@zivis/mcp 0.1.11 → 0.1.17

package/dist/api-client.js

@@ -1,6 +1,19 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import { resolveAuth } from "./auth/index.js";
-import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, } from "./project-binding.js";
+import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, sanitizeBindingOverrides, } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
+const USER_AGENT = (() => {
+    try {
+        const __dirname = path.dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"));
+        return `@zivis/mcp/${pkg.version ?? "0.0.0"}`;
+    }
+    catch {
+        return "@zivis/mcp/0.0.0";
+    }
+})();
 export class ApiClient {
     config;
     constructor(config = DEFAULT_CONFIG) {
@@ -12,16 +25,12 @@ export class ApiClient {
         if (!detected) {
             return this.config;
         }
-        const { binding } = detected;
+        const { binding, filePath } = detected;
         const fromBinding = resolveConfigFromBinding(ws);
         return {
             ...this.config,
             session: resolveMcpSessionForWorkspace(this.config, ws, detected, fromBinding),
-            ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
-            ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
-            ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
-            ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
-            ...(binding.configDir ? { configDir: binding.configDir } : {}),
+            ...sanitizeBindingOverrides(binding, filePath),
         };
     }
     buildAuthHeaders(creds) {
@@ -50,7 +59,7 @@ export class ApiClient {
         const url = `${apiBaseUrl}${path}`;
         const headers = {
             "Content-Type": "application/json",
-            "User-Agent": "@zivis-ai/cli",
+            "User-Agent": USER_AGENT,
             ...this.buildAuthHeaders(creds),
         };
         const fetchOptions = { method, headers };
@@ -88,7 +97,7 @@ export class ApiClient {
         }
         const url = `${effectiveConfig.apiBaseUrl}${path}`;
         const headers = {
-            "User-Agent": "@zivis-ai/cli",
+            "User-Agent": USER_AGENT,
             ...this.buildAuthHeaders(creds),
         };
         const response = await fetch(url, { method: "GET", headers });

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-08-31T22:32:10.810Z",
+  "built_at": "2026-09-08T13:37:26.490Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/project-binding.d.ts

@@ -3,6 +3,7 @@ export declare function detectProjectBinding(cwd: string): {
     binding: ProjectBinding;
     filePath: string;
 } | null;
+export declare function sanitizeBindingOverrides(binding: ProjectBinding, filePath: string): Partial<Pick<ZivisConfig, "apiBaseUrl" | "oauthApiUrl" | "oauthClientId">>;
 export declare function resolveConfigFromBinding(cwd?: string): ZivisConfig;
 export declare function resolveMcpSessionForWorkspace(incoming: ZivisConfig, workspacePath: string, detected: ReturnType<typeof detectProjectBinding>, fromBinding: ZivisConfig): string;
 export declare function validateProjectBinding(binding: ProjectBinding, filePath: string, config: ZivisConfig): void;

package/dist/project-binding.js

@@ -27,19 +27,63 @@ export function detectProjectBinding(cwd) {
     }
     return null;
 }
+const TRUSTED_BINDING_HOST = "zivis.ai";
+const TRUSTED_BINDING_HOST_SUFFIX = ".zivis.ai";
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isTrustedBindingUrl(raw, envAnchor) {
+    if (envAnchor && raw === envAnchor)
+        return true;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (LOOPBACK_HOSTS.has(host))
+        return true;
+    if (parsed.protocol !== "https:")
+        return false;
+    return host === TRUSTED_BINDING_HOST || host.endsWith(TRUSTED_BINDING_HOST_SUFFIX);
+}
+function describeHost(raw) {
+    try {
+        return new URL(raw).host;
+    }
+    catch {
+        return "<unparseable url>";
+    }
+}
+export function sanitizeBindingOverrides(binding, filePath) {
+    const out = {};
+    const gate = (field, value, envName) => {
+        if (!value)
+            return;
+        if (isTrustedBindingUrl(value, process.env[envName])) {
+            out[field] = value;
+            return;
+        }
+        console.error(`[zivis] WARNING: ignoring untrusted "${field}" in ${filePath} ` +
+            `(host: ${describeHost(value)}). A repo binding may only point at ` +
+            `https://*.zivis.ai, localhost, or the exact value of ${envName}. ` +
+            `Falling back to the configured/default host.`);
+    };
+    gate("apiBaseUrl", binding.apiBaseUrl, "ZIVIS_API_URL");
+    gate("oauthApiUrl", binding.oauthApiUrl, "ZIVIS_OAUTH_API_URL");
+    if (binding.oauthClientId)
+        out.oauthClientId = binding.oauthClientId;
+    return out;
+}
 export function resolveConfigFromBinding(cwd) {
     const detected = detectProjectBinding(cwd ?? process.cwd());
     if (!detected)
         return DEFAULT_CONFIG;
-    const { binding } = detected;
+    const { binding, filePath } = detected;
     return {
         ...DEFAULT_CONFIG,
         ...(binding.session ? { session: binding.session } : {}),
-        ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
-        ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
-        ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
-        ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
-        ...(binding.configDir ? { configDir: binding.configDir } : {}),
+        ...sanitizeBindingOverrides(binding, filePath),
     };
 }
 export function resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding) {

