@zivis/mcp 0.1.0-alpha.9 → 0.1.6

package/dist/tools/threat-run-matcher.js

@@ -0,0 +1,145 @@
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { runMatcher } from "../matcher/index.js";
+import { buildInferenceBundle } from "../matcher/inference-candidates.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+const execAsync = promisify(exec);
+export const THREAT_RUN_MATCHER_NAME = "zivis_threat_run_matcher";
+export const THREAT_RUN_MATCHER_DESCRIPTION = `Run the local pattern matcher against the latest repo graph artifact and emit normalized threat findings.
+
+Use this when:
+- The user asks ZIVIS to actually evaluate (not just list) which patterns fire on their code
+- After 'zivis inspect' has produced an artifact and the user wants concrete findings
+- "find security issues in my code", "check this against the threat library", "what's actually wrong here"
+
+Phase 3 v1 evaluates AST strategies for real (via @ast-grep/napi for TS/JS, plus Python and Go via dynamic language packs). INFER strategies emit a candidate the host LLM is expected to pick up via zivis_threat_get_inference_prompt and run with its own model. GRAPH / META / DEP / CONFIG strategies are surfaced as fired_strategies with match_count: 0 — visible-but-not-evaluated for now.
+
+Lane assignment per finding:
+- trusted: count of fired deterministic strategies meets the capsule's required_evidence_count
+- inferred: at least one strategy fired but the bar wasn't met (host should run inference to confirm)
+
+The output is a normalized findings array with pattern_id, lane, confidence, evidence spans, and (for inferred-lane findings) an inference_candidate the host LLM uses to run deeper analysis.`;
+export const THREAT_RUN_MATCHER_SCHEMA = {
+    artifact_path: z
+        .string()
+        .optional()
+        .describe("Path to a specific RepoGraphArtifactV1 JSON. If omitted, the most recent inspect run in the user cache is used."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Repo root for source-file walking — capsule AST strategies match against files in this directory. Defaults to server cwd."),
+};
+export function createThreatRunMatcherHandler() {
+    return async (params) => {
+        const cwd = params.cwd ?? process.cwd();
+        let artifactPath;
+        try {
+            artifactPath = await resolveArtifactPath(params.artifact_path, cwd);
+        }
+        catch (err) {
+            return withNextStepsError(`No repo graph artifact found. ${err.message}`, [
+                {
+                    id: "run_zivis_inspect",
+                    label: "Run `zivis inspect` to build the local repo graph first",
+                    tool: "zivis_inspect",
+                    why: "The matcher consumes the latest inspect artifact.",
+                },
+            ], "Run `zivis inspect` first; this tool reads from its output.");
+        }
+        const result = await runMatcher({ artifactPath, cwd });
+        const inferenceBundle = await buildInferenceBundle(result.findings);
+        const headline = result.summary.total === 0
+            ? "Matcher ran cleanly — no patterns fired against this repo."
+            : `Matcher emitted ${result.summary.total} finding(s): ${result.summary.trusted_count} trusted, ${result.summary.inferred_count} inferred. ` +
+                (inferenceBundle.inference_candidates.length > 0
+                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution — see host_required_action.`
+                    : "");
+        return withNextSteps({
+            ...result,
+            host_required_action: inferenceBundle.host_required_action,
+            inference_candidates: inferenceBundle.inference_candidates,
+        }, result.summary.inferred_count > 0
+            ? [
+                {
+                    id: "get_inference_prompts",
+                    label: "Pull inference prompts for inferred-lane findings and run them in your model",
+                    tool: "zivis_threat_get_inference_prompt",
+                    why: "Each inferred finding has an inference_candidate.prompt_ref. Pass it (or the capsule_id) to retrieve the prompt bundle.",
+                },
+                {
+                    id: "review_findings",
+                    label: "Review the trusted-lane findings first; they're evidence-backed and ready for the threat model",
+                    tool: "zivis_threat_run_matcher",
+                    why: "Trusted-lane findings can land in the threat model directly. Inferred require host-LLM confirmation.",
+                },
+            ]
+            : result.summary.total === 0
+                ? [
+                    {
+                        id: "expand_pack",
+                        label: "No matches today — proprietary patterns evaluated server-side may still apply",
+                        tool: "zivis_threat_run_matcher",
+                        why: "Public pack covers a curated subset. Phase 4 sends the artifact for proprietary platform evaluation.",
+                    },
+                ]
+                : [], headline);
+    };
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function resolveArtifactPath(explicit, cwd) {
+    if (explicit) {
+        if (!fssync.existsSync(explicit)) {
+            throw new Error(`Artifact path does not exist: ${explicit}`);
+        }
+        return explicit;
+    }
+    const repoId = await deriveRepoId(cwd);
+    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
+    if (!fssync.existsSync(runsDir)) {
+        throw new Error(`No inspect runs for this repo (looked under ${runsDir}). Run \`zivis inspect\` from this directory first.`);
+    }
+    const candidates = [];
+    for (const entry of await fs.readdir(runsDir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const full = path.join(runsDir, entry);
+        const stat = await fs.stat(full);
+        candidates.push({ file: full, mtime: stat.mtimeMs });
+    }
+    if (candidates.length === 0) {
+        throw new Error(`No inspect runs found under ${runsDir}.`);
+    }
+    candidates.sort((a, b) => b.mtime - a.mtime);
+    return candidates[0].file;
+}
+async function deriveRepoId(cwd) {
+    try {
+        const { stdout } = await execAsync("git remote get-url origin", { cwd });
+        const remote = stdout.trim();
+        if (remote)
+            return "remote-" + sha256Short(remote);
+    }
+    catch {
+    }
+    return "path-" + sha256Short(cwd);
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}

