@zivis/mcp 0.1.10 → 0.1.12

package/dist/http-probe/capture.d.ts

@@ -0,0 +1,51 @@
+export interface CaptureRequestSpec {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string | Record<string, unknown> | unknown[];
+    label?: string;
+    timeoutMs?: number;
+}
+export interface CapturedRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string;
+    label?: string;
+}
+export interface CapturedResponse {
+    status: number;
+    status_text?: string;
+    headers: Record<string, string>;
+    body?: string;
+    body_json?: unknown;
+}
+export interface HttpCapture {
+    request: CapturedRequest;
+    response: CapturedResponse;
+    meta: {
+        captured_at: string;
+        duration_ms: number;
+        request_fingerprint: string;
+        redacted: boolean;
+        error?: string;
+    };
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    statusText?: string;
+    headers: {
+        forEach(cb: (value: string, key: string) => void): void;
+    };
+    text(): Promise<string>;
+}>;
+export declare function requestFingerprint(req: CapturedRequest): string;
+export declare function captureRequest(spec: CaptureRequestSpec, deps?: {
+    fetchImpl?: FetchLike;
+}): Promise<HttpCapture>;
+export declare function redactCapture(capture: HttpCapture): HttpCapture;

package/dist/http-probe/capture.js

@@ -0,0 +1,96 @@
+import * as crypto from "node:crypto";
+import { redactValue } from "../redact.js";
+function normalizeHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers ?? {}))
+        out[k.toLowerCase()] = String(v);
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+}
+function bodyToString(body) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    try {
+        return JSON.stringify(body);
+    }
+    catch {
+        return String(body);
+    }
+}
+export function requestFingerprint(req) {
+    const headerLines = Object.entries(req.headers)
+        .map(([k, v]) => `${k}: ${v}`)
+        .join("\n");
+    const canonical = `${req.method} ${req.url}\n${headerLines}\n\n${req.body ?? ""}`;
+    return crypto.createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+function tryJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function captureRequest(spec, deps = {}) {
+    const method = (spec.method ?? "GET").toUpperCase();
+    const headers = normalizeHeaders(spec.headers);
+    const body = bodyToString(spec.body);
+    const request = { method, url: spec.url, headers, body, label: spec.label };
+    const fingerprint = requestFingerprint(request);
+    const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), spec.timeoutMs ?? 30_000);
+    const started = Date.now();
+    try {
+        const res = await fetchImpl(spec.url, { method, headers, body, signal: controller.signal });
+        const respHeaders = {};
+        res.headers.forEach((value, key) => {
+            respHeaders[key.toLowerCase()] = value;
+        });
+        const text = await res.text();
+        const bodyJson = tryJson(text);
+        return {
+            request,
+            response: {
+                status: res.status,
+                status_text: res.statusText,
+                headers: Object.fromEntries(Object.entries(respHeaders).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))),
+                body: text,
+                body_json: bodyJson,
+            },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            request,
+            response: { status: 0, headers: {} },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+                error: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export function redactCapture(capture) {
+    const request = redactValue(capture.request).value;
+    const response = redactValue(capture.response).value;
+    return {
+        request,
+        response,
+        meta: { ...capture.meta, redacted: true },
+    };
+}

package/dist/http-probe/compare.d.ts

@@ -0,0 +1,43 @@
+import type { HttpCapture } from "./capture.js";
+export interface StatusComparison {
+    a: number;
+    b: number;
+    changed: boolean;
+}
+export interface JsonPathDiff {
+    path: string;
+    kind: "added" | "removed" | "changed";
+    a?: unknown;
+    b?: unknown;
+}
+export interface BodyComparison {
+    equal: boolean;
+    json_diffs?: JsonPathDiff[];
+    opaque_change?: boolean;
+}
+export interface HeaderDiff {
+    header: string;
+    kind: "added" | "removed" | "changed";
+    a?: string;
+    b?: string;
+}
+export type AccessSignal = "same_status" | "both_success" | "both_denied" | "access_differential" | "one_error" | "mixed";
+export interface CaptureComparison {
+    equal: boolean;
+    labels: {
+        a?: string;
+        b?: string;
+    };
+    status: StatusComparison;
+    headers: HeaderDiff[];
+    body: BodyComparison;
+    access_signal: AccessSignal;
+    summary: string;
+    same_request: boolean;
+}
+export interface CompareOptions {
+    headerAllowlist?: string[];
+    allHeaders?: boolean;
+}
+export declare function diffJson(a: unknown, b: unknown, basePath?: string): JsonPathDiff[];
+export declare function compareCaptures(a: HttpCapture, b: HttpCapture, opts?: CompareOptions): CaptureComparison;

