@zivis/mcp 0.1.10 → 0.1.12

package/dist/scanners/normalize.js

@@ -0,0 +1,181 @@
+import { redactString } from "../redact.js";
+function redact(text) {
+    if (text === undefined || text === null || text === "")
+        return undefined;
+    return redactString(String(text)).text;
+}
+function normalizeSeverity(raw) {
+    const s = String(raw ?? "").toLowerCase();
+    if (s.startsWith("crit"))
+        return "critical";
+    if (s === "high" || s === "error")
+        return "high";
+    if (s === "medium" || s === "moderate" || s === "warning" || s === "warn")
+        return "medium";
+    if (s === "low")
+        return "low";
+    if (s === "info" || s === "informational" || s === "unknown" || s === "none" || s === "") {
+        return s === "" || s === "unknown" || s === "none" ? "unknown" : "info";
+    }
+    return "unknown";
+}
+function asArray(v) {
+    return Array.isArray(v) ? v : [];
+}
+function lead(base) {
+    return { lane: "lead", ...base };
+}
+export function normalizeGitleaks(parsed) {
+    const findings = asArray(parsed);
+    return findings.map((f) => {
+        const tags = Array.isArray(f.Tags) ? f.Tags : [];
+        const sevTag = tags.find((t) => ["critical", "high", "medium", "low"].includes(String(t).toLowerCase()));
+        return lead({
+            source: "gitleaks",
+            rule_id: f.RuleID ?? "gitleaks-secret",
+            title: f.Description ?? f.RuleID ?? "Potential secret",
+            severity: sevTag ? normalizeSeverity(sevTag) : "high",
+            location: { file: f.File, start_line: f.StartLine, end_line: f.EndLine },
+            excerpt: redact(f.Match),
+            metadata: tags.length ? { tags } : undefined,
+        });
+    });
+}
+export function normalizeTrivy(parsed) {
+    const results = asArray(parsed?.Results);
+    const out = [];
+    for (const r of results) {
+        for (const v of asArray(r.Vulnerabilities)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: v.VulnerabilityID ?? "trivy-vuln",
+                title: v.Title ?? `${v.PkgName ?? "dependency"} ${v.VulnerabilityID ?? ""}`.trim(),
+                severity: normalizeSeverity(v.Severity),
+                location: { file: r.Target },
+                package: v.PkgName,
+                cwe: Array.isArray(v.CweIDs) && v.CweIDs.length ? v.CweIDs : undefined,
+                references: dedupeRefs(v.PrimaryURL, v.References),
+                metadata: {
+                    installed_version: v.InstalledVersion,
+                    fixed_version: v.FixedVersion,
+                },
+            }));
+        }
+        for (const s of asArray(r.Secrets)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: s.RuleID ?? "trivy-secret",
+                title: s.Title ?? "Potential secret",
+                severity: normalizeSeverity(s.Severity ?? "high"),
+                location: { file: r.Target, start_line: s.StartLine, end_line: s.EndLine },
+                excerpt: redact(s.Match),
+            }));
+        }
+        for (const m of asArray(r.Misconfigurations)) {
+            out.push(lead({
+                source: "trivy",
+                rule_id: m.ID ?? "trivy-misconfig",
+                title: m.Title ?? m.ID ?? "Misconfiguration",
+                severity: normalizeSeverity(m.Severity),
+                location: { file: r.Target },
+                references: dedupeRefs(m.PrimaryURL, m.References),
+            }));
+        }
+    }
+    return out;
+}
+export function normalizeSemgrep(parsed) {
+    const results = asArray(parsed?.results);
+    return results.map((r) => {
+        const meta = r.extra?.metadata ?? {};
+        return lead({
+            source: "semgrep",
+            rule_id: r.check_id ?? "semgrep-rule",
+            title: r.extra?.message ?? r.check_id ?? "Semgrep match",
+            severity: normalizeSeverity(r.extra?.severity),
+            location: { file: r.path, start_line: r.start?.line, end_line: r.end?.line },
+            cwe: toStringArray(meta.cwe),
+            owasp: toStringArray(meta.owasp),
+            references: Array.isArray(meta.references) ? meta.references : undefined,
+            excerpt: redact(r.extra?.lines),
+        });
+    });
+}
+export function normalizeOsvScanner(parsed) {
+    const results = asArray(parsed?.results);
+    const out = [];
+    for (const src of results) {
+        const file = src.source?.path;
+        for (const pkg of asArray(src.packages)) {
+            const pkgName = pkg.package?.name;
+            const groupSeverity = new Map();
+            for (const g of asArray(pkg.groups)) {
+                for (const id of asArray(g.ids)) {
+                    if (g.max_severity)
+                        groupSeverity.set(id, g.max_severity);
+                }
+            }
+            for (const v of asArray(pkg.vulnerabilities)) {
+                out.push(lead({
+                    source: "osv-scanner",
+                    rule_id: v.id ?? "osv-vuln",
+                    title: v.summary ?? `${pkgName ?? "dependency"} ${v.id ?? ""}`.trim(),
+                    severity: cvssScoreToSeverity(groupSeverity.get(v.id ?? "")),
+                    location: { file },
+                    package: pkgName,
+                    references: asArray(v.references)
+                        .map((r) => r.url)
+                        .filter((u) => typeof u === "string"),
+                    metadata: { version: pkg.package?.version, ecosystem: pkg.package?.ecosystem },
+                }));
+            }
+        }
+    }
+    return out;
+}
+function toStringArray(v) {
+    if (v === undefined || v === null)
+        return undefined;
+    const arr = Array.isArray(v) ? v : [v];
+    const out = arr.map((x) => String(x)).filter(Boolean);
+    return out.length ? out : undefined;
+}
+function dedupeRefs(primary, refs) {
+    const set = new Set();
+    if (primary)
+        set.add(primary);
+    for (const r of Array.isArray(refs) ? refs : [])
+        if (r)
+            set.add(r);
+    return set.size ? [...set] : undefined;
+}
+function cvssScoreToSeverity(score) {
+    if (!score)
+        return "unknown";
+    const n = Number.parseFloat(score);
+    if (Number.isNaN(n))
+        return "unknown";
+    if (n >= 9.0)
+        return "critical";
+    if (n >= 7.0)
+        return "high";
+    if (n >= 4.0)
+        return "medium";
+    if (n > 0)
+        return "low";
+    return "unknown";
+}
+export function normalizeScannerOutput(source, parsed) {
+    switch (source) {
+        case "gitleaks":
+            return normalizeGitleaks(parsed);
+        case "trivy":
+            return normalizeTrivy(parsed);
+        case "semgrep":
+            return normalizeSemgrep(parsed);
+        case "osv-scanner":
+            return normalizeOsvScanner(parsed);
+        default:
+            return [];
+    }
+}