package/dist/tools/update-document.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_update_document — Update a document's title, markdown content, or tags.
- *
- * Maps to: PATCH /api/documents/:id
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_DOCUMENT_NAME = "zivis_update_document";

package/dist/tools/update-document.js

@@ -1,10 +1,5 @@
-/**
- * zivis_update_document — Update a document's title, markdown content, or tags.
- *
- * Maps to: PATCH /api/documents/:id
- */
 import { z } from "zod";
-import { sanitizeResponse } from "../sanitize.js";
+import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
 export const UPDATE_DOCUMENT_NAME = "zivis_update_document";
 export const UPDATE_DOCUMENT_DESCRIPTION = `Update a document's title, markdown content, or tags. At least one of these fields must be provided.
 
@@ -47,9 +42,9 @@ export function createUpdateDocumentHandler(apiClient) {
             }
             const body = {};
             if (title !== undefined)
-                body.title = title;
+                body.title = sanitizeInboundText(title, 500);
             if (content !== undefined)
-                body.content = content;
+                body.content = sanitizeInboundText(content, 200_000);
             if (tags !== undefined)
                 body.tags = tags;
             const data = await apiClient.patch(`/api/documents/${document_id}`, body);
@@ -60,4 +55,3 @@ export function createUpdateDocumentHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-document.js.map

package/dist/tools/update-endpoint.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_update_endpoint — Update a specific endpoint's configuration
- *
- * Maps to: PATCH /api/rt/applications/:id/endpoints/:endpointId
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_ENDPOINT_NAME = "zivis_update_endpoint";
@@ -15,8 +10,8 @@ export declare const UPDATE_ENDPOINT_SCHEMA: {
         POST: "POST";
         GET: "GET";
         PATCH: "PATCH";
-        DELETE: "DELETE";
         PUT: "PUT";
+        DELETE: "DELETE";
         HEAD: "HEAD";
         OPTIONS: "OPTIONS";
     }>>;

package/dist/tools/update-endpoint.js

@@ -1,8 +1,3 @@
-/**
- * zivis_update_endpoint — Update a specific endpoint's configuration
- *
- * Maps to: PATCH /api/rt/applications/:id/endpoints/:endpointId
- */
 import { z } from "zod";
 import { requireApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -79,7 +74,6 @@ export function createUpdateEndpointHandler(apiClient) {
         }
         const application_id = req.id;
         const apiPath = `/api/rt/applications/${application_id}/endpoints/${params.endpoint_id}`;
-        // Map snake_case params to camelCase API fields, only including provided values
         const body = {};
         if (params.path !== undefined)
             body.path = params.path;
@@ -142,4 +136,3 @@ export function createUpdateEndpointHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-endpoint.js.map