package/dist/prompts/audit-dependencies.js

@@ -1,6 +1,6 @@
 export function registerAuditDependenciesPrompt(server) {
     server.registerPrompt("audit-dependencies", {
-        description: "Check the open source libraries this project depends on for security risks. No account setup needed.",
+        description: "Check the open source libraries this project depends on for security risks (requires a connected ZIVIS project — run `zivis init` first if needed).",
         argsSchema: {},
     }, async () => ({
         messages: [
@@ -12,33 +12,21 @@ export function registerAuditDependenciesPrompt(server) {
 
 Please do the following:
 
-1. Look at the dependency files in this project. In priority order, check:
-   - package.json (look for the "dependencies" and "devDependencies" keys)
-   - requirements.txt or pyproject.toml
-   - go.mod
-   - Any other manifest files you can see
+1. Check whether this repo is connected to ZIVIS: look for \`.zivis/project.json\`. If it's missing, run \`zivis init\` in the terminal first (interactive login + one-time setup) and only continue once that succeeds.
 
-2. From those files, find all external dependencies that have a GitHub repository.
-   - Skip internal packages (those starting with "@my-company/" or similar private namespaces).
-   - Skip built-in packages (e.g. node built-ins like "fs", "path").
+2. Run \`zivis test dependencies\` in the terminal. This loads the ZIVIS dependency-risk methodology (reachability triage against the resolved lockfile — not just a CVE list) plus this project's prior ZIVIS security context, and hands you the grounding to do the actual analysis yourself.
 
-3. For each external dependency that has a public GitHub repo, call \`zivis_check_repo_trust\`
-   with the owner/repo string (e.g. "openai/openai-node").
+3. Follow the methodology it prints: build the dependency worklist from your lockfile, trace direct-runtime dependencies for reachability (is the vulnerable function actually imported, called, and fed attacker-controlled input?), and classify each as reachable-confirmed / reachable-but-contingent / not-imported / not-applicable / indeterminate.
 
-4. After checking each one, give me a summary table with columns:
-   - Package name
-   - Trust grade (A+ through F)
-   - Risk level (Safe / Low risk / Moderate / High / Critical)
-   - Any critical or high findings (one line each)
+4. Give me a summary table with columns: package, installed version, CVE(s), reachability verdict, and one-line reasoning.
 
-5. Flag any package with grade C or below and explain in plain English why it's risky.
+5. For anything reachable-confirmed, record it as a finding through the run's normal reporting flow so it's durable ZIVIS history, not just terminal output.
 
-6. At the end, suggest the two highest-priority actions to take based on the results.
+6. At the end, name any transitive-only dependencies you didn't trace this pass (an explicit coverage gap, not a silent pass) and suggest the two highest-priority actions.
 
 Ground rules:
-- Process dependencies one at a time so I can follow along.
-- If a package doesn't have a GitHub repo, skip it and say "(no GitHub repo found)".
-- Don't make up trust data — only use what zivis_check_repo_trust returns.
+- This requires a connected ZIVIS project — do not fabricate a trust score or skip straight to a verdict if \`zivis init\`/\`zivis test dependencies\` fails; report what went wrong instead.
+- A CVE with no confirmed reachable call site is not the same as a confirmed vulnerability — say so explicitly rather than flattening the distinction.
 - Speak in plain English. "High risk" is better than "critical severity threat vector".`,
                 },
             },