package/dist/scanners/run.d.ts

@@ -0,0 +1,27 @@
+import type { LocalScanReport, ScannerId, ScannerRunResult } from "./types.js";
+export declare const SUPPORTED_SCANNERS: readonly ScannerId[];
+export declare const SCANNER_BINARIES: Record<ScannerId, string>;
+export interface ScannerCommand {
+    bin: string;
+    args: string[];
+}
+export declare function scannerCommand(source: ScannerId, dir: string, outPath: string): ScannerCommand;
+export interface ScannerExecEnv {
+    isAvailable(bin: string): Promise<boolean>;
+    execute(cmd: ScannerCommand, opts: {
+        timeoutMs: number;
+    }): Promise<{
+        reportText: string | null;
+        error?: string;
+    }>;
+}
+export declare const defaultExecEnv: ScannerExecEnv;
+export interface RunLocalScannersOptions {
+    sources?: ScannerId[];
+    timeoutMs?: number;
+    env?: ScannerExecEnv;
+    tmpDir?: string;
+}
+export declare function runOneScanner(source: ScannerId, dir: string, opts?: RunLocalScannersOptions): Promise<ScannerRunResult>;
+export declare function runLocalScanners(dir: string, opts?: RunLocalScannersOptions): Promise<LocalScanReport>;
+export declare function aggregate(results: ScannerRunResult[]): LocalScanReport;