package/dist/tools/update-finding.d.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const UPDATE_FINDING_NAME = "zivis_update_finding";
+export declare const UPDATE_FINDING_DESCRIPTION = "Update an existing security finding \u2014 edit its fields or change its status.\n\nUse to correct or flesh out a finding (title, severity, description, category, remediation, CWE/OWASP), or to move it through its lifecycle (triaged, resolved, dismissed, suppressed). Only pass the fields you want to change. Every change is audited. Pass the finding's id (from zivis_create_finding or the findings list). To delete a finding, use zivis_delete_finding instead.";
+export declare const UPDATE_FINDING_SCHEMA: {
+    finding_id: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodEnum<{
+        vulnerability: "vulnerability";
+        misconfiguration: "misconfiguration";
+        secret: "secret";
+        anomaly: "anomaly";
+        other: "other";
+    }>>;
+    remediation_steps: z.ZodOptional<z.ZodString>;
+    cwe_id: z.ZodOptional<z.ZodString>;
+    owasp_id: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        open: "open";
+        in_progress: "in_progress";
+        resolved: "resolved";
+        dismissed: "dismissed";
+        triaged: "triaged";
+        suppressed: "suppressed";
+    }>>;
+    dismiss_reason: z.ZodOptional<z.ZodEnum<{
+        false_positive: "false_positive";
+        risk_accepted: "risk_accepted";
+        duplicate: "duplicate";
+        wont_fix: "wont_fix";
+    }>>;
+    note: z.ZodOptional<z.ZodString>;
+};
+type UpdateFindingParams = {
+    finding_id: string;
+    title?: string;
+    severity?: "critical" | "high" | "medium" | "low" | "info";
+    description?: string;
+    category?: "vulnerability" | "misconfiguration" | "secret" | "anomaly" | "other";
+    remediation_steps?: string;
+    cwe_id?: string;
+    owasp_id?: string;
+    status?: "open" | "triaged" | "in_progress" | "resolved" | "dismissed" | "suppressed";
+    dismiss_reason?: "false_positive" | "risk_accepted" | "duplicate" | "wont_fix";
+    note?: string;
+};
+export declare function createUpdateFindingHandler(apiClient: ApiClient): (params: UpdateFindingParams) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;
+export {};

package/dist/tools/update-finding.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
+export const UPDATE_FINDING_NAME = "zivis_update_finding";
+export const UPDATE_FINDING_DESCRIPTION = `Update an existing security finding — edit its fields or change its status.
+
+Use to correct or flesh out a finding (title, severity, description, category, remediation, CWE/OWASP), or to move it through its lifecycle (triaged, resolved, dismissed, suppressed). Only pass the fields you want to change. Every change is audited. Pass the finding's id (from zivis_create_finding or the findings list). To delete a finding, use zivis_delete_finding instead.`;
+export const UPDATE_FINDING_SCHEMA = {
+    finding_id: z.string().describe("UUID of the finding to update"),
+    title: z.string().optional().describe("New title"),
+    severity: z
+        .enum(["critical", "high", "medium", "low", "info"])
+        .optional()
+        .describe("New severity"),
+    description: z.string().optional().describe("New description / details (markdown allowed)"),
+    category: z
+        .enum(["vulnerability", "misconfiguration", "secret", "anomaly", "other"])
+        .optional()
+        .describe("New category"),
+    remediation_steps: z.string().optional().describe("New remediation guidance"),
+    cwe_id: z.string().optional().describe("CWE id, e.g. 'CWE-89'"),
+    owasp_id: z.string().optional().describe("OWASP id, e.g. 'A01'"),
+    status: z
+        .enum(["open", "triaged", "in_progress", "resolved", "dismissed", "suppressed"])
+        .optional()
+        .describe("New lifecycle status. Use zivis_delete_finding to delete."),
+    dismiss_reason: z
+        .enum(["false_positive", "risk_accepted", "duplicate", "wont_fix"])
+        .optional()
+        .describe("Reason, when status=dismissed"),
+    note: z.string().optional().describe("Optional note recorded in the audit history"),
+};
+function errorResult(message) {
+    return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true,
+    };
+}
+function successResult(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+    };
+}
+export function createUpdateFindingHandler(apiClient) {
+    return async (params) => {
+        try {
+            if (!params.finding_id || !params.finding_id.trim()) {
+                return errorResult("finding_id is required");
+            }
+            const body = {};
+            if (params.title !== undefined)
+                body.title = sanitizeInboundText(params.title, 500);
+            if (params.severity !== undefined)
+                body.severity = params.severity;
+            if (params.description !== undefined)
+                body.description = sanitizeInboundText(params.description, 8000);
+            if (params.category !== undefined)
+                body.category = params.category;
+            if (params.remediation_steps !== undefined)
+                body.remediationSteps = sanitizeInboundText(params.remediation_steps, 4000);
+            if (params.cwe_id !== undefined)
+                body.cweId = params.cwe_id;
+            if (params.owasp_id !== undefined)
+                body.owaspId = params.owasp_id;
+            if (params.status !== undefined)
+                body.status = params.status;
+            if (params.dismiss_reason !== undefined)
+                body.dismissReason = sanitizeInboundText(params.dismiss_reason, 2000);
+            if (params.note !== undefined)
+                body.note = sanitizeInboundText(params.note, 4000);
+            if (Object.keys(body).length === 0) {
+                return errorResult("Provide at least one field to update");
+            }
+            const data = await apiClient.patch(`/api/findings/unified/${encodeURIComponent(params.finding_id)}`, body);
+            return successResult(data);
+        }
+        catch (err) {
+            return errorResult(err?.message ?? "Failed to update finding");
+        }
+    };
+}

