@zivis/mcp 0.1.10 → 0.1.11

package/dist/http-probe/capture.d.ts

@@ -0,0 +1,51 @@
+export interface CaptureRequestSpec {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string | Record<string, unknown> | unknown[];
+    label?: string;
+    timeoutMs?: number;
+}
+export interface CapturedRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string;
+    label?: string;
+}
+export interface CapturedResponse {
+    status: number;
+    status_text?: string;
+    headers: Record<string, string>;
+    body?: string;
+    body_json?: unknown;
+}
+export interface HttpCapture {
+    request: CapturedRequest;
+    response: CapturedResponse;
+    meta: {
+        captured_at: string;
+        duration_ms: number;
+        request_fingerprint: string;
+        redacted: boolean;
+        error?: string;
+    };
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    statusText?: string;
+    headers: {
+        forEach(cb: (value: string, key: string) => void): void;
+    };
+    text(): Promise<string>;
+}>;
+export declare function requestFingerprint(req: CapturedRequest): string;
+export declare function captureRequest(spec: CaptureRequestSpec, deps?: {
+    fetchImpl?: FetchLike;
+}): Promise<HttpCapture>;
+export declare function redactCapture(capture: HttpCapture): HttpCapture;

package/dist/http-probe/capture.js

@@ -0,0 +1,96 @@
+import * as crypto from "node:crypto";
+import { redactValue } from "../redact.js";
+function normalizeHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers ?? {}))
+        out[k.toLowerCase()] = String(v);
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+}
+function bodyToString(body) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    try {
+        return JSON.stringify(body);
+    }
+    catch {
+        return String(body);
+    }
+}
+export function requestFingerprint(req) {
+    const headerLines = Object.entries(req.headers)
+        .map(([k, v]) => `${k}: ${v}`)
+        .join("\n");
+    const canonical = `${req.method} ${req.url}\n${headerLines}\n\n${req.body ?? ""}`;
+    return crypto.createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+function tryJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function captureRequest(spec, deps = {}) {
+    const method = (spec.method ?? "GET").toUpperCase();
+    const headers = normalizeHeaders(spec.headers);
+    const body = bodyToString(spec.body);
+    const request = { method, url: spec.url, headers, body, label: spec.label };
+    const fingerprint = requestFingerprint(request);
+    const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), spec.timeoutMs ?? 30_000);
+    const started = Date.now();
+    try {
+        const res = await fetchImpl(spec.url, { method, headers, body, signal: controller.signal });
+        const respHeaders = {};
+        res.headers.forEach((value, key) => {
+            respHeaders[key.toLowerCase()] = value;
+        });
+        const text = await res.text();
+        const bodyJson = tryJson(text);
+        return {
+            request,
+            response: {
+                status: res.status,
+                status_text: res.statusText,
+                headers: Object.fromEntries(Object.entries(respHeaders).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))),
+                body: text,
+                body_json: bodyJson,
+            },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            request,
+            response: { status: 0, headers: {} },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+                error: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export function redactCapture(capture) {
+    const request = redactValue(capture.request).value;
+    const response = redactValue(capture.response).value;
+    return {
+        request,
+        response,
+        meta: { ...capture.meta, redacted: true },
+    };
+}

package/dist/http-probe/compare.d.ts

@@ -0,0 +1,43 @@
+import type { HttpCapture } from "./capture.js";
+export interface StatusComparison {
+    a: number;
+    b: number;
+    changed: boolean;
+}
+export interface JsonPathDiff {
+    path: string;
+    kind: "added" | "removed" | "changed";
+    a?: unknown;
+    b?: unknown;
+}
+export interface BodyComparison {
+    equal: boolean;
+    json_diffs?: JsonPathDiff[];
+    opaque_change?: boolean;
+}
+export interface HeaderDiff {
+    header: string;
+    kind: "added" | "removed" | "changed";
+    a?: string;
+    b?: string;
+}
+export type AccessSignal = "same_status" | "both_success" | "both_denied" | "access_differential" | "one_error" | "mixed";
+export interface CaptureComparison {
+    equal: boolean;
+    labels: {
+        a?: string;
+        b?: string;
+    };
+    status: StatusComparison;
+    headers: HeaderDiff[];
+    body: BodyComparison;
+    access_signal: AccessSignal;
+    summary: string;
+    same_request: boolean;
+}
+export interface CompareOptions {
+    headerAllowlist?: string[];
+    allHeaders?: boolean;
+}
+export declare function diffJson(a: unknown, b: unknown, basePath?: string): JsonPathDiff[];
+export declare function compareCaptures(a: HttpCapture, b: HttpCapture, opts?: CompareOptions): CaptureComparison;