package/dist/server.js

@@ -55,8 +55,6 @@ import { THREAT_LIST_RELEVANT_CAPSULES_NAME, THREAT_LIST_RELEVANT_CAPSULES_DESCR
 import { THREAT_GET_CAPSULE_NAME, THREAT_GET_CAPSULE_DESCRIPTION, THREAT_GET_CAPSULE_SCHEMA, createThreatGetCapsuleHandler, } from "./tools/threat-get-capsule.js";
 import { THREAT_GET_INFERENCE_PROMPT_NAME, THREAT_GET_INFERENCE_PROMPT_DESCRIPTION, THREAT_GET_INFERENCE_PROMPT_SCHEMA, createThreatGetInferencePromptHandler, } from "./tools/threat-get-inference-prompt.js";
 import { THREAT_RUN_MATCHER_NAME, THREAT_RUN_MATCHER_DESCRIPTION, THREAT_RUN_MATCHER_SCHEMA, createThreatRunMatcherHandler, } from "./tools/threat-run-matcher.js";
-import { CHECK_REPO_TRUST_NAME, CHECK_REPO_TRUST_DESCRIPTION, CHECK_REPO_TRUST_SCHEMA, createCheckRepoTrustHandler, } from "./tools/check-repo-trust.js";
-import { GET_OSS_ZAT_NAME, GET_OSS_ZAT_DESCRIPTION, GET_OSS_ZAT_SCHEMA, createGetOssZatHandler, } from "./tools/get-oss-zat.js";
 import { VERIFY_TRUST_MARK_NAME, VERIFY_TRUST_MARK_DESCRIPTION, VERIFY_TRUST_MARK_SCHEMA, createVerifyTrustMarkHandler, } from "./tools/verify-trust-mark.js";
 import { GET_TRUST_KEYS_NAME, GET_TRUST_KEYS_DESCRIPTION, GET_TRUST_KEYS_SCHEMA, createGetTrustKeysHandler, } from "./tools/get-trust-keys.js";
 import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createInspectZatHandler, } from "./tools/inspect-zat.js";
@@ -73,7 +71,6 @@ import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHE
 import { MANAGE_APPLICATION_NAME, MANAGE_APPLICATION_DESCRIPTION, MANAGE_APPLICATION_SCHEMA, createManageApplicationHandler, } from "./tools/manage-application.js";
 import { MANAGE_ENDPOINT_LIFECYCLE_NAME, MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION, MANAGE_ENDPOINT_LIFECYCLE_SCHEMA, createManageEndpointLifecycleHandler, } from "./tools/manage-endpoint-lifecycle.js";
 import { DISCOVER_LOCAL_INFRA_NAME, DISCOVER_LOCAL_INFRA_DESCRIPTION, DISCOVER_LOCAL_INFRA_SCHEMA, createDiscoverLocalInfraHandler, } from "./tools/discover-local-infra.js";
-import { GENERATE_DIAGRAM_NAME, GENERATE_DIAGRAM_DESCRIPTION, GENERATE_DIAGRAM_SCHEMA, createGenerateDiagramHandler, } from "./tools/generate-diagram.js";
 import { LIST_DIAGRAMS_NAME, LIST_DIAGRAMS_DESCRIPTION, LIST_DIAGRAMS_SCHEMA, createListDiagramsHandler, } from "./tools/list-diagrams.js";
 import { GET_DIAGRAM_NAME, GET_DIAGRAM_DESCRIPTION, GET_DIAGRAM_SCHEMA, createGetDiagramHandler, } from "./tools/get-diagram.js";
 import { CREATE_DIAGRAM_NAME, CREATE_DIAGRAM_DESCRIPTION, CREATE_DIAGRAM_SCHEMA, createCreateDiagramHandler, } from "./tools/create-diagram.js";
@@ -143,14 +140,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: THREAT_RUN_MATCHER_DESCRIPTION,
         inputSchema: THREAT_RUN_MATCHER_SCHEMA,
     }, createThreatRunMatcherHandler());
-    server.registerTool(CHECK_REPO_TRUST_NAME, {
-        description: CHECK_REPO_TRUST_DESCRIPTION,
-        inputSchema: CHECK_REPO_TRUST_SCHEMA,
-    }, createCheckRepoTrustHandler(config));
-    server.registerTool(GET_OSS_ZAT_NAME, {
-        description: GET_OSS_ZAT_DESCRIPTION,
-        inputSchema: GET_OSS_ZAT_SCHEMA,
-    }, createGetOssZatHandler(config));
     server.registerTool(VERIFY_TRUST_MARK_NAME, {
         description: VERIFY_TRUST_MARK_DESCRIPTION,
         inputSchema: VERIFY_TRUST_MARK_SCHEMA,
@@ -215,10 +204,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: DISCOVER_LOCAL_INFRA_DESCRIPTION,
         inputSchema: DISCOVER_LOCAL_INFRA_SCHEMA,
     }, createDiscoverLocalInfraHandler());
-    server.registerTool(GENERATE_DIAGRAM_NAME, {
-        description: GENERATE_DIAGRAM_DESCRIPTION,
-        inputSchema: GENERATE_DIAGRAM_SCHEMA,
-    }, createGenerateDiagramHandler(apiClient));
     server.registerTool(LIST_DIAGRAMS_NAME, {
         description: LIST_DIAGRAMS_DESCRIPTION,
         inputSchema: LIST_DIAGRAMS_SCHEMA,