package/dist/scanners/run.js

@@ -0,0 +1,142 @@
+import * as os from "node:os";
+import * as path from "node:path";
+import * as fs from "node:fs/promises";
+import * as crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { normalizeScannerOutput } from "./normalize.js";
+export const SUPPORTED_SCANNERS = ["gitleaks", "trivy", "semgrep", "osv-scanner"];
+export const SCANNER_BINARIES = {
+    gitleaks: "gitleaks",
+    trivy: "trivy",
+    semgrep: "semgrep",
+    "osv-scanner": "osv-scanner",
+};
+export function scannerCommand(source, dir, outPath) {
+    switch (source) {
+        case "gitleaks":
+            return {
+                bin: "gitleaks",
+                args: ["detect", "--source", dir, "--no-banner", "--report-format", "json", "--report-path", outPath, "--exit-code", "0"],
+            };
+        case "trivy":
+            return {
+                bin: "trivy",
+                args: ["fs", "--quiet", "--format", "json", "--output", outPath, "--scanners", "vuln,secret,misconfig", dir],
+            };
+        case "semgrep":
+            return {
+                bin: "semgrep",
+                args: ["scan", "--json", "--output", outPath, "--quiet", "--config", process.env.ZIVIS_SEMGREP_CONFIG || "auto", dir],
+            };
+        case "osv-scanner":
+            return {
+                bin: "osv-scanner",
+                args: ["--format", "json", "--output", outPath, "--recursive", dir],
+            };
+        default:
+            throw new Error(`unknown scanner: ${source}`);
+    }
+}
+const execFileAsync = (bin, args, timeoutMs) => new Promise((resolve) => {
+    execFile(bin, args, { timeout: timeoutMs, maxBuffer: 64 * 1024 * 1024 }, (err) => {
+        const code = err && typeof err.code === "number" ? (err.code) : err ? 1 : 0;
+        resolve({ code, stderr: err ? String(err.message ?? "") : "" });
+    });
+});
+export const defaultExecEnv = {
+    async isAvailable(bin) {
+        return new Promise((resolve) => {
+            execFile(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [bin] : ["-v", bin], { shell: true, timeout: 5000 }, (err) => {
+                resolve(!err);
+            });
+        });
+    },
+    async execute(cmd, opts) {
+        const outIdx = cmd.args.findIndex((a) => a === "--output" || a === "--report-path");
+        const outPath = outIdx >= 0 ? cmd.args[outIdx + 1] : undefined;
+        if (!outPath)
+            return { reportText: null, error: "no output path in command" };
+        try {
+            await execFileAsync(cmd.bin, cmd.args, opts.timeoutMs);
+            const text = await fs.readFile(outPath, "utf8").catch(() => null);
+            return { reportText: text };
+        }
+        catch (err) {
+            return { reportText: null, error: err instanceof Error ? err.message : String(err) };
+        }
+        finally {
+            if (outPath)
+                await fs.rm(outPath, { force: true }).catch(() => { });
+        }
+    },
+};
+export async function runOneScanner(source, dir, opts = {}) {
+    const env = opts.env ?? defaultExecEnv;
+    const bin = SCANNER_BINARIES[source];
+    const started = Date.now();
+    if (!(await env.isAvailable(bin))) {
+        return { source, status: "not_installed", leads: [] };
+    }
+    const tmpDir = opts.tmpDir ?? os.tmpdir();
+    const outPath = path.join(tmpDir, `zivis-${source}-${crypto.randomUUID()}.json`);
+    const cmd = scannerCommand(source, dir, outPath);
+    try {
+        const { reportText, error } = await env.execute(cmd, { timeoutMs: opts.timeoutMs ?? 120_000 });
+        if (error && reportText === null) {
+            return { source, status: "error", leads: [], error, duration_ms: Date.now() - started };
+        }
+        if (reportText === null || reportText.trim() === "") {
+            return { source, status: "ok", leads: [], duration_ms: Date.now() - started };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(reportText);
+        }
+        catch (e) {
+            return { source, status: "error", leads: [], error: `unparseable ${source} JSON: ${e instanceof Error ? e.message : String(e)}`, duration_ms: Date.now() - started };
+        }
+        const leads = normalizeScannerOutput(source, parsed);
+        return { source, status: "ok", leads, duration_ms: Date.now() - started };
+    }
+    catch (err) {
+        return { source, status: "error", leads: [], error: err instanceof Error ? err.message : String(err), duration_ms: Date.now() - started };
+    }
+}
+export async function runLocalScanners(dir, opts = {}) {
+    const sources = opts.sources ?? [...SUPPORTED_SCANNERS];
+    const results = [];
+    for (const source of sources) {
+        results.push(await runOneScanner(source, dir, opts));
+    }
+    return aggregate(results);
+}
+export function aggregate(results) {
+    const leads = [];
+    const bySource = {};
+    const bySeverity = {};
+    const scannersRun = [];
+    const scannersMissing = [];
+    for (const r of results) {
+        if (r.status === "not_installed")
+            scannersMissing.push(r.source);
+        else
+            scannersRun.push(r.source);
+        for (const l of r.leads) {
+            leads.push(l);
+            bySource[l.source] = (bySource[l.source] ?? 0) + 1;
+            bySeverity[l.severity] = (bySeverity[l.severity] ?? 0) + 1;
+        }
+    }
+    return {
+        ran_at: new Date().toISOString(),
+        results,
+        leads,
+        summary: {
+            total_leads: leads.length,
+            by_source: bySource,
+            by_severity: bySeverity,
+            scanners_run: scannersRun,
+            scanners_missing: scannersMissing,
+        },
+    };
+}