package/dist/http-probe/compare.js

@@ -0,0 +1,117 @@
+const VOLATILE_HEADERS = new Set([
+    "date",
+    "age",
+    "etag",
+    "last-modified",
+    "expires",
+    "set-cookie",
+    "x-request-id",
+    "x-correlation-id",
+    "cf-ray",
+    "x-amz-request-id",
+    "x-amz-id-2",
+    "x-served-by",
+    "x-timer",
+    "x-runtime",
+    "server-timing",
+    "content-length",
+]);
+function isDenied(status) {
+    return status === 401 || status === 403;
+}
+function isSuccess(status) {
+    return status >= 200 && status < 300;
+}
+function isError(status) {
+    return status === 0 || status >= 500;
+}
+function classifyAccess(a, b) {
+    if (isError(a) || isError(b))
+        return "one_error";
+    if (isSuccess(a) && isSuccess(b))
+        return "both_success";
+    if (isDenied(a) && isDenied(b))
+        return "both_denied";
+    if ((isSuccess(a) && isDenied(b)) || (isDenied(a) && isSuccess(b)))
+        return "access_differential";
+    if (a === b)
+        return "same_status";
+    return "mixed";
+}
+function diffHeaders(a, b, opts) {
+    const allow = opts.headerAllowlist ? new Set(opts.headerAllowlist.map((h) => h.toLowerCase())) : null;
+    const keep = (h) => (allow ? allow.has(h) : opts.allHeaders ? true : !VOLATILE_HEADERS.has(h));
+    const keys = new Set([...Object.keys(a), ...Object.keys(b)].filter(keep));
+    const out = [];
+    for (const h of [...keys].sort()) {
+        const av = a[h];
+        const bv = b[h];
+        if (av === bv)
+            continue;
+        if (av === undefined)
+            out.push({ header: h, kind: "added", b: bv });
+        else if (bv === undefined)
+            out.push({ header: h, kind: "removed", a: av });
+        else
+            out.push({ header: h, kind: "changed", a: av, b: bv });
+    }
+    return out;
+}
+export function diffJson(a, b, basePath = "$") {
+    const diffs = [];
+    const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    if (Array.isArray(a) && Array.isArray(b)) {
+        const max = Math.max(a.length, b.length);
+        for (let i = 0; i < max; i++) {
+            const p = `${basePath}[${i}]`;
+            if (i >= a.length)
+                diffs.push({ path: p, kind: "added", b: b[i] });
+            else if (i >= b.length)
+                diffs.push({ path: p, kind: "removed", a: a[i] });
+            else
+                diffs.push(...diffJson(a[i], b[i], p));
+        }
+        return diffs;
+    }
+    if (isObj(a) && isObj(b)) {
+        const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+        for (const k of [...keys].sort()) {
+            const p = `${basePath}.${k}`;
+            if (!(k in a))
+                diffs.push({ path: p, kind: "added", b: b[k] });
+            else if (!(k in b))
+                diffs.push({ path: p, kind: "removed", a: a[k] });
+            else
+                diffs.push(...diffJson(a[k], b[k], p));
+        }
+        return diffs;
+    }
+    if (JSON.stringify(a) !== JSON.stringify(b)) {
+        diffs.push({ path: basePath, kind: "changed", a, b });
+    }
+    return diffs;
+}
+function compareBodies(a, b) {
+    const aHasJson = a.body_json !== undefined;
+    const bHasJson = b.body_json !== undefined;
+    if (aHasJson && bHasJson) {
+        const json_diffs = diffJson(a.body_json, b.body_json);
+        return { equal: json_diffs.length === 0, json_diffs };
+    }
+    const equal = (a.body ?? "") === (b.body ?? "");
+    return { equal, opaque_change: !equal };
+}
+export function compareCaptures(a, b, opts = {}) {
+    const status = { a: a.response.status, b: b.response.status, changed: a.response.status !== b.response.status };
+    const headers = diffHeaders(a.response.headers, b.response.headers, opts);
+    const body = compareBodies(a.response, b.response);
+    const access_signal = classifyAccess(a.response.status, b.response.status);
+    const same_request = a.meta.request_fingerprint === b.meta.request_fingerprint;
+    const equal = !status.changed && headers.length === 0 && body.equal;
+    const la = a.request.label ?? "A";
+    const lb = b.request.label ?? "B";
+    const summary = equal
+        ? `${la} and ${lb} are equivalent (status ${status.a}, no header/body differences).`
+        : `${la}=${status.a} vs ${lb}=${status.b}; ${headers.length} header diff(s), body ${body.equal ? "identical" : "differs"}; access_signal=${access_signal}.`;
+    return { equal, labels: { a: a.request.label, b: b.request.label }, status, headers, body, access_signal, summary, same_request };
+}