package/dist/tools/update-mermaid-source.d.ts

@@ -1,16 +1,3 @@
-/**
- * zivis_update_mermaid_source — Update the Mermaid source of a diagram
- *
- * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
- *
- * Workflow for an editing AI:
- *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
- *   2. Reason about the change the user requested. Produce a new Mermaid source string.
- *   3. Call this tool with the new source to persist it.
- *
- * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
- * (contentType = "canvas"), use zivis_manage_diagram instead.
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";

package/dist/tools/update-mermaid-source.js

@@ -1,16 +1,3 @@
-/**
- * zivis_update_mermaid_source — Update the Mermaid source of a diagram
- *
- * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
- *
- * Workflow for an editing AI:
- *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
- *   2. Reason about the change the user requested. Produce a new Mermaid source string.
- *   3. Call this tool with the new source to persist it.
- *
- * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
- * (contentType = "canvas"), use zivis_manage_diagram instead.
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";
@@ -73,4 +60,3 @@ export function createUpdateMermaidSourceHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-mermaid-source.js.map

package/dist/tools/verify-trust-mark.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
- *
- * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
- */
 import { z } from "zod";
 import type { ZivisConfig } from "../types.js";
 export declare const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";

package/dist/tools/verify-trust-mark.js

@@ -1,8 +1,3 @@
-/**
- * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
- *
- * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
- */
 import { z } from "zod";
 export const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";
 export const VERIFY_TRUST_MARK_DESCRIPTION = `Verify a ZIVIS Trust Mark by its SHA-256 hash or Ed25519 compact token.
@@ -105,4 +100,3 @@ export function createVerifyTrustMarkHandler(config) {
         }
     };
 }
-//# sourceMappingURL=verify-trust-mark.js.map

package/dist/types.d.ts

@@ -1,6 +1,3 @@
-/**
- * Shared types for the ZIVIS MCP Security Server
- */
 export interface OAuthTokens {
     access_token: string;
     refresh_token?: string;
@@ -10,9 +7,7 @@ export interface OAuthTokens {
 export type AuthMethod = "oauth" | "apikey" | "none";
 export interface AuthCredentials {
     method: AuthMethod;
-    /** OAuth access token (when method === "oauth") */
     accessToken?: string;
-    /** WorkOS API key (when method === "apikey") */
     apiKey?: string;
 }
 export interface AuthStatus {
@@ -186,26 +181,31 @@ export interface SessionInfo {
 }
 export type SessionIndex = Record<string, SessionInfo>;
 export interface ProjectBinding {
-    /** Expected ZIVIS_SESSION value (e.g., "zivis", "acme-corp") */
     session: string;
-    /** Zivis org UUID (API) */
     orgId?: string;
-    /** WorkOS org id — OAuth login and JWT org_id use this boundary */
     workosOrgId?: string;
-    /** Human-readable org name */
     orgName?: string;
-    /** RT application UUID when this project is tied to a single app in the org */
     applicationId?: string;
-    /** Display name for that application (optional) */
     applicationName?: string;
+    apiBaseUrl?: string;
+    oauthApiUrl?: string;
+    oauthClientId?: string;
+    keychainPrefix?: string;
+    configDir?: string;
+}
+export interface CredentialStorage {
+    keychainPrefix: string;
+    configDir: string;
 }
 export interface ZivisConfig {
     apiBaseUrl: string;
     oauthClientId: string;
     oauthApiUrl: string;
     callbackPort: number;
-    /** Named session for multi-tenant isolation (from ZIVIS_SESSION env var) */
     session?: string;
+    keychainPrefix?: string;
+    configDir?: string;
+    workspacePath?: string;
 }
 interface EnvConfig {
     apiBaseUrl: string;
@@ -214,7 +214,7 @@ interface EnvConfig {
     keychainPrefix: string;
     configDir: string;
 }
-export declare const BUILD_ENV: "staging" | "production";
 export declare const ENV_CONFIG: EnvConfig;
 export declare const DEFAULT_CONFIG: ZivisConfig;
+export declare function credentialStorageFromConfig(config?: ZivisConfig): CredentialStorage;
 export {};