package/dist/scanners/types.d.ts

@@ -0,0 +1,40 @@
+export type ScannerId = "gitleaks" | "trivy" | "semgrep" | "osv-scanner";
+export type LeadSeverity = "critical" | "high" | "medium" | "low" | "info" | "unknown";
+export interface LeadLocation {
+    file?: string;
+    start_line?: number;
+    end_line?: number;
+}
+export interface NormalizedLead {
+    lane: "lead";
+    source: ScannerId;
+    rule_id: string;
+    title: string;
+    severity: LeadSeverity;
+    location?: LeadLocation;
+    package?: string;
+    cwe?: string[];
+    owasp?: string[];
+    references?: string[];
+    excerpt?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface ScannerRunResult {
+    source: ScannerId;
+    status: "ok" | "not_installed" | "error";
+    leads: NormalizedLead[];
+    error?: string;
+    duration_ms?: number;
+}
+export interface LocalScanReport {
+    ran_at: string;
+    results: ScannerRunResult[];
+    leads: NormalizedLead[];
+    summary: {
+        total_leads: number;
+        by_source: Record<string, number>;
+        by_severity: Record<string, number>;
+        scanners_run: ScannerId[];
+        scanners_missing: ScannerId[];
+    };
+}

package/dist/scanners/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server.js

@@ -73,7 +73,6 @@ import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHE
 import { MANAGE_APPLICATION_NAME, MANAGE_APPLICATION_DESCRIPTION, MANAGE_APPLICATION_SCHEMA, createManageApplicationHandler, } from "./tools/manage-application.js";
 import { MANAGE_ENDPOINT_LIFECYCLE_NAME, MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION, MANAGE_ENDPOINT_LIFECYCLE_SCHEMA, createManageEndpointLifecycleHandler, } from "./tools/manage-endpoint-lifecycle.js";
 import { DISCOVER_LOCAL_INFRA_NAME, DISCOVER_LOCAL_INFRA_DESCRIPTION, DISCOVER_LOCAL_INFRA_SCHEMA, createDiscoverLocalInfraHandler, } from "./tools/discover-local-infra.js";
-import { GENERATE_DIAGRAM_NAME, GENERATE_DIAGRAM_DESCRIPTION, GENERATE_DIAGRAM_SCHEMA, createGenerateDiagramHandler, } from "./tools/generate-diagram.js";
 import { LIST_DIAGRAMS_NAME, LIST_DIAGRAMS_DESCRIPTION, LIST_DIAGRAMS_SCHEMA, createListDiagramsHandler, } from "./tools/list-diagrams.js";
 import { GET_DIAGRAM_NAME, GET_DIAGRAM_DESCRIPTION, GET_DIAGRAM_SCHEMA, createGetDiagramHandler, } from "./tools/get-diagram.js";
 import { CREATE_DIAGRAM_NAME, CREATE_DIAGRAM_DESCRIPTION, CREATE_DIAGRAM_SCHEMA, createCreateDiagramHandler, } from "./tools/create-diagram.js";
@@ -215,10 +214,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: DISCOVER_LOCAL_INFRA_DESCRIPTION,
         inputSchema: DISCOVER_LOCAL_INFRA_SCHEMA,
     }, createDiscoverLocalInfraHandler());
-    server.registerTool(GENERATE_DIAGRAM_NAME, {
-        description: GENERATE_DIAGRAM_DESCRIPTION,
-        inputSchema: GENERATE_DIAGRAM_SCHEMA,
-    }, createGenerateDiagramHandler(apiClient));
     server.registerTool(LIST_DIAGRAMS_NAME, {
         description: LIST_DIAGRAMS_DESCRIPTION,
         inputSchema: LIST_DIAGRAMS_SCHEMA,