package/dist/http-probe/index.d.ts

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, type CaptureRequestSpec, type CapturedRequest, type CapturedResponse, type HttpCapture, type FetchLike, } from "./capture.js";
+export { compareCaptures, diffJson, type CaptureComparison, type CompareOptions, type StatusComparison, type BodyComparison, type HeaderDiff, type JsonPathDiff, type AccessSignal, } from "./compare.js";

package/dist/http-probe/index.js

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, } from "./capture.js";
+export { compareCaptures, diffJson, } from "./compare.js";

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-08-31T00:01:43.737Z",
+  "built_at": "2026-08-31T22:32:10.810Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/redact.d.ts

@@ -0,0 +1,30 @@
+export interface RedactionFinding {
+    rule: string;
+    path: string;
+}
+export interface RedactionReport {
+    redacted: boolean;
+    count: number;
+    byRule: Record<string, number>;
+    findings: RedactionFinding[];
+}
+interface RedactRule {
+    id: string;
+    regex: RegExp;
+    secretGroup?: number;
+}
+export declare const REDACTION_RULES: readonly RedactRule[];
+export declare function redactString(input: string, report?: RedactionReport, path?: string): {
+    text: string;
+    report: RedactionReport;
+};
+export declare const SENSITIVE_KEY_NAMES: ReadonlySet<string>;
+export interface RedactOptions {
+    maxDepth?: number;
+}
+export declare function redactValue<T>(value: T, opts?: RedactOptions): {
+    value: T;
+    report: RedactionReport;
+};
+export declare function redactEvidence<T>(value: T): T;
+export {};