package/dist/tools/check-project.js

@@ -44,18 +44,12 @@ export function createCheckProjectHandler(apiClient, _config) {
                 {
                     id: "run_auth_init",
                     label: "Connect this project to your ZIVIS org",
-                    tool: "zivis_check_project",
-                    why: "Run 'zivis auth init' in your terminal to create the binding, then re-check.",
+                    tool: "cli_command",
+                    args_hint: { command: "zivis init" },
+                    why: "Every ZIVIS command requires a bound Application — this creates the binding, then re-check.",
                     requires_tier: "free",
                 },
-                {
-                    id: "check_deps_no_auth",
-                    label: "Check dependencies without a binding (no auth needed)",
-                    tool: "zivis_check_repo_trust",
-                    why: "You can check any GitHub repo for security issues right now — no binding required.",
-                    requires_tier: "free",
-                },
-            ], "Project is not bound to a ZIVIS org. Run 'zivis auth init' in your terminal to fix this.");
+            ], "Project is not bound to a ZIVIS org. Run 'zivis init' in your terminal to fix this.");
         }
         const { binding, filePath } = detected;
         const sessionMatches = currentSession === binding.session;
@@ -161,8 +155,9 @@ export function createCheckProjectHandler(apiClient, _config) {
                 {
                     id: "check_deps",
                     label: "Check the open source libraries you depend on",
-                    tool: "zivis_check_repo_trust",
-                    why: "Free and fast — catches risky AI SDKs and known-bad dependencies.",
+                    tool: "cli_command",
+                    args_hint: { command: "zivis test dependencies" },
+                    why: "Runs the ZIVIS dependency-risk methodology against your resolved lockfile — reachability triage, not just a CVE list.",
                     requires_tier: "free",
                 },
             ], `Project is correctly connected to ${binding.orgName ?? "your ZIVIS org"}.`);

