELETE /api/diagrams/:id and sub-resource endpoints
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const MANAGE_DIAGRAM_NAME = "zivis_manage_diagram";
@@ -45,14 +40,12 @@ export const MANAGE_DIAGRAM_SCHEMA = {
         "unlink_threat_model",
     ])
         .describe("Action to perform"),
-    // Metadata fields
     name: z.string().optional().describe("Diagram name (update_metadata)"),
     description: z.string().optional().describe("Diagram description (update_metadata)"),
     diagram_type: z
         .enum(["architecture", "data_flow", "attack_chain", "sequence", "trust_boundary", "network", "deployment", "custom"])
         .optional()
         .describe("Diagram type (update_metadata)"),
-    // Node fields
     node_id: z.string().optional().describe("Node UUID (required for update_node, delete_node)"),
     node_name: z.string().optional().describe("Node name (required for add_node, optional for update_node)"),
     node_description: z.string().optional().describe("Node description"),
@@ -66,7 +59,6 @@ export const MANAGE_DIAGRAM_SCHEMA = {
     step_order: z.number().optional().describe("Step order (attack chain diagrams)"),
     boundary_id: z.string().optional().describe("Boundary UUID to assign node to, or boundary to update/delete"),
     metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata JSON"),
-    // Connection fields
     connection_id: z.string().optional().describe("Connection UUID (required for update_connection, delete_connection)"),
     source_node_id: z.string().optional().describe("Source node UUID (required for add_connection)"),
     target_node_id: z.string().optional().describe("Target node UUID (required for add_connection)"),
@@ -74,7 +66,6 @@ export const MANAGE_DIAGRAM_SCHEMA = {
     connection_description: z.string().optional().describe("Connection description"),
     connection_tags: z.array(z.string()).optional().describe("Connection tags"),
     bidirectional: z.boolean().optional().describe("Whether connection goes both ways"),
-    // Boundary fields
     boundary_label: z.string().optional().describe("Boundary label (required for add_boundary)"),
     boundary_description: z.string().optional().describe("Boundary description"),
     boundary_color: z.string().optional().describe("Boundary hex color"),
@@ -82,7 +73,6 @@ export const MANAGE_DIAGRAM_SCHEMA = {
     boundary_position_y: z.number().optional().describe("Boundary Y position"),
     boundary_width: z.number().optional().describe("Boundary width"),
     boundary_height: z.number().optional().describe("Boundary height"),
-    // Link fields
     threat_model_id: z.string().optional().describe("Threat model UUID (link/unlink)"),
 };
 function errorResult(message) {
@@ -102,7 +92,6 @@ export function createManageDiagramHandler(apiClient) {
             const { diagram_id, action } = params;
             const base = `/api/diagrams/${diagram_id}`;
             switch (action) {
-                // ── Metadata ──
                 case "update_metadata": {
                     const body = {};
                     if (params.name)
@@ -118,7 +107,6 @@ export function createManageDiagramHandler(apiClient) {
                     await apiClient.del(base);
                     return successResult({ action: "deleted", diagram_id });
                 }
-                // ── Nodes ──
                 case "add_node": {
                     if (!params.node_name)
                         return errorResult("node_name is required for add_node");
@@ -187,7 +175,6 @@ export function createManageDiagramHandler(apiClient) {
                     await apiClient.del(`${base}/nodes/${params.node_id}`);
                     return successResult({ action: "deleted", node_id: params.node_id });
                 }
-                // ── Connections ──
                 case "add_connection": {
                     if (!params.source_node_id || !params.target_node_id) {
                         return errorResult("source_node_id and target_node_id are required for add_connection");