package/dist/http-probe/compare.js

@@ -0,0 +1,117 @@
+const VOLATILE_HEADERS = new Set([
+    "date",
+    "age",
+    "etag",
+    "last-modified",
+    "expires",
+    "set-cookie",
+    "x-request-id",
+    "x-correlation-id",
+    "cf-ray",
+    "x-amz-request-id",
+    "x-amz-id-2",
+    "x-served-by",
+    "x-timer",
+    "x-runtime",
+    "server-timing",
+    "content-length",
+]);
+function isDenied(status) {
+    return status === 401 || status === 403;
+}
+function isSuccess(status) {
+    return status >= 200 && status < 300;
+}
+function isError(status) {
+    return status === 0 || status >= 500;
+}
+function classifyAccess(a, b) {
+    if (isError(a) || isError(b))
+        return "one_error";
+    if (isSuccess(a) && isSuccess(b))
+        return "both_success";
+    if (isDenied(a) && isDenied(b))
+        return "both_denied";
+    if ((isSuccess(a) && isDenied(b)) || (isDenied(a) && isSuccess(b)))
+        return "access_differential";
+    if (a === b)
+        return "same_status";
+    return "mixed";
+}
+function diffHeaders(a, b, opts) {
+    const allow = opts.headerAllowlist ? new Set(opts.headerAllowlist.map((h) => h.toLowerCase())) : null;
+    const keep = (h) => (allow ? allow.has(h) : opts.allHeaders ? true : !VOLATILE_HEADERS.has(h));
+    const keys = new Set([...Object.keys(a), ...Object.keys(b)].filter(keep));
+    const out = [];
+    for (const h of [...keys].sort()) {
+        const av = a[h];
+        const bv = b[h];
+        if (av === bv)
+            continue;
+        if (av === undefined)
+            out.push({ header: h, kind: "added", b: bv });
+        else if (bv === undefined)
+            out.push({ header: h, kind: "removed", a: av });
+        else
+            out.push({ header: h, kind: "changed", a: av, b: bv });
+    }
+    return out;
+}
+export function diffJson(a, b, basePath = "$") {
+    const diffs = [];
+    const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    if (Array.isArray(a) && Array.isArray(b)) {
+        const max = Math.max(a.length, b.length);
+        for (let i = 0; i < max; i++) {
+            const p = `${basePath}[${i}]`;
+            if (i >= a.length)
+                diffs.push({ path: p, kind: "added", b: b[i] });
+            else if (i >= b.length)
+                diffs.push({ path: p, kind: "removed", a: a[i] });
+            else
+                diffs.push(...diffJson(a[i], b[i], p));
+        }
+        return diffs;
+    }
+    if (isObj(a) && isObj(b)) {
+        const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+        for (const k of [...keys].sort()) {
+            const p = `${basePath}.${k}`;
+            if (!(k in a))
+                diffs.push({ path: p, kind: "added", b: b[k] });
+            else if (!(k in b))
+                diffs.push({ path: p, kind: "removed", a: a[k] });
+            else
+                diffs.push(...diffJson(a[k], b[k], p));
+        }
+        return diffs;
+    }
+    if (JSON.stringify(a) !== JSON.stringify(b)) {
+        diffs.push({ path: basePath, kind: "changed", a, b });
+    }
+    return diffs;
+}
+function compareBodies(a, b) {
+    const aHasJson = a.body_json !== undefined;
+    const bHasJson = b.body_json !== undefined;
+    if (aHasJson && bHasJson) {
+        const json_diffs = diffJson(a.body_json, b.body_json);
+        return { equal: json_diffs.length === 0, json_diffs };
+    }
+    const equal = (a.body ?? "") === (b.body ?? "");
+    return { equal, opaque_change: !equal };
+}
+export function compareCaptures(a, b, opts = {}) {
+    const status = { a: a.response.status, b: b.response.status, changed: a.response.status !== b.response.status };
+    const headers = diffHeaders(a.response.headers, b.response.headers, opts);
+    const body = compareBodies(a.response, b.response);
+    const access_signal = classifyAccess(a.response.status, b.response.status);
+    const same_request = a.meta.request_fingerprint === b.meta.request_fingerprint;
+    const equal = !status.changed && headers.length === 0 && body.equal;
+    const la = a.request.label ?? "A";
+    const lb = b.request.label ?? "B";
+    const summary = equal
+        ? `${la} and ${lb} are equivalent (status ${status.a}, no header/body differences).`
+        : `${la}=${status.a} vs ${lb}=${status.b}; ${headers.length} header diff(s), body ${body.equal ? "identical" : "differs"}; access_signal=${access_signal}.`;
+    return { equal, labels: { a: a.request.label, b: b.request.label }, status, headers, body, access_signal, summary, same_request };
+}