package/dist/tools/create-diagram.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
-export declare const CREATE_DIAGRAM_DESCRIPTION = "Create a new canvas diagram with nodes, connections, and boundaries in a single call.\n\nUse this to build system architecture diagrams, data flow diagrams, attack chains, etc. from code analysis.\n\n**Temp IDs:** When creating nodes and connections together, assign each node a temp_id (e.g., \"node_0\", \"node_1\") and reference them in connections via source_temp_id / target_temp_id. Similarly, assign boundaries a temp_id and reference them in nodes via boundary_temp_id.\n\n**Positioning:** Nodes default to (0,0). For readable layouts, space nodes apart (e.g., 250px horizontal, 150px vertical gaps). Default node size is 200x100px. Boundaries should be sized to contain their child nodes with padding.\n\n**Tags:** Use tags to annotate nodes with metadata (e.g., [\"database\", \"postgres\", \"port:5432\", \"pii\"]). These are searchable and displayed in the UI.\n\n**Colors:** Use hex colors (e.g., \"#336791\" for databases, \"#DC382D\" for caches, \"#009639\" for proxies).";
+export declare const CREATE_DIAGRAM_DESCRIPTION = "Create a new diagram from Mermaid source.\n\nUse this to record system architecture diagrams, data flow diagrams, attack chains, sequence diagrams, etc. from code analysis. Content is Mermaid syntax (flowchart, sequenceDiagram, etc.) \u2014 see zivis_update_mermaid_source for editing an existing diagram's source.";
 export declare const CREATE_DIAGRAM_SCHEMA: {
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -15,84 +15,14 @@ export declare const CREATE_DIAGRAM_SCHEMA: {
         trust_boundary: "trust_boundary";
         network: "network";
     }>;
-    nodes: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        temp_id: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        icon: z.ZodOptional<z.ZodString>;
-        color: z.ZodOptional<z.ZodString>;
-        position_x: z.ZodOptional<z.ZodNumber>;
-        position_y: z.ZodOptional<z.ZodNumber>;
-        width: z.ZodOptional<z.ZodNumber>;
-        height: z.ZodOptional<z.ZodNumber>;
-        step_order: z.ZodOptional<z.ZodNumber>;
-        boundary_temp_id: z.ZodOptional<z.ZodString>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>>>;
-    connections: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        source_temp_id: z.ZodOptional<z.ZodString>;
-        target_temp_id: z.ZodOptional<z.ZodString>;
-        source_node_id: z.ZodOptional<z.ZodString>;
-        target_node_id: z.ZodOptional<z.ZodString>;
-        label: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        bidirectional: z.ZodOptional<z.ZodBoolean>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>>>;
-    boundaries: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        temp_id: z.ZodOptional<z.ZodString>;
-        label: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        color: z.ZodOptional<z.ZodString>;
-        position_x: z.ZodOptional<z.ZodNumber>;
-        position_y: z.ZodOptional<z.ZodNumber>;
-        width: z.ZodOptional<z.ZodNumber>;
-        height: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>>;
+    content: z.ZodString;
     linked_threat_model_id: z.ZodOptional<z.ZodString>;
 };
 export declare function createCreateDiagramHandler(apiClient: ApiClient): (params: {
     name: string;
     description?: string;
     diagram_type: string;
-    nodes?: Array<{
-        temp_id?: string;
-        name: string;
-        description?: string;
-        tags?: string[];
-        icon?: string;
-        color?: string;
-        position_x?: number;
-        position_y?: number;
-        width?: number;
-        height?: number;
-        step_order?: number;
-        boundary_temp_id?: string;
-        metadata?: Record<string, unknown>;
-    }>;
-    connections?: Array<{
-        source_temp_id?: string;
-        target_temp_id?: string;
-        source_node_id?: string;
-        target_node_id?: string;
-        label?: string;
-        description?: string;
-        tags?: string[];
-        bidirectional?: boolean;
-        metadata?: Record<string, unknown>;
-    }>;
-    boundaries?: Array<{
-        temp_id?: string;
-        label: string;
-        description?: string;
-        color?: string;
-        position_x?: number;
-        position_y?: number;
-        width?: number;
-        height?: number;
-    }>;
+    content: string;
     linked_threat_model_id?: string;
 }) => Promise<{
     content: {

package/dist/tools/create-diagram.js

@@ -1,17 +1,9 @@
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
-export const CREATE_DIAGRAM_DESCRIPTION = `Create a new canvas diagram with nodes, connections, and boundaries in a single call.
+export const CREATE_DIAGRAM_DESCRIPTION = `Create a new diagram from Mermaid source.
 