@@ -236,7 +223,6 @@ export function createManageDiagramHandler(apiClient) {
                     await apiClient.del(`${base}/connections/${params.connection_id}`);
                     return successResult({ action: "deleted", connection_id: params.connection_id });
                 }
-                // ── Boundaries ──
                 case "add_boundary": {
                     if (!params.boundary_label)
                         return errorResult("boundary_label is required for add_boundary");
@@ -285,7 +271,6 @@ export function createManageDiagramHandler(apiClient) {
                     await apiClient.del(`${base}/boundaries/${params.boundary_id}`);
                     return successResult({ action: "deleted", boundary_id: params.boundary_id });
                 }
-                // ── Threat Model Links ──
                 case "link_threat_model": {
                     if (!params.threat_model_id)
                         return errorResult("threat_model_id is required for link_threat_model");
@@ -313,4 +298,3 @@ export function createManageDiagramHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=manage-diagram.js.map

package/dist/tools/manage-endpoint-lifecycle.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const MANAGE_ENDPOINT_LIFECYCLE_NAME = "zivis_manage_endpoint_lifecycle";
+export declare const MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION = "Manage endpoint lifecycle for an application.\n\nActions:\n- create: create a single endpoint\n- update: patch an endpoint\n- delete: delete a single endpoint\n- bulk_delete: delete endpoints by source (e.g., openapi)\n- import_openapi: import endpoints from an OpenAPI spec";
+export declare const MANAGE_ENDPOINT_LIFECYCLE_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    action: z.ZodEnum<{
+        create: "create";
+        update: "update";
+        delete: "delete";
+        bulk_delete: "bulk_delete";
+        import_openapi: "import_openapi";
+    }>;
+    endpoint_id: z.ZodOptional<z.ZodString>;
+    path: z.ZodOptional<z.ZodString>;
+    method: z.ZodOptional<z.ZodEnum<{
+        POST: "POST";
+        GET: "GET";
+        PATCH: "PATCH";
+        PUT: "PUT";
+        DELETE: "DELETE";
+        HEAD: "HEAD";
+        OPTIONS: "OPTIONS";
+    }>>;
+    summary: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    auth_required: z.ZodOptional<z.ZodBoolean>;
+    deprecated: z.ZodOptional<z.ZodBoolean>;
+    endpoint_type: z.ZodOptional<z.ZodEnum<{
+        api: "api";
+        chat: "chat";
+        sse: "sse";
+        validation: "validation";
+        web: "web";
+    }>>;
+    request_template: z.ZodOptional<z.ZodString>;
+    response_path: z.ZodOptional<z.ZodString>;
+    streaming_enabled: z.ZodOptional<z.ZodBoolean>;
+    source: z.ZodOptional<z.ZodEnum<{
+        openapi: "openapi";
+        manual: "manual";
+        discovery: "discovery";
+    }>>;
+    spec_url: z.ZodOptional<z.ZodString>;
+    spec_content: z.ZodOptional<z.ZodString>;
+    replace_existing: z.ZodOptional<z.ZodBoolean>;
+};
+export declare function createManageEndpointLifecycleHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    action: "create" | "update" | "delete" | "bulk_delete" | "import_openapi";
+    endpoint_id?: string;
+    path?: string;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    summary?: string;
+    description?: string;
+    tags?: string[];
+    auth_required?: boolean;
+    deprecated?: boolean;
+    endpoint_type?: "api" | "chat" | "sse" | "validation" | "web";
+    request_template?: string;
+    response_path?: string;
+    streaming_enabled?: boolean;
+    source?: "openapi" | "manual" | "discovery";
+    spec_url?: string;
+    spec_content?: string;
+    replace_existing?: boolean;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/manage-endpoint-lifecycle.js

@@ -0,0 +1,180 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const MANAGE_ENDPOINT_LIFECYCLE_NAME = "zivis_manage_endpoint_lifecycle";
+export const MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION = `Manage endpoint lifecycle for an application.