package/dist/tools/create-diagram.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
-export declare const CREATE_DIAGRAM_DESCRIPTION = "Create a new canvas diagram with nodes, connections, and boundaries in a single call.\n\nUse this to build system architecture diagrams, data flow diagrams, attack chains, etc. from code analysis.\n\n**Temp IDs:** When creating nodes and connections together, assign each node a temp_id (e.g., \"node_0\", \"node_1\") and reference them in connections via source_temp_id / target_temp_id. Similarly, assign boundaries a temp_id and reference them in nodes via boundary_temp_id.\n\n**Positioning:** Nodes default to (0,0). For readable layouts, space nodes apart (e.g., 250px horizontal, 150px vertical gaps). Default node size is 200x100px. Boundaries should be sized to contain their child nodes with padding.\n\n**Tags:** Use tags to annotate nodes with metadata (e.g., [\"database\", \"postgres\", \"port:5432\", \"pii\"]). These are searchable and displayed in the UI.\n\n**Colors:** Use hex colors (e.g., \"#336791\" for databases, \"#DC382D\" for caches, \"#009639\" for proxies).";
+export declare const CREATE_DIAGRAM_DESCRIPTION = "Create a new diagram from Mermaid source.\n\nUse this to record system architecture diagrams, data flow diagrams, attack chains, sequence diagrams, etc. from code analysis. Content is Mermaid syntax (flowchart, sequenceDiagram, etc.) \u2014 see zivis_update_mermaid_source for editing an existing diagram's source.";
 export declare const CREATE_DIAGRAM_SCHEMA: {
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -15,84 +15,14 @@ export declare const CREATE_DIAGRAM_SCHEMA: {
         trust_boundary: "trust_boundary";
         network: "network";
     }>;
-    nodes: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        temp_id: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        icon: z.ZodOptional<z.ZodString>;
-        color: z.ZodOptional<z.ZodString>;
-        position_x: z.ZodOptional<z.ZodNumber>;
-        position_y: z.ZodOptional<z.ZodNumber>;
-        width: z.ZodOptional<z.ZodNumber>;
-        height: z.ZodOptional<z.ZodNumber>;
-        step_order: z.ZodOptional<z.ZodNumber>;
-        boundary_temp_id: z.ZodOptional<z.ZodString>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>>>;
-    connections: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        source_temp_id: z.ZodOptional<z.ZodString>;
-        target_temp_id: z.ZodOptional<z.ZodString>;
-        source_node_id: z.ZodOptional<z.ZodString>;
-        target_node_id: z.ZodOptional<z.ZodString>;
-        label: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        bidirectional: z.ZodOptional<z.ZodBoolean>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>>>;
-    boundaries: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        temp_id: z.ZodOptional<z.ZodString>;
-        label: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        color: z.ZodOptional<z.ZodString>;
-        position_x: z.ZodOptional<z.ZodNumber>;
-        position_y: z.ZodOptional<z.ZodNumber>;
-        width: z.ZodOptional<z.ZodNumber>;
-        height: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>>;
+    content: z.ZodString;
     linked_threat_model_id: z.ZodOptional<z.ZodString>;
 };
 export declare function createCreateDiagramHandler(apiClient: ApiClient): (params: {
     name: string;
     description?: string;
     diagram_type: string;
-    nodes?: Array<{
-        temp_id?: string;
-        name: string;
-        description?: string;
-        tags?: string[];
-        icon?: string;
-        color?: string;
-        position_x?: number;
-        position_y?: number;
-        width?: number;
-        height?: number;
-        step_order?: number;
-        boundary_temp_id?: string;
-        metadata?: Record<string, unknown>;
-    }>;
-    connections?: Array<{
-        source_temp_id?: string;
-        target_temp_id?: string;
-        source_node_id?: string;
-        target_node_id?: string;
-        label?: string;
-        description?: string;
-        tags?: string[];
-        bidirectional?: boolean;
-        metadata?: Record<string, unknown>;
-    }>;
-    boundaries?: Array<{
-        temp_id?: string;
-        label: string;
-        description?: string;
-        color?: string;
-        position_x?: number;
-        position_y?: number;
-        width?: number;
-        height?: number;
-    }>;
+    content: string;
     linked_threat_model_id?: string;
 }) => Promise<{
     content: {

package/dist/tools/create-diagram.js

@@ -1,17 +1,9 @@
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
-export const CREATE_DIAGRAM_DESCRIPTION = `Create a new canvas diagram with nodes, connections, and boundaries in a single call.
+export const CREATE_DIAGRAM_DESCRIPTION = `Create a new diagram from Mermaid source.
 