-Use this to build system architecture diagrams, data flow diagrams, attack chains, etc. from code analysis.
-
-**Temp IDs:** When creating nodes and connections together, assign each node a temp_id (e.g., "node_0", "node_1") and reference them in connections via source_temp_id / target_temp_id. Similarly, assign boundaries a temp_id and reference them in nodes via boundary_temp_id.
-
-**Positioning:** Nodes default to (0,0). For readable layouts, space nodes apart (e.g., 250px horizontal, 150px vertical gaps). Default node size is 200x100px. Boundaries should be sized to contain their child nodes with padding.
-
-**Tags:** Use tags to annotate nodes with metadata (e.g., ["database", "postgres", "port:5432", "pii"]). These are searchable and displayed in the UI.
-
-**Colors:** Use hex colors (e.g., "#336791" for databases, "#DC382D" for caches, "#009639" for proxies).`;
+Use this to record system architecture diagrams, data flow diagrams, attack chains, sequence diagrams, etc. from code analysis. Content is Mermaid syntax (flowchart, sequenceDiagram, etc.) — see zivis_update_mermaid_source for editing an existing diagram's source.`;
 export const CREATE_DIAGRAM_SCHEMA = {
     name: z
         .string()
@@ -23,51 +15,9 @@ export const CREATE_DIAGRAM_SCHEMA = {
     diagram_type: z
         .enum(["architecture", "data_flow", "attack_chain", "sequence", "trust_boundary", "network", "deployment", "custom"])
         .describe("Type of diagram"),
-    nodes: z
-        .array(z.object({
-        temp_id: z.string().optional().describe("Temporary ID for referencing in connections (e.g., 'node_0')"),
-        name: z.string().describe("Node name (e.g., 'PostgreSQL', 'API Gateway')"),
-        description: z.string().optional().describe("Node description"),
-        tags: z.array(z.string()).optional().describe("Tags (e.g., ['database', 'port:5432'])"),
-        icon: z.string().optional().describe("Icon name (e.g., 'database', 'server', 'shield', 'globe')"),
-        color: z.string().optional().describe("Hex color (e.g., '#336791')"),
-        position_x: z.number().optional().describe("X position on canvas (default 0)"),
-        position_y: z.number().optional().describe("Y position on canvas (default 0)"),
-        width: z.number().optional().describe("Node width (default 200)"),
-        height: z.number().optional().describe("Node height (default 100)"),
-        step_order: z.number().optional().describe("Step order for attack chain diagrams"),
-        boundary_temp_id: z.string().optional().describe("Temp ID of boundary this node belongs to"),
-        metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata"),
-    }))
-        .optional()
-        .describe("Nodes to create"),
-    connections: z
-        .array(z.object({
-        source_temp_id: z.string().optional().describe("Source node temp ID"),
-        target_temp_id: z.string().optional().describe("Target node temp ID"),
-        source_node_id: z.string().optional().describe("Source node UUID (if referencing existing node)"),
-        target_node_id: z.string().optional().describe("Target node UUID (if referencing existing node)"),
-        label: z.string().optional().describe("Connection label (e.g., 'HTTPS', 'depends on')"),
-        description: z.string().optional().describe("Connection description"),
-        tags: z.array(z.string()).optional().describe("Connection tags"),
-        bidirectional: z.boolean().optional().describe("Whether connection goes both ways (default false)"),
-        metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata"),
-    }))
-        .optional()
-        .describe("Connections between nodes"),
-    boundaries: z
-        .array(z.object({
-        temp_id: z.string().optional().describe("Temporary ID for referencing in nodes (e.g., 'boundary_0')"),
-        label: z.string().describe("Boundary label (e.g., 'DMZ', 'Internal Network')"),
-        description: z.string().optional().describe("Boundary description"),
-        color: z.string().optional().describe("Hex color"),
-        position_x: z.number().optional().describe("X position (default 0)"),
-        position_y: z.number().optional().describe("Y position (default 0)"),
-        width: z.number().optional().describe("Boundary width (default 400)"),
-        height: z.number().optional().describe("Boundary height (default 300)"),
-    }))
-        .optional()
-        .describe("Boundary groups (trust boundaries, network segments)"),
+    content: z
+        .string()
+        .describe("Mermaid diagram source (e.g., 'flowchart TD\\n  A[Client] --> B[Server]')"),
     linked_threat_model_id: z
         .string()
         .optional()
@@ -76,51 +26,13 @@ export const CREATE_DIAGRAM_SCHEMA = {
 export function createCreateDiagramHandler(apiClient) {
     return async (params) => {
         try {
-            const apiNodes = params.nodes?.map((n) => ({
-                tempId: n.temp_id,
-                name: n.name,
-                description: n.description,
-                tags: n.tags,
-                icon: n.icon,
-                color: n.color,
-                positionX: n.position_x,
-                positionY: n.position_y,
-                width: n.width,
-                height: n.height,
-                stepOrder: n.step_order,
-                boundaryTempId: n.boundary_temp_id,
-                metadata: n.metadata,
-            }));
-            const apiConnections = params.connections?.map((c) => ({
-                sourceTempId: c.source_temp_id,
-                targetTempId: c.target_temp_id,
-                sourceNodeId: c.source_node_id,
-                targetNodeId: c.target_node_id,
-                label: c.label,
-                description: c.description,
-                tags: c.tags,
-                bidirectional: c.bidirectional,
-                metadata: c.metadata,
-            }));
-            const apiBoundaries = params.boundaries?.map((b) => ({
-                tempId: b.temp_id,
-                label: b.label,
-                description: b.description,
-                color: b.color,
-                positionX: b.position_x,
-                positionY: b.position_y,
-                width: b.width,
-                height: b.height,
-            }));
             const data = await apiClient.post("/api/diagrams", {
                 name: params.name,
                 description: params.description,
                 diagramType: params.diagram_type,
-                contentType: "canvas",
+                contentType: "mermaid",
+                content: params.content,
                 sourceType: "manual",
-                nodes: apiNodes,
-                connections: apiConnections,
-                boundaries: apiBoundaries,
             });
             const sanitized = sanitizeResponse(data);
             const diagramId = sanitized.id;
@@ -135,16 +47,12 @@ export function createCreateDiagramHandler(apiClient) {
                 catch {
                 }
             }
-            const nodeCount = Array.isArray(sanitized.nodes) ? sanitized.nodes.length : 0;
-            const connCount = Array.isArray(sanitized.connections) ? sanitized.connections.length : 0;
-            const boundaryCount = Array.isArray(sanitized.boundaries) ? sanitized.boundaries.length : 0;
             const result = {
                 diagram_id: diagramId,
                 name: sanitized.name,
                 diagram_type: sanitized.diagramType,
-                stats: { nodes: nodeCount, connections: connCount, boundaries: boundaryCount },
                 linked_threat_model_id: linkedThreatModelId,
-                _instruction: "Diagram created. Use zivis_get_diagram to see full content, or zivis_manage_diagram to modify.",
+                _instruction: "Diagram created. Use zivis_get_diagram to see full content, or zivis_manage_diagram to modify metadata/links, or zivis_update_mermaid_source to change the diagram source.",
             };
             return {
                 content: [