+
+Actions:
+- create: create a single endpoint
+- update: patch an endpoint
+- delete: delete a single endpoint
+- bulk_delete: delete endpoints by source (e.g., openapi)
+- import_openapi: import endpoints from an OpenAPI spec`;
+export const MANAGE_ENDPOINT_LIFECYCLE_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json when set."),
+    action: z
+        .enum(["create", "update", "delete", "bulk_delete", "import_openapi"])
+        .describe("Endpoint lifecycle action"),
+    endpoint_id: z.string().optional().describe("Required for update/delete actions"),
+    path: z.string().optional().describe("Endpoint path, e.g. /api/chat"),
+    method: z
+        .enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"])
+        .optional()
+        .describe("HTTP method"),
+    summary: z.string().optional().describe("Endpoint summary"),
+    description: z.string().optional().describe("Endpoint description"),
+    tags: z.array(z.string()).optional().describe("Endpoint tags"),
+    auth_required: z.boolean().optional().describe("Whether auth is required"),
+    deprecated: z.boolean().optional().describe("Whether endpoint is deprecated"),
+    endpoint_type: z
+        .enum(["api", "chat", "sse", "validation", "web"])
+        .optional()
+        .describe("Endpoint type"),
+    request_template: z
+        .string()
+        .optional()
+        .describe("AI request template, usually includes {{message}}"),
+    response_path: z
+        .string()
+        .optional()
+        .describe("JSON path to pull response text"),
+    streaming_enabled: z.boolean().optional().describe("Whether streaming is enabled"),
+    source: z
+        .enum(["openapi", "manual", "discovery"])
+        .optional()
+        .describe("Source filter for bulk_delete"),
+    spec_url: z.string().optional().describe("OpenAPI spec URL for import_openapi"),
+    spec_content: z.string().optional().describe("Raw OpenAPI spec content"),
+    replace_existing: z
+        .boolean()
+        .optional()
+        .describe("When import_openapi, remove previous openapi endpoints first"),
+};
+export function createManageEndpointLifecycleHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        const applicationId = req.id;
+        const action = params.action;
+        try {
+            let data;
+            if (action === "create") {
+                if (!params.path || !params.method) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Error: create requires path and method",
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post(`/api/rt/applications/${applicationId}/endpoints`, {
+                    path: params.path,
+                    method: params.method,
+                    summary: params.summary,
+                    description: params.description,
+                    tags: params.tags,
+                    authRequired: params.auth_required,
+                    deprecated: params.deprecated,
+                    endpointType: params.endpoint_type,
+                    requestTemplate: params.request_template,
+                    responsePath: params.response_path,
+                    streamingEnabled: params.streaming_enabled,
+                });
+            }
+            else if (action === "update") {
+                if (!params.endpoint_id) {
+                    return {
+                        content: [
+                            { type: "text", text: "Error: endpoint_id is required for update" },
+                        ],
+                        isError: true,
+                    };
+                }
+                const body = {};
+                if (params.path !== undefined)
+                    body.path = params.path;
+                if (params.method !== undefined)
+                    body.method = params.method;
+                if (params.summary !== undefined)
+                    body.summary = params.summary;
+                if (params.description !== undefined)
+                    body.description = params.description;
+                if (params.tags !== undefined)
+                    body.tags = params.tags;
+                if (params.auth_required !== undefined)
+                    body.authRequired = params.auth_required;
+                if (params.deprecated !== undefined)
+                    body.deprecated = params.deprecated;
+                if (params.endpoint_type !== undefined)
+                    body.endpointType = params.endpoint_type;
+                if (params.request_template !== undefined)
+                    body.requestTemplate = params.request_template;
+                if (params.response_path !== undefined)
+                    body.responsePath = params.response_path;
+                if (params.streaming_enabled !== undefined) {
+                    body.streamingEnabled = params.streaming_enabled;
+                }
+                data = await apiClient.patch(`/api/rt/applications/${applicationId}/endpoints/${params.endpoint_id}`, body);
+            }
+            else if (action === "delete") {
+                if (!params.endpoint_id) {
+                    return {
+                        content: [
+                            { type: "text", text: "Error: endpoint_id is required for delete" },
+                        ],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.del(`/api/rt/applications/${applicationId}/endpoints/${params.endpoint_id}`);
+            }
+            else if (action === "bulk_delete") {
+                if (!params.source) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Error: source is required for bulk_delete (openapi/manual/discovery)",
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.del(`/api/rt/applications/${applicationId}/endpoints?source=${encodeURIComponent(params.source)}`);
+            }
+            else {
+                data = await apiClient.post(`/api/rt/applications/${applicationId}/endpoints/import-openapi`, {
+                    specUrl: params.spec_url,
+                    specContent: params.spec_content,
+                    replaceExisting: params.replace_existing ?? false,
+                });
+            }
+            const sanitized = sanitizeResponse({
+                action,
+                application_id: applicationId,
+                endpoint_id: params.endpoint_id,
+                result: data,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage endpoint lifecycle";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/open-in-ide.d.ts

@@ -1,29 +1,17 @@
-/**
- * zivis_open_in_ide — Build a vscode:// deep link that opens a ZIVIS artifact
- * inside the ZIVIS Code IDE extension.