package/dist/types.js

@@ -1,33 +1,27 @@
-/**
- * Shared types for the ZIVIS MCP Security Server
- */
-const ENVIRONMENT_CONFIGS = {
-    staging: {
-        apiBaseUrl: "https://staging.zivis.ai",
-        oauthClientId: "client_01KGCMZ482H9SJPKTVRCC213K0",
-        oauthApiUrl: "https://delightful-abundance-65-staging.authkit.app",
-        keychainPrefix: "io.zivis.mcp.staging",
-        configDir: "zivis-staging",
-    },
-    production: {
-        apiBaseUrl: "https://app.zivis.ai",
-        oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
-        oauthApiUrl: "https://api.workos.com",
-        keychainPrefix: "io.zivis.mcp",
-        configDir: "zivis",
-    },
+const PRODUCTION_DEFAULTS = {
+    apiBaseUrl: "https://app.zivis.ai",
+    oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
+    oauthApiUrl: "https://auth2.zivis.ai",
+    keychainPrefix: "ai.zivis.mcp",
+    configDir: "zivis",
+};
+export const ENV_CONFIG = {
+    apiBaseUrl: process.env.ZIVIS_API_URL || PRODUCTION_DEFAULTS.apiBaseUrl,
+    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || PRODUCTION_DEFAULTS.oauthClientId,
+    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || PRODUCTION_DEFAULTS.oauthApiUrl,
+    keychainPrefix: process.env.ZIVIS_KEYCHAIN_PREFIX || PRODUCTION_DEFAULTS.keychainPrefix,
+    configDir: process.env.ZIVIS_CONFIG_DIR || PRODUCTION_DEFAULTS.configDir,
 };
-// Build-time environment (defaults to staging for development)
-export const BUILD_ENV = (process.env.ZIVIS_BUILD_ENV || "staging");
-// Get the config for the current build environment
-export const ENV_CONFIG = ENVIRONMENT_CONFIGS[BUILD_ENV] || ENVIRONMENT_CONFIGS.staging;
 export const DEFAULT_CONFIG = {
-    // Runtime env vars override build-time defaults (useful for testing)
-    apiBaseUrl: process.env.ZIVIS_API_URL || ENV_CONFIG.apiBaseUrl,
-    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || ENV_CONFIG.oauthClientId,
-    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || ENV_CONFIG.oauthApiUrl,
+    apiBaseUrl: ENV_CONFIG.apiBaseUrl,
+    oauthClientId: ENV_CONFIG.oauthClientId,
+    oauthApiUrl: ENV_CONFIG.oauthApiUrl,
     callbackPort: 8741,
-    // Session isolation for multi-tenant safety
     session: process.env.ZIVIS_SESSION || undefined,
 };
-//# sourceMappingURL=types.js.map
+export function credentialStorageFromConfig(config) {
+    return {
+        keychainPrefix: config?.keychainPrefix ?? ENV_CONFIG.keychainPrefix,
+        configDir: config?.configDir ?? ENV_CONFIG.configDir,
+    };
+}