package/dist/tools/devx-run.d.ts

@@ -54,7 +54,7 @@ export declare function createRunReportHandler(apiClient: ApiClient): (params: R
     }[];
 }>;
 export declare const RUN_COMPLETE_NAME = "zivis_run_complete";
-export declare const RUN_COMPLETE_DESCRIPTION = "Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) \u2014 the run's immutable close-out.\n\n`result` is the SAME envelope shape `zivis run complete --input` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } \u2014 validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus (on a fresh completion) the Application's Trust Room link, when one is provisioned.";
+export declare const RUN_COMPLETE_DESCRIPTION = "Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) \u2014 the run's immutable close-out.\n\n`result` is the SAME envelope shape `zivis run complete --input` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } \u2014 validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus the Application's stable Assurance Overview URL (`applicationAssuranceUrl`).";
 export declare const RUN_COMPLETE_SCHEMA: {
     run_id: z.ZodString;
     result: z.ZodRecord<z.ZodString, z.ZodUnknown>;

package/dist/tools/devx-run.js

@@ -124,7 +124,7 @@ export function createRunReportHandler(apiClient) {
 export const RUN_COMPLETE_NAME = "zivis_run_complete";
 export const RUN_COMPLETE_DESCRIPTION = `Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) — the run's immutable close-out.
 
-\`result\` is the SAME envelope shape \`zivis run complete --input\` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } — validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus (on a fresh completion) the Application's Trust Room link, when one is provisioned.`;
+\`result\` is the SAME envelope shape \`zivis run complete --input\` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } — validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus the Application's stable Assurance Overview URL (\`applicationAssuranceUrl\`).`;
 export const RUN_COMPLETE_SCHEMA = {
     run_id: z.string().min(1).describe("The runId returned by zivis_run_start. Must be pending — completing an already-completed run replays idempotently."),
     result: z

package/dist/tools/discover-local-infra.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
-export declare const DISCOVER_LOCAL_INFRA_DESCRIPTION = "Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.\n\nAnalyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns structured recommendations for red team testing via zivis_local_scan.\n\nWhat it reads:\n- docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml\n- Dockerfile(s) in the project root and subdirectories\n- .env files (structure only \u2014 values are redacted for safety)\n- package.json, requirements.txt, pyproject.toml, go.mod (to detect AI frameworks)\n\nWhat it checks:\n- Docker daemon status\n- Currently running containers (docker compose ps)\n- Port mappings and exposed services\n\nWhat it returns:\n- List of services with ports and images\n- Running vs stopped status per service\n- Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)\n- Suggested target_url, chat_endpoint, target_type for zivis_local_scan\n- Whether the zivis-local-runner Docker image is available\n\nThis tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.";
+export declare const DISCOVER_LOCAL_INFRA_DESCRIPTION = "Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.\n\nAnalyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns a suggested target shape (URL, chat endpoint) for the coding agent to use as grounding context before running `zivis test ai`.\n\nWhat it reads:\n- docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml\n- Dockerfile(s) in the project root and subdirectories\n- .env files (structure only \u2014 values are redacted for safety)\n- package.json, requirements.txt, pyproject.toml, go.mod (to detect AI frameworks)\n\nWhat it checks:\n- Docker daemon status\n- Currently running containers (docker compose ps)\n- Port mappings and exposed services\n\nWhat it returns:\n- List of services with ports and images\n- Running vs stopped status per service\n- Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)\n- Suggested target_url/target_type/chat_endpoint \u2014 informational context, not a tool call to make\n- Whether the zivis-local-runner Docker image is available\n\nFor actually testing the discovered AI system, run `zivis test ai` in the terminal \u2014 this tool only maps what's running locally.\n\nThis tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.";
 export declare const DISCOVER_LOCAL_INFRA_SCHEMA: {
     project_dir: z.ZodOptional<z.ZodString>;
 };