- *
- * No API call — pure URI construction. The ZIVIS Code extension registers a
- * URI handler for `vscode://zivisai.zivis-security/<kind>?id=<uuid>` and opens
- * the matching diagram/document panel or reveals the threat model in its tree.
- *
- * Use this whenever the agent wants to surface a "open this in your IDE" link
- * (e.g. after creating a diagram, finishing a security review, or referencing
- * a threat model in a remediation suggestion).
- */
 import { z } from "zod";
 export declare const OPEN_IN_IDE_NAME = "zivis_open_in_ide";
 export declare const OPEN_IN_IDE_DESCRIPTION = "Build a vscode:// or cursor:// deep link that opens a ZIVIS artifact inside the ZIVIS Code IDE extension.\n\nReturns a URI like `vscode://zivisai.zivis-security/diagram?id=<uuid>` (or `cursor://...` when ide_client is cursor). When opened with the system's URL handler, it launches the matching desktop editor and opens the diagram, document, or threat model.\n\nSupported kinds:\n  - diagram        \u2014 opens the diagram in a webview panel\n  - document       \u2014 opens the document in a webview panel\n  - threat-model   \u2014 reveals the threat model in the ZIVIS sidebar tree\n\nRequires the ZIVIS Code extension (publisher: zivisai, name: zivis-security) to be installed in the user's IDE. If it isn't, the URI will prompt the user to install it.\n\nThis tool does not make any API calls and does not validate that the ID exists \u2014 it's a pure URI builder.";
 export declare const OPEN_IN_IDE_SCHEMA: {
     kind: z.ZodEnum<{
-        diagram: "diagram";
         document: "document";
+        diagram: "diagram";
         "threat-model": "threat-model";
     }>;
     id: z.ZodString;
     label: z.ZodOptional<z.ZodString>;
     ide_client: z.ZodOptional<z.ZodEnum<{
-        vscode: "vscode";
         cursor: "cursor";
+        vscode: "vscode";
     }>>;
 };
 export declare function createOpenInIdeHandler(): (params: {

package/dist/tools/open-in-ide.js

@@ -1,15 +1,3 @@
-/**
- * zivis_open_in_ide — Build a vscode:// deep link that opens a ZIVIS artifact
- * inside the ZIVIS Code IDE extension.
- *
- * No API call — pure URI construction. The ZIVIS Code extension registers a
- * URI handler for `vscode://zivisai.zivis-security/<kind>?id=<uuid>` and opens
- * the matching diagram/document panel or reveals the threat model in its tree.
- *
- * Use this whenever the agent wants to surface a "open this in your IDE" link
- * (e.g. after creating a diagram, finishing a security review, or referencing
- * a threat model in a remediation suggestion).
- */
 import { z } from "zod";
 export const OPEN_IN_IDE_NAME = "zivis_open_in_ide";
 export const OPEN_IN_IDE_DESCRIPTION = `Build a vscode:// or cursor:// deep link that opens a ZIVIS artifact inside the ZIVIS Code IDE extension.