package/dist/redact.js

@@ -0,0 +1,164 @@
+function emptyReport() {
+    return { redacted: false, count: 0, byRule: {}, findings: [] };
+}
+function record(report, rule, path) {
+    report.redacted = true;
+    report.count += 1;
+    report.byRule[rule] = (report.byRule[rule] ?? 0) + 1;
+    report.findings.push({ rule, path });
+}
+const MASK = (id) => `[REDACTED:${id}]`;
+export const REDACTION_RULES = [
+    {
+        id: "auth-header",
+        regex: /^([ \t]*(?:authorization|proxy-authorization|www-authenticate|cookie|set-cookie|x-api-key|x-apikey|x-auth-token|x-access-token|x-session-token|x-refresh-token|x-amz-security-token|api-key|apikey)[ \t]*:[ \t]*)(.+)$/gim,
+        secretGroup: 2,
+    },
+    { id: "bearer-token", regex: /\b(Bearer[ \t]+)([A-Za-z0-9._~+/=-]{8,})/gi, secretGroup: 2 },
+    { id: "basic-auth", regex: /\b(Basic[ \t]+)([A-Za-z0-9+/=]{8,})/gi, secretGroup: 2 },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    { id: "jwt", regex: /\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g },
+    { id: "aws-access-key-id", regex: /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g },
+    {
+        id: "aws-secret-access-key",
+        regex: /(aws_?secret_?access_?key["' ]*[=:]["' ]*)([A-Za-z0-9/+=]{40})/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "azure-storage-key",
+        regex: /(AccountKey=)([A-Za-z0-9+/=]{40,})/gi,
+        secretGroup: 2,
+    },
+    { id: "google-api-key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: "github-token", regex: /\bgh[pousr]_[A-Za-z0-9_]{36,}\b/g },
+    { id: "slack-token", regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}/g },
+    { id: "slack-webhook", regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g },
+    { id: "stripe-key", regex: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+    { id: "sendgrid-key", regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g },
+    { id: "npm-token", regex: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { id: "anthropic-key", regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "openai-key", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    {
+        id: "connection-string-password",
+        regex: /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqps?|https?):\/\/[^:@/\s]+:)([^@/\s]+)(@)/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "generic-secret-assignment",
+        regex: /\b(password|passwd|pwd|secret|client[_-]?secret|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|private[_-]?key|passphrase)\b(["' ]*[=:]["' ]*)([^\s"',;&})]{6,})/gi,
+        secretGroup: 3,
+    },
+];
+export function redactString(input, report = emptyReport(), path = "") {
+    if (typeof input !== "string" || input.length === 0) {
+        return { text: input, report };
+    }
+    let text = input;
+    for (const rule of REDACTION_RULES) {
+        if (rule.secretGroup === undefined) {
+            text = text.replace(rule.regex, () => {
+                record(report, rule.id, path);
+                return MASK(rule.id);
+            });
+        }
+        else {
+            const g = rule.secretGroup;
+            text = text.replace(rule.regex, (match, ...groups) => {
+                const secret = groups[g - 1];
+                if (secret === undefined || secret === "")
+                    return match;
+                record(report, rule.id, path);
+                const idx = match.lastIndexOf(String(secret));
+                if (idx < 0)
+                    return MASK(rule.id);
+                return match.slice(0, idx) + MASK(rule.id) + match.slice(idx + String(secret).length);
+            });
+        }
+    }
+    return { text, report };
+}
+export const SENSITIVE_KEY_NAMES = new Set([
+    "authorization",
+    "proxyauthorization",
+    "cookie",
+    "setcookie",
+    "xapikey",
+    "xauthtoken",
+    "xaccesstoken",
+    "xsessiontoken",
+    "xrefreshtoken",
+    "xamzsecuritytoken",
+    "apikey",
+    "apitoken",
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "secret",
+    "clientsecret",
+    "secretkey",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "authtoken",
+    "sessiontoken",
+    "sessionid",
+    "session",
+    "privatekey",
+    "credential",
+    "credentials",
+    "bearer",
+    "auth",
+].map((k) => k.replace(/[-_]/g, "")));
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_]/g, "");
+}
+export function redactValue(value, opts = {}) {
+    const report = emptyReport();
+    const maxDepth = opts.maxDepth ?? 64;
+    const seen = new WeakSet();
+    const walk = (node, path, depth, underSensitiveKey) => {
+        if (node === null || node === undefined)
+            return node;
+        if (typeof node === "string") {
+            if (underSensitiveKey) {
+                if (node.length > 0) {
+                    record(report, "sensitive-key", path);
+                    return MASK("sensitive-key");
+                }
+                return node;
+            }
+            return redactString(node, report, path).text;
+        }
+        if (typeof node !== "object")
+            return node;
+        if (seen.has(node))
+            return "[CYCLE]";
+        if (depth >= maxDepth)
+            return node;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            return node.map((item, i) => walk(item, `${path}[${i}]`, depth + 1, underSensitiveKey));
+        }
+        const out = {};
+        for (const [key, v] of Object.entries(node)) {
+            const childPath = path ? `${path}.${key}` : key;
+            const sensitive = underSensitiveKey || SENSITIVE_KEY_NAMES.has(normalizeKey(key));
+            out[key] = walk(v, childPath, depth + 1, sensitive);
+        }
+        return out;
+    };
+    const redacted = walk(value, "", 0, false);
+    return { value: redacted, report };
+}
+export function redactEvidence(value) {
+    return redactValue(value).value;
+}