-Use this to build system architecture diagrams, data flow diagrams, attack chains, etc. from code analysis.
-
-**Temp IDs:** When creating nodes and connections together, assign each node a temp_id (e.g., "node_0", "node_1") and reference them in connections via source_temp_id / target_temp_id. Similarly, assign boundaries a temp_id and reference them in nodes via boundary_temp_id.
-
-**Positioning:** Nodes default to (0,0). For readable layouts, space nodes apart (e.g., 250px horizontal, 150px vertical gaps). Default node size is 200x100px. Boundaries should be sized to contain their child nodes with padding.
-
-**Tags:** Use tags to annotate nodes with metadata (e.g., ["database", "postgres", "port:5432", "pii"]). These are searchable and displayed in the UI.
-
-**Colors:** Use hex colors (e.g., "#336791" for databases, "#DC382D" for caches, "#009639" for proxies).`;
+Use this to record system architecture diagrams, data flow diagrams, attack chains, sequence diagrams, etc. from code analysis. Content is Mermaid syntax (flowchart, sequenceDiagram, etc.) — see zivis_update_mermaid_source for editing an existing diagram's source.`;
 export const CREATE_DIAGRAM_SCHEMA = {
     name: z
         .string()
@@ -23,51 +15,9 @@ export const CREATE_DIAGRAM_SCHEMA = {
     diagram_type: z
         .enum(["architecture", "data_flow", "attack_chain", "sequence", "trust_boundary", "network", "deployment", "custom"])
         .describe("Type of diagram"),
-    nodes: z
-        .array(z.object({
-        temp_id: z.string().optional().describe("Temporary ID for referencing in connections (e.g., 'node_0')"),
-        name: z.string().describe("Node name (e.g., 'PostgreSQL', 'API Gateway')"),
-        description: z.string().optional().describe("Node description"),
-        tags: z.array(z.string()).optional().describe("Tags (e.g., ['database', 'port:5432'])"),
-        icon: z.string().optional().describe("Icon name (e.g., 'database', 'server', 'shield', 'globe')"),
-        color: z.string().optional().describe("Hex color (e.g., '#336791')"),
-        position_x: z.number().optional().describe("X position on canvas (default 0)"),
-        position_y: z.number().optional().describe("Y position on canvas (default 0)"),
-        width: z.number().optional().describe("Node width (default 200)"),
-        height: z.number().optional().describe("Node height (default 100)"),
-        step_order: z.number().optional().describe("Step order for attack chain diagrams"),
-        boundary_temp_id: z.string().optional().describe("Temp ID of boundary this node belongs to"),
-        metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata"),
-    }))
-        .optional()
-        .describe("Nodes to create"),
-    connections: z
-        .array(z.object({
-        source_temp_id: z.string().optional().describe("Source node temp ID"),
-        target_temp_id: z.string().optional().describe("Target node temp ID"),
-        source_node_id: z.string().optional().describe("Source node UUID (if referencing existing node)"),
-        target_node_id: z.string().optional().describe("Target node UUID (if referencing existing node)"),
-        label: z.string().optional().describe("Connection label (e.g., 'HTTPS', 'depends on')"),
-        description: z.string().optional().describe("Connection description"),
-        tags: z.array(z.string()).optional().describe("Connection tags"),
-        bidirectional: z.boolean().optional().describe("Whether connection goes both ways (default false)"),
-        metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata"),
-    }))
-        .optional()
-        .describe("Connections between nodes"),
-    boundaries: z
-        .array(z.object({
-        temp_id: z.string().optional().describe("Temporary ID for referencing in nodes (e.g., 'boundary_0')"),
-        label: z.string().describe("Boundary label (e.g., 'DMZ', 'Internal Network')"),
-        description: z.string().optional().describe("Boundary description"),
-        color: z.string().optional().describe("Hex color"),
-        position_x: z.number().optional().describe("X position (default 0)"),
-        position_y: z.number().optional().describe("Y position (default 0)"),
-        width: z.number().optional().describe("Boundary width (default 400)"),
-        height: z.number().optional().describe("Boundary height (default 300)"),
-    }))
-        .optional()
-        .describe("Boundary groups (trust boundaries, network segments)"),
+    content: z
+        .string()
+        .describe("Mermaid diagram source (e.g., 'flowchart TD\\n  A[Client] --> B[Server]')"),