@@ -58,4 +46,3 @@ export function createOpenInIdeHandler() {
         };
     };
 }
-//# sourceMappingURL=open-in-ide.js.map

package/dist/tools/review-change.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const REVIEW_CHANGE_NAME = "zivis_review_change";
+export declare const REVIEW_CHANGE_DESCRIPTION = "Preview the security-architecture impact of a proposed code change BEFORE pushing.\n\nSend a list of files about to change (before/after content). ZIVIS projects the change against the live architecture graph and returns:\n  - Which extractor modules would re-run on the diff (e.g. AI Model Inventory, Injection Surfaces)\n  - Which existing SIGNALs touch the changed files\n  - Glob matches per module so you know what's in scope\n\nUse this BEFORE making non-trivial changes to:\n  - LLM call sites (prompts, model bindings)\n  - Agent tool registrations\n  - Auth / control middleware\n  - RAG retrieval paths\n  - Any file that already produced a SIGNAL\n\nThe response is metadata-only in v1 (does not yet run the pattern matcher against the proposed diff). It tells you what would be re-evaluated, not the verdict.";
+export declare const REVIEW_CHANGE_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    changes: z.ZodArray<z.ZodObject<{
+        file_path: z.ZodString;
+        before_content: z.ZodOptional<z.ZodString>;
+        after_content: z.ZodString;
+    }, z.core.$strip>>;
+    intent: z.ZodOptional<z.ZodString>;
+};
+export declare function createReviewChangeHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    changes: Array<{
+        file_path: string;
+        before_content?: string;
+        after_content: string;
+    }>;
+    intent?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/review-change.js

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const REVIEW_CHANGE_NAME = "zivis_review_change";
+export const REVIEW_CHANGE_DESCRIPTION = `Preview the security-architecture impact of a proposed code change BEFORE pushing.
+
+Send a list of files about to change (before/after content). ZIVIS projects the change against the live architecture graph and returns:
+  - Which extractor modules would re-run on the diff (e.g. AI Model Inventory, Injection Surfaces)
+  - Which existing SIGNALs touch the changed files
+  - Glob matches per module so you know what's in scope
+
+Use this BEFORE making non-trivial changes to:
+  - LLM call sites (prompts, model bindings)
+  - Agent tool registrations
+  - Auth / control middleware
+  - RAG retrieval paths
+  - Any file that already produced a SIGNAL
+
+The response is metadata-only in v1 (does not yet run the pattern matcher against the proposed diff). It tells you what would be re-evaluated, not the verdict.`;
+export const REVIEW_CHANGE_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json."),
+    changes: z
+        .array(z.object({
+        file_path: z.string().describe("Repo-relative file path"),
+        before_content: z.string().optional().describe("Current file content (optional)"),
+        after_content: z.string().describe("Proposed new file content"),
+    }))
+        .min(1)
+        .describe("List of proposed file changes"),
+    intent: z
+        .string()
+        .optional()
+        .describe("One-line user-stated purpose of the change — e.g. 'adding a tool to the email-sender agent'"),
+};
+export function createReviewChangeHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        const application_id = req.id;
+        try {
+            const data = await apiClient.post(`/api/apps/${application_id}/review-change`, {
+                intent: params.intent,
+                changes: params.changes.map((c) => ({
+                    filePath: c.file_path,
+                    beforeContent: c.before_content,
+                    afterContent: c.after_content,
+                })),
+            });
+            const result = {
+                application_id: data.applicationId,
+                intent: data.intent,
+                modules_that_would_run: data.modulesThatWouldRun.map((m) => ({
+                    module_id: m.moduleId,
+                    matched_files: m.fileGlobMatches,
+                })),
+                modules_that_would_skip: data.modulesThatWouldSkip.map((m) => ({
+                    module_id: m.moduleId,
+                    reason: m.reason,
+                })),
+                current_signals_touching_changed_files: data.currentSignalsTouchingChangedFiles.map((s) => ({
+                    signal_id: s.signalLogicalId,
+                    title: s.title,
+                    severity: s.severity,
+                    evidence_file_paths: s.evidenceFilePaths,
+                })),
+                warnings: data.warnings,
+            };
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(sanitizeResponse(result), null, 2),
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to review change";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}