package/dist/scanners/index.d.ts

@@ -0,0 +1,3 @@
+export type { ScannerId, LeadSeverity, LeadLocation, NormalizedLead, ScannerRunResult, LocalScanReport, } from "./types.js";
+export { normalizeScannerOutput, normalizeGitleaks, normalizeTrivy, normalizeSemgrep, normalizeOsvScanner, } from "./normalize.js";
+export { SUPPORTED_SCANNERS, SCANNER_BINARIES, scannerCommand, runOneScanner, runLocalScanners, aggregate, defaultExecEnv, type ScannerCommand, type ScannerExecEnv, type RunLocalScannersOptions, } from "./run.js";

package/dist/scanners/index.js

@@ -0,0 +1,2 @@
+export { normalizeScannerOutput, normalizeGitleaks, normalizeTrivy, normalizeSemgrep, normalizeOsvScanner, } from "./normalize.js";
+export { SUPPORTED_SCANNERS, SCANNER_BINARIES, scannerCommand, runOneScanner, runLocalScanners, aggregate, defaultExecEnv, } from "./run.js";

package/dist/scanners/normalize.d.ts

@@ -0,0 +1,6 @@
+import type { NormalizedLead, ScannerId } from "./types.js";
+export declare function normalizeGitleaks(parsed: unknown): NormalizedLead[];
+export declare function normalizeTrivy(parsed: unknown): NormalizedLead[];
+export declare function normalizeSemgrep(parsed: unknown): NormalizedLead[];
+export declare function normalizeOsvScanner(parsed: unknown): NormalizedLead[];
+export declare function normalizeScannerOutput(source: ScannerId, parsed: unknown): NormalizedLead[];