     linked_threat_model_id: z
         .string()
         .optional()
@@ -76,51 +26,13 @@ export const CREATE_DIAGRAM_SCHEMA = {
 export function createCreateDiagramHandler(apiClient) {
     return async (params) => {
         try {
-            const apiNodes = params.nodes?.map((n) => ({
-                tempId: n.temp_id,
-                name: n.name,
-                description: n.description,
-                tags: n.tags,
-                icon: n.icon,
-                color: n.color,
-                positionX: n.position_x,
-                positionY: n.position_y,
-                width: n.width,
-                height: n.height,
-                stepOrder: n.step_order,
-                boundaryTempId: n.boundary_temp_id,
-                metadata: n.metadata,
-            }));
-            const apiConnections = params.connections?.map((c) => ({
-                sourceTempId: c.source_temp_id,
-                targetTempId: c.target_temp_id,
-                sourceNodeId: c.source_node_id,
-                targetNodeId: c.target_node_id,
-                label: c.label,
-                description: c.description,
-                tags: c.tags,
-                bidirectional: c.bidirectional,
-                metadata: c.metadata,
-            }));
-            const apiBoundaries = params.boundaries?.map((b) => ({
-                tempId: b.temp_id,
-                label: b.label,
-                description: b.description,
-                color: b.color,
-                positionX: b.position_x,
-                positionY: b.position_y,
-                width: b.width,
-                height: b.height,
-            }));
             const data = await apiClient.post("/api/diagrams", {
                 name: params.name,
                 description: params.description,
                 diagramType: params.diagram_type,
-                contentType: "canvas",
+                contentType: "mermaid",
+                content: params.content,
                 sourceType: "manual",
-                nodes: apiNodes,
-                connections: apiConnections,
-                boundaries: apiBoundaries,
             });
             const sanitized = sanitizeResponse(data);
             const diagramId = sanitized.id;
@@ -135,16 +47,12 @@ export function createCreateDiagramHandler(apiClient) {
                 catch {
                 }
             }
-            const nodeCount = Array.isArray(sanitized.nodes) ? sanitized.nodes.length : 0;
-            const connCount = Array.isArray(sanitized.connections) ? sanitized.connections.length : 0;
-            const boundaryCount = Array.isArray(sanitized.boundaries) ? sanitized.boundaries.length : 0;
             const result = {
                 diagram_id: diagramId,
                 name: sanitized.name,
                 diagram_type: sanitized.diagramType,
-                stats: { nodes: nodeCount, connections: connCount, boundaries: boundaryCount },
                 linked_threat_model_id: linkedThreatModelId,
-                _instruction: "Diagram created. Use zivis_get_diagram to see full content, or zivis_manage_diagram to modify.",
+                _instruction: "Diagram created. Use zivis_get_diagram to see full content, or zivis_manage_diagram to modify metadata/links, or zivis_update_mermaid_source to change the diagram source.",
             };
             return {
                 content: [

package/dist/tools/get-diagram.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const GET_DIAGRAM_NAME = "zivis_get_diagram";
-export declare const GET_DIAGRAM_DESCRIPTION = "Get the full content of a diagram including all nodes, connections, boundaries, and Mermaid source.\n\nReturns node IDs, names, tags, positions, boundary assignments, and metadata. Connection IDs include source/target node references and labels. Boundary IDs include labels and positions.\n\nFor mermaid-type diagrams, the `content` field contains the full Mermaid source string \u2014 use it to read or render the diagram. For canvas-type diagrams, `content` is null and the structure is expressed via nodes/connections/boundaries.\n\nUse this before modifying a diagram \u2014 you need node/connection/boundary IDs for zivis_manage_diagram (canvas) or the Mermaid source for zivis_update_mermaid_source (mermaid).";
+export declare const GET_DIAGRAM_DESCRIPTION = "Get the full content of a diagram, including its Mermaid source.\n\nUse this before modifying a diagram \u2014 you need the current Mermaid source for zivis_update_mermaid_source.";
 export declare const GET_DIAGRAM_SCHEMA: {
     diagram_id: z.ZodString;
 };