package/dist/http-probe/index.d.ts

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, type CaptureRequestSpec, type CapturedRequest, type CapturedResponse, type HttpCapture, type FetchLike, } from "./capture.js";
+export { compareCaptures, diffJson, type CaptureComparison, type CompareOptions, type StatusComparison, type BodyComparison, type HeaderDiff, type JsonPathDiff, type AccessSignal, } from "./compare.js";

package/dist/http-probe/index.js

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, } from "./capture.js";
+export { compareCaptures, diffJson, } from "./compare.js";

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-08-31T00:01:43.737Z",
+  "built_at": "2026-09-01T21:19:00.226Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/redact.d.ts

@@ -0,0 +1,30 @@
+export interface RedactionFinding {
+    rule: string;
+    path: string;
+}
+export interface RedactionReport {
+    redacted: boolean;
+    count: number;
+    byRule: Record<string, number>;
+    findings: RedactionFinding[];
+}
+interface RedactRule {
+    id: string;
+    regex: RegExp;
+    secretGroup?: number;
+}
+export declare const REDACTION_RULES: readonly RedactRule[];
+export declare function redactString(input: string, report?: RedactionReport, path?: string): {
+    text: string;
+    report: RedactionReport;
+};
+export declare const SENSITIVE_KEY_NAMES: ReadonlySet<string>;
+export interface RedactOptions {
+    maxDepth?: number;
+}
+export declare function redactValue<T>(value: T, opts?: RedactOptions): {
+    value: T;
+    report: RedactionReport;
+};
+export declare function redactEvidence<T>(value: T): T;
+export {};