package/dist/scanners/normalize.js

@@ -0,0 +1,181 @@
+import { redactString } from "../redact.js";
+function redact(text) {
+    if (text === undefined || text === null || text === "")
+        return undefined;
+    return redactString(String(text)).text;
+}
+function normalizeSeverity(raw) {
+    const s = String(raw ?? "").toLowerCase();
+    if (s.startsWith("crit"))
+        return "critical";
+    if (s === "high" || s === "error")
+        return "high";
+    if (s === "medium" || s === "moderate" || s === "warning" || s === "warn")
+        return "medium";
+    if (s === "low")
+        return "low";
+    if (s === "info" || s === "informational" || s === "unknown" || s === "none" || s === "") {
+        return s === "" || s === "unknown" || s === "none" ? "unknown" : "info";
+    }
+    return "unknown";
+}
+function asArray(v) {
+    return Array.isArray(v) ? v : [];
+}
+function lead(base) {
+    return { lane: "lead", ...base };
+}
+export function normalizeGitleaks(parsed) {
+    const findings = asArray(parsed);
+    return findings.map((f) => {
+        const tags = Array.isArray(f.Tags) ? f.Tags : [];
+        const sevTag = tags.find((t) => ["critical", "high", "medium", "low"].includes(String(t).toLowerCase()));
+        return lead({
+            source: "gitleaks",
+            rule_id: f.RuleID ?? "gitleaks-secret",
+            title: f.Description ?? f.RuleID ?? "Potential secret",
+            severity: sevTag ? normalizeSeverity(sevTag) : "high",
+            location: { file: f.File, start_line: f.StartLine, end_line: f.EndLine },
+            excerpt: redact(f.Match),
+            metadata: tags.length ? { tags } : undefined,
+        });
+    });
+}
+export function normalizeTrivy(parsed) {
+    const results = asArray(parsed?.Results);
+    const out = [];
+    for (const r of results) {
+        for (const v of asArray(r.Vulnerabilities)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: v.VulnerabilityID ?? "trivy-vuln",
+                title: v.Title ?? `${v.PkgName ?? "dependency"} ${v.VulnerabilityID ?? ""}`.trim(),
+                severity: normalizeSeverity(v.Severity),
+                location: { file: r.Target },
+                package: v.PkgName,
+                cwe: Array.isArray(v.CweIDs) && v.CweIDs.length ? v.CweIDs : undefined,
+                references: dedupeRefs(v.PrimaryURL, v.References),
+                metadata: {
+                    installed_version: v.InstalledVersion,
+                    fixed_version: v.FixedVersion,
+                },
+            }));
+        }
+        for (const s of asArray(r.Secrets)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: s.RuleID ?? "trivy-secret",
+                title: s.Title ?? "Potential secret",
+                severity: normalizeSeverity(s.Severity ?? "high"),
+                location: { file: r.Target, start_line: s.StartLine, end_line: s.EndLine },
+                excerpt: redact(s.Match),
+            }));
+        }
+        for (const m of asArray(r.Misconfigurations)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: m.ID ?? "trivy-misconfig",
+                title: m.Title ?? m.ID ?? "Misconfiguration",
+                severity: normalizeSeverity(m.Severity),
+                location: { file: r.Target },
+                references: dedupeRefs(m.PrimaryURL, m.References),
+            }));
+        }
+    }
+    return out;
+}
+export function normalizeSemgrep(parsed) {
+    const results = asArray(parsed?.results);
+    return results.map((r) => {
+        const meta = r.extra?.metadata ?? {};
+        return lead({
+            source: "semgrep",
+            rule_id: r.check_id ?? "semgrep-rule",
+            title: r.extra?.message ?? r.check_id ?? "Semgrep match",
+            severity: normalizeSeverity(r.extra?.severity),
+            location: { file: r.path, start_line: r.start?.line, end_line: r.end?.line },
+            cwe: toStringArray(meta.cwe),
+            owasp: toStringArray(meta.owasp),
+            references: Array.isArray(meta.references) ? meta.references : undefined,
+            excerpt: redact(r.extra?.lines),
+        });
+    });
+}
+export function normalizeOsvScanner(parsed) {
+    const results = asArray(parsed?.results);
+    const out = [];
+    for (const src of results) {
+        const file = src.source?.path;
+        for (const pkg of asArray(src.packages)) {
+            const pkgName = pkg.package?.name;
+            const groupSeverity = new Map();
+            for (const g of asArray(pkg.groups)) {
+                for (const id of asArray(g.ids)) {
+                    if (g.max_severity)
+                        groupSeverity.set(id, g.max_severity);
+                }
+            }
+            for (const v of asArray(pkg.vulnerabilities)) {
+                out.push(lead({
+                    source: "osv-scanner",
+                    rule_id: v.id ?? "osv-vuln",
+                    title: v.summary ?? `${pkgName ?? "dependency"} ${v.id ?? ""}`.trim(),
+                    severity: cvssScoreToSeverity(groupSeverity.get(v.id ?? "")),
+                    location: { file },
+                    package: pkgName,
+                    references: asArray(v.references)
+                        .map((r) => r.url)
+                        .filter((u) => typeof u === "string"),
+                    metadata: { version: pkg.package?.version, ecosystem: pkg.package?.ecosystem },
+                }));
+            }
+        }
+    }
+    return out;
+}
+function toStringArray(v) {
+    if (v === undefined || v === null)
+        return undefined;
+    const arr = Array.isArray(v) ? v : [v];
+    const out = arr.map((x) => String(x)).filter(Boolean);
+    return out.length ? out : undefined;
+}
+function dedupeRefs(primary, refs) {
+    const set = new Set();
+    if (primary)
+        set.add(primary);
+    for (const r of Array.isArray(refs) ? refs : [])
+        if (r)
+            set.add(r);
+    return set.size ? [...set] : undefined;
+}
+function cvssScoreToSeverity(score) {
+    if (!score)
+        return "unknown";
+    const n = Number.parseFloat(score);
+    if (Number.isNaN(n))
+        return "unknown";
+    if (n >= 9.0)
+        return "critical";
+    if (n >= 7.0)
+        return "high";
+    if (n >= 4.0)
+        return "medium";
+    if (n > 0)
+        return "low";
+    return "unknown";
+}
+export function normalizeScannerOutput(source, parsed) {
+    switch (source) {
+        case "gitleaks":
+            return normalizeGitleaks(parsed);
+        case "trivy":
+            return normalizeTrivy(parsed);
+        case "semgrep":
+            return normalizeSemgrep(parsed);
+        case "osv-scanner":
+            return normalizeOsvScanner(parsed);
+        default:
+            return [];
+    }
+}