package/dist/tools/discover-local-infra.js

@@ -7,7 +7,7 @@ const execAsync = promisify(exec);
 export const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
 export const DISCOVER_LOCAL_INFRA_DESCRIPTION = `Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.
 
-Analyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns structured recommendations for red team testing via zivis_local_scan.
+Analyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns a suggested target shape (URL, chat endpoint) for the coding agent to use as grounding context before running \`zivis test ai\`.
 
 What it reads:
 - docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml
@@ -24,9 +24,11 @@ What it returns:
 - List of services with ports and images
 - Running vs stopped status per service
 - Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)
-- Suggested target_url, chat_endpoint, target_type for zivis_local_scan
+- Suggested target_url/target_type/chat_endpoint — informational context, not a tool call to make
 - Whether the zivis-local-runner Docker image is available
 
+For actually testing the discovered AI system, run \`zivis test ai\` in the terminal — this tool only maps what's running locally.
+
 This tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.`;
 export const DISCOVER_LOCAL_INFRA_SCHEMA = {
     project_dir: z
@@ -127,7 +129,7 @@ export function createDiscoverLocalInfraHandler() {
             aiFrameworks: { detected: [], envHints: [] },
             runnerImage: { available: false },
             suggestion: null,
-            localScanCommand: null,
+            nextStep: null,
         };
         try {
             const { stdout } = await execAsync("docker version --format '{{.Server.Version}}'", {
@@ -344,19 +346,10 @@ export function createDiscoverLocalInfraHandler() {
         }
         result.suggestion = generateSuggestion(result.compose.services, result.aiFrameworks.detected, result.aiFrameworks.envHints, result.dockerfiles);
         if (result.suggestion) {
-            const parts = [`target_url="${result.suggestion.target_url}"`];
-            parts.push(`target_type="${result.suggestion.target_type}"`);
-            if (result.suggestion.chat_endpoint) {
-                parts.push(`chat_endpoint="${result.suggestion.chat_endpoint}"`);
-            }
-            if (result.suggestion.request_template) {
-                parts.push(`request_template='${result.suggestion.request_template}'`);
-            }
-            if (result.suggestion.response_path) {
-                parts.push(`response_path="${result.suggestion.response_path}"`);
-            }
-            parts.push(`scan_depth="standard"`);
-            result.localScanCommand = `zivis_local_scan(${parts.join(", ")})`;
+            result.nextStep =
+                `Detected ${result.suggestion.target_type} target at ${result.suggestion.target_url}` +
+                    (result.suggestion.chat_endpoint ? ` (chat endpoint: ${result.suggestion.chat_endpoint})` : "") +
+                    `. Run \`zivis test ai\` to test it.`;
         }
         return {
             content: [

package/dist/tools/get-diagram.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const GET_DIAGRAM_NAME = "zivis_get_diagram";
-export declare const GET_DIAGRAM_DESCRIPTION = "Get the full content of a diagram including all nodes, connections, boundaries, and Mermaid source.\n\nReturns node IDs, names, tags, positions, boundary assignments, and metadata. Connection IDs include source/target node references and labels. Boundary IDs include labels and positions.\n\nFor mermaid-type diagrams, the `content` field contains the full Mermaid source string \u2014 use it to read or render the diagram. For canvas-type diagrams, `content` is null and the structure is expressed via nodes/connections/boundaries.\n\nUse this before modifying a diagram \u2014 you need node/connection/boundary IDs for zivis_manage_diagram (canvas) or the Mermaid source for zivis_update_mermaid_source (mermaid).";
+export declare const GET_DIAGRAM_DESCRIPTION = "Get the full content of a diagram, including its Mermaid source.\n\nUse this before modifying a diagram \u2014 you need the current Mermaid source for zivis_update_mermaid_source.";
 export declare const GET_DIAGRAM_SCHEMA: {
     diagram_id: z.ZodString;
 };