package/dist/redact.js

@@ -0,0 +1,164 @@
+function emptyReport() {
+    return { redacted: false, count: 0, byRule: {}, findings: [] };
+}
+function record(report, rule, path) {
+    report.redacted = true;
+    report.count += 1;
+    report.byRule[rule] = (report.byRule[rule] ?? 0) + 1;
+    report.findings.push({ rule, path });
+}
+const MASK = (id) => `[REDACTED:${id}]`;
+export const REDACTION_RULES = [
+    {
+        id: "auth-header",
+        regex: /^([ \t]*(?:authorization|proxy-authorization|www-authenticate|cookie|set-cookie|x-api-key|x-apikey|x-auth-token|x-access-token|x-session-token|x-refresh-token|x-amz-security-token|api-key|apikey)[ \t]*:[ \t]*)(.+)$/gim,
+        secretGroup: 2,
+    },
+    { id: "bearer-token", regex: /\b(Bearer[ \t]+)([A-Za-z0-9._~+/=-]{8,})/gi, secretGroup: 2 },
+    { id: "basic-auth", regex: /\b(Basic[ \t]+)([A-Za-z0-9+/=]{8,})/gi, secretGroup: 2 },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    { id: "jwt", regex: /\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g },
+    { id: "aws-access-key-id", regex: /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g },
+    {
+        id: "aws-secret-access-key",
+        regex: /(aws_?secret_?access_?key["' ]*[=:]["' ]*)([A-Za-z0-9/+=]{40})/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "azure-storage-key",
+        regex: /(AccountKey=)([A-Za-z0-9+/=]{40,})/gi,
+        secretGroup: 2,
+    },
+    { id: "google-api-key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: "github-token", regex: /\bgh[pousr]_[A-Za-z0-9_]{36,}\b/g },
+    { id: "slack-token", regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}/g },
+    { id: "slack-webhook", regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g },
+    { id: "stripe-key", regex: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+    { id: "sendgrid-key", regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g },
+    { id: "npm-token", regex: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { id: "anthropic-key", regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "openai-key", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    {
+        id: "connection-string-password",
+        regex: /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqps?|https?):\/\/[^:@/\s]+:)([^@/\s]+)(@)/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "generic-secret-assignment",
+        regex: /\b(password|passwd|pwd|secret|client[_-]?secret|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|private[_-]?key|passphrase)\b(["' ]*[=:]["' ]*)([^\s"',;&})]{6,})/gi,
+        secretGroup: 3,
+    },
+];
+export function redactString(input, report = emptyReport(), path = "") {
+    if (typeof input !== "string" || input.length === 0) {
+        return { text: input, report };
+    }
+    let text = input;
+    for (const rule of REDACTION_RULES) {
+        if (rule.secretGroup === undefined) {
+            text = text.replace(rule.regex, () => {
+                record(report, rule.id, path);
+                return MASK(rule.id);
+            });
+        }
+        else {
+            const g = rule.secretGroup;
+            text = text.replace(rule.regex, (match, ...groups) => {
+                const secret = groups[g - 1];
+                if (secret === undefined || secret === "")
+                    return match;
+                record(report, rule.id, path);
+                const idx = match.lastIndexOf(String(secret));
+                if (idx < 0)
+                    return MASK(rule.id);
+                return match.slice(0, idx) + MASK(rule.id) + match.slice(idx + String(secret).length);
+            });
+        }
+    }
+    return { text, report };
+}
+export const SENSITIVE_KEY_NAMES = new Set([
+    "authorization",
+    "proxyauthorization",
+    "cookie",
+    "setcookie",
+    "xapikey",
+    "xauthtoken",
+    "xaccesstoken",
+    "xsessiontoken",
+    "xrefreshtoken",
+    "xamzsecuritytoken",
+    "apikey",
+    "apitoken",
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "secret",
+    "clientsecret",
+    "secretkey",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "authtoken",
+    "sessiontoken",
+    "sessionid",
+    "session",
+    "privatekey",
+    "credential",
+    "credentials",
+    "bearer",
+    "auth",
+].map((k) => k.replace(/[-_]/g, "")));
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_]/g, "");
+}
+export function redactValue(value, opts = {}) {
+    const report = emptyReport();
+    const maxDepth = opts.maxDepth ?? 64;
+    const seen = new WeakSet();
+    const walk = (node, path, depth, underSensitiveKey) => {
+        if (node === null || node === undefined)
+            return node;
+        if (typeof node === "string") {
+            if (underSensitiveKey) {
+                if (node.length > 0) {
+                    record(report, "sensitive-key", path);
+                    return MASK("sensitive-key");
+                }
+                return node;
+            }
+            return redactString(node, report, path).text;
+        }
+        if (typeof node !== "object")
+            return node;
+        if (seen.has(node))
+            return "[CYCLE]";
+        if (depth >= maxDepth)
+            return node;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            return node.map((item, i) => walk(item, `${path}[${i}]`, depth + 1, underSensitiveKey));
+        }
+        const out = {};
+        for (const [key, v] of Object.entries(node)) {
+            const childPath = path ? `${path}.${key}` : key;
+            const sensitive = underSensitiveKey || SENSITIVE_KEY_NAMES.has(normalizeKey(key));
+            out[key] = walk(v, childPath, depth + 1, sensitive);
+        }
+        return out;
+    };
+    const redacted = walk(value, "", 0, false);
+    return { value: redacted, report };
+}
+export function redactEvidence(value) {
+    return redactValue(value).value;
+}

package/dist/scanners/index.d.ts

@@ -0,0 +1,3 @@
+export type { ScannerId, LeadSeverity, LeadLocation, NormalizedLead, ScannerRunResult, LocalScanReport, } from "./types.js";
+export { normalizeScannerOutput, normalizeGitleaks, normalizeTrivy, normalizeSemgrep, normalizeOsvScanner, } from "./normalize.js";
+export { SUPPORTED_SCANNERS, SCANNER_BINARIES, scannerCommand, runOneScanner, runLocalScanners, aggregate, defaultExecEnv, type ScannerCommand, type ScannerExecEnv, type RunLocalScannersOptions, } from "./run.js";

package/dist/scanners/index.js

@@ -0,0 +1,2 @@
+export { normalizeScannerOutput, normalizeGitleaks, normalizeTrivy, normalizeSemgrep, normalizeOsvScanner, } from "./normalize.js";
+export { SUPPORTED_SCANNERS, SCANNER_BINARIES, scannerCommand, runOneScanner, runLocalScanners, aggregate, defaultExecEnv, } from "./run.js";

package/dist/scanners/normalize.d.ts

@@ -0,0 +1,6 @@
+import type { NormalizedLead, ScannerId } from "./types.js";
+export declare function normalizeGitleaks(parsed: unknown): NormalizedLead[];
+export declare function normalizeTrivy(parsed: unknown): NormalizedLead[];
+export declare function normalizeSemgrep(parsed: unknown): NormalizedLead[];
+export declare function normalizeOsvScanner(parsed: unknown): NormalizedLead[];
+export declare function normalizeScannerOutput(source: ScannerId, parsed: unknown): NormalizedLead[];