package/dist/scanners/run.d.ts

@@ -0,0 +1,27 @@
+import type { LocalScanReport, ScannerId, ScannerRunResult } from "./types.js";
+export declare const SUPPORTED_SCANNERS: readonly ScannerId[];
+export declare const SCANNER_BINARIES: Record<ScannerId, string>;
+export interface ScannerCommand {
+    bin: string;
+    args: string[];
+}
+export declare function scannerCommand(source: ScannerId, dir: string, outPath: string): ScannerCommand;
+export interface ScannerExecEnv {
+    isAvailable(bin: string): Promise<boolean>;
+    execute(cmd: ScannerCommand, opts: {
+        timeoutMs: number;
+    }): Promise<{
+        reportText: string | null;
+        error?: string;
+    }>;
+}
+export declare const defaultExecEnv: ScannerExecEnv;
+export interface RunLocalScannersOptions {
+    sources?: ScannerId[];
+    timeoutMs?: number;
+    env?: ScannerExecEnv;
+    tmpDir?: string;
+}
+export declare function runOneScanner(source: ScannerId, dir: string, opts?: RunLocalScannersOptions): Promise<ScannerRunResult>;
+export declare function runLocalScanners(dir: string, opts?: RunLocalScannersOptions): Promise<LocalScanReport>;
+export declare function aggregate(results: ScannerRunResult[]): LocalScanReport;

package/dist/scanners/run.js

@@ -0,0 +1,142 @@
+import * as os from "node:os";
+import * as path from "node:path";
+import * as fs from "node:fs/promises";
+import * as crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { normalizeScannerOutput } from "./normalize.js";
+export const SUPPORTED_SCANNERS = ["gitleaks", "trivy", "semgrep", "osv-scanner"];
+export const SCANNER_BINARIES = {
+    gitleaks: "gitleaks",
+    trivy: "trivy",
+    semgrep: "semgrep",
+    "osv-scanner": "osv-scanner",
+};
+export function scannerCommand(source, dir, outPath) {
+    switch (source) {
+        case "gitleaks":
+            return {
+                bin: "gitleaks",
+                args: ["detect", "--source", dir, "--no-banner", "--report-format", "json", "--report-path", outPath, "--exit-code", "0"],
+            };
+        case "trivy":
+            return {
+                bin: "trivy",
+                args: ["fs", "--quiet", "--format", "json", "--output", outPath, "--scanners", "vuln,secret,misconfig", dir],
+            };
+        case "semgrep":
+            return {
+                bin: "semgrep",
+                args: ["scan", "--json", "--output", outPath, "--quiet", "--config", process.env.ZIVIS_SEMGREP_CONFIG || "auto", dir],
+            };
+        case "osv-scanner":
+            return {
+                bin: "osv-scanner",
+                args: ["--format", "json", "--output", outPath, "--recursive", dir],
+            };
+        default:
+            throw new Error(`unknown scanner: ${source}`);
+    }
+}
+const execFileAsync = (bin, args, timeoutMs) => new Promise((resolve) => {
+    execFile(bin, args, { timeout: timeoutMs, maxBuffer: 64 * 1024 * 1024 }, (err) => {
+        const code = err && typeof err.code === "number" ? (err.code) : err ? 1 : 0;
+        resolve({ code, stderr: err ? String(err.message ?? "") : "" });
+    });
+});
+export const defaultExecEnv = {
+    async isAvailable(bin) {
+        return new Promise((resolve) => {
+            execFile(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [bin] : ["-v", bin], { shell: true, timeout: 5000 }, (err) => {
+                resolve(!err);
+            });
+        });
+    },
+    async execute(cmd, opts) {
+        const outIdx = cmd.args.findIndex((a) => a === "--output" || a === "--report-path");
+        const outPath = outIdx >= 0 ? cmd.args[outIdx + 1] : undefined;
+        if (!outPath)
+            return { reportText: null, error: "no output path in command" };
+        try {
+            await execFileAsync(cmd.bin, cmd.args, opts.timeoutMs);
+            const text = await fs.readFile(outPath, "utf8").catch(() => null);
+            return { reportText: text };
+        }
+        catch (err) {
+            return { reportText: null, error: err instanceof Error ? err.message : String(err) };
+        }
+        finally {
+            if (outPath)
+                await fs.rm(outPath, { force: true }).catch(() => { });
+        }
+    },
+};
+export async function runOneScanner(source, dir, opts = {}) {
+    const env = opts.env ?? defaultExecEnv;
+    const bin = SCANNER_BINARIES[source];
+    const started = Date.now();
+    if (!(await env.isAvailable(bin))) {
+        return { source, status: "not_installed", leads: [] };
+    }
+    const tmpDir = opts.tmpDir ?? os.tmpdir();
+    const outPath = path.join(tmpDir, `zivis-${source}-${crypto.randomUUID()}.json`);
+    const cmd = scannerCommand(source, dir, outPath);
+    try {
+        const { reportText, error } = await env.execute(cmd, { timeoutMs: opts.timeoutMs ?? 120_000 });
+        if (error && reportText === null) {
+            return { source, status: "error", leads: [], error, duration_ms: Date.now() - started };
+        }
+        if (reportText === null || reportText.trim() === "") {
+            return { source, status: "ok", leads: [], duration_ms: Date.now() - started };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(reportText);
+        }
+        catch (e) {
+            return { source, status: "error", leads: [], error: `unparseable ${source} JSON: ${e instanceof Error ? e.message : String(e)}`, duration_ms: Date.now() - started };
+        }
+        const leads = normalizeScannerOutput(source, parsed);
+        return { source, status: "ok", leads, duration_ms: Date.now() - started };
+    }
+    catch (err) {
+        return { source, status: "error", leads: [], error: err instanceof Error ? err.message : String(err), duration_ms: Date.now() - started };
+    }
+}
+export async function runLocalScanners(dir, opts = {}) {
+    const sources = opts.sources ?? [...SUPPORTED_SCANNERS];
+    const results = [];
+    for (const source of sources) {
+        results.push(await runOneScanner(source, dir, opts));
+    }
+    return aggregate(results);
+}
+export function aggregate(results) {
+    const leads = [];
+    const bySource = {};
+    const bySeverity = {};
+    const scannersRun = [];
+    const scannersMissing = [];
+    for (const r of results) {
+        if (r.status === "not_installed")
+            scannersMissing.push(r.source);
+        else
+            scannersRun.push(r.source);
+        for (const l of r.leads) {
+            leads.push(l);
+            bySource[l.source] = (bySource[l.source] ?? 0) + 1;
+            bySeverity[l.severity] = (bySeverity[l.severity] ?? 0) + 1;
+        }
+    }
+    return {
+        ran_at: new Date().toISOString(),
+        results,
+        leads,
+        summary: {
+            total_leads: leads.length,
+            by_source: bySource,
+            by_severity: bySeverity,
+            scanners_run: scannersRun,
+            scanners_missing: scannersMissing,
+        },
+    };
+}