package/package.json

@@ -1,7 +1,14 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.0-alpha.9",
+  "version": "0.1.6",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
+  "license": "Apache-2.0",
+  "homepage": "https://zivis.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zivisai/zivis-platform.git",
+    "directory": "zivis-mcp-security"
+  },
   "type": "module",
   "bin": {
     "zivis-mcp": "./dist/index.js"
@@ -13,19 +20,27 @@
     "./auth/token-refresh": "./dist/auth/token-refresh.js",
     "./api-client": "./dist/api-client.js",
     "./project-binding": "./dist/project-binding.js",
+    "./resolve-application-id": "./dist/resolve-application-id.js",
     "./server": "./dist/server.js",
     "./types": "./dist/types.js",
-    "./cli": "./dist/cli.js"
+    "./cli": "./dist/cli.js",
+    "./pattern-pack": "./dist/pattern-pack/index.js",
+    "./matcher": "./dist/matcher/index.js"
   },
   "files": [
     "dist",
-    "package.json"
+    "package.json",
+    "README.md",
+    "LICENSE"
   ],
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "scripts": {
-    "build": "tsc && node scripts/ensure-symlink.cjs",
+    "build:pattern-pack": "tsx ../scripts/build-pattern-pack.ts",
+    "build": "tsc -p tsconfig.build.json && pnpm run build:pattern-pack && node scripts/ensure-symlink.cjs",
+    "prepublishOnly": "rm -rf dist && pnpm run build",
+    "postpublish": "node -e \"const p=require('./package.json'); require('child_process').execSync('npm dist-tag add '+p.name+'@'+p.version+' latest',{stdio:'inherit'});\"",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "test": "vitest run",
@@ -37,13 +52,21 @@
     "node": ">=20.0.0"
   },
   "dependencies": {
+    "@ast-grep/lang-go": "^0.0.6",
+    "@ast-grep/lang-python": "^0.0.6",
+    "@ast-grep/napi": "^0.42.1",
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "js-yaml": "^4.1.0",
     "open": "^10.1.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
     "husky": "^9.1.7",
+    "tsx": "^4.19.2",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   }

package/dist/api-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,OAAO,SAAS;IACZ,MAAM,CAAc;IAE5B,YAAY,SAAsB,cAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB,CAAC,GAAY;QACjC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,gBAAgB,CACtB,KAAsB;QAEtB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,OAAO;gBACV,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,KAAK,QAAQ;gBACX,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC;YACxC,KAAK,MAAM;gBACT,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,0CAA0C,EAC1C,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAElE,yCAAyC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;YACtD,IACE,UAAU,CAAC,MAAM,KAAK,OAAO;gBAC7B,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAC5C,CAAC;gBACD,6BAA6B;gBAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,UAAU,CACX,CAAC;gBACF,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,IAAI,QAAQ,CAChB,wCAAwC,EACxC,GAAG,EACH,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACpB,MAAM,IAAI,QAAQ,CAChB,WAAW,CAAC,YAAY,IAAI,oBAAoB,EAChD,WAAW,CAAC,MAAM,EAClB,WAAW,CACZ,CAAC;gBACJ,CAAC;gBACD,OAAO,WAAW,CAAC,IAAK,CAAC;YAC3B,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,wCAAwC,EACxC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,MAAM,CAAC,YAAY,IAAI,uBAAuB,MAAM,IAAI,IAAI,EAAE,EAC9D,MAAM,CAAC,MAAM,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,KAAsB;QAOtB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,YAAY,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtD,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEhD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,YAAY,EACT,SAAoC,CAAC,OAAO;wBAC5C,SAAoC,CAAC,KAAK;wBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE;iBAC5B,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gBAAgB;YAChB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAChE,MAAM,IAAI,QAAQ,CAChB,mCAAmC,GAAG,MAAM,OAAO,EAAE,EACrD,CAAC,EACD,eAAe,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,0CAA0C,EAC1C,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,QAAQ,CACf,SAAoC,CAAC,OAAO;gBAC1C,SAAoC,CAAC,KAAK;gBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAC3B,QAAQ,CAAC,MAAM,EACf,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc,EACpC,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,4CAA4C;IAC5C,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,oFAAoF;IACpF,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,wCAAwC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,yDAAyD;IACzD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAsB,cAAc;IAEpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,sBAAsB,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QACpG,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/auth/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}