package/dist/scanners/types.d.ts

@@ -0,0 +1,40 @@
+export type ScannerId = "gitleaks" | "trivy" | "semgrep" | "osv-scanner";
+export type LeadSeverity = "critical" | "high" | "medium" | "low" | "info" | "unknown";
+export interface LeadLocation {
+    file?: string;
+    start_line?: number;
+    end_line?: number;
+}
+export interface NormalizedLead {
+    lane: "lead";
+    source: ScannerId;
+    rule_id: string;
+    title: string;
+    severity: LeadSeverity;
+    location?: LeadLocation;
+    package?: string;
+    cwe?: string[];
+    owasp?: string[];
+    references?: string[];
+    excerpt?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface ScannerRunResult {
+    source: ScannerId;
+    status: "ok" | "not_installed" | "error";
+    leads: NormalizedLead[];
+    error?: string;
+    duration_ms?: number;
+}
+export interface LocalScanReport {
+    ran_at: string;
+    results: ScannerRunResult[];
+    leads: NormalizedLead[];
+    summary: {
+        total_leads: number;
+        by_source: Record<string, number>;
+        by_severity: Record<string, number>;
+        scanners_run: ScannerId[];
+        scanners_missing: ScannerId[];
+    };
+}

package/dist/scanners/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",
@@ -24,6 +24,9 @@
     "./server": "./dist/server.js",
     "./types": "./dist/types.js",
     "./cli": "./dist/cli.js",
+    "./redact": "./dist/redact.js",
+    "./scanners": "./dist/scanners/index.js",
+    "./http-probe": "./dist/http-probe/index.js",
     "./pattern-pack": "./dist/pattern-pack/index.js",
     "./matcher": "./dist/matcher/index.js"
   },