@zivis/mcp 0.1.12 → 0.1.17

package/dist/api-client.js

@@ -1,6 +1,19 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import { resolveAuth } from "./auth/index.js";
-import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, } from "./project-binding.js";
+import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, sanitizeBindingOverrides, } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
+const USER_AGENT = (() => {
+    try {
+        const __dirname = path.dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"));
+        return `@zivis/mcp/${pkg.version ?? "0.0.0"}`;
+    }
+    catch {
+        return "@zivis/mcp/0.0.0";
+    }
+})();
 export class ApiClient {
     config;
     constructor(config = DEFAULT_CONFIG) {
@@ -12,16 +25,12 @@ export class ApiClient {
         if (!detected) {
             return this.config;
         }
-        const { binding } = detected;
+        const { binding, filePath } = detected;
         const fromBinding = resolveConfigFromBinding(ws);
         return {
             ...this.config,
             session: resolveMcpSessionForWorkspace(this.config, ws, detected, fromBinding),
-            ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
-            ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
-            ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
-            ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
-            ...(binding.configDir ? { configDir: binding.configDir } : {}),
+            ...sanitizeBindingOverrides(binding, filePath),
         };
     }
     buildAuthHeaders(creds) {
@@ -50,7 +59,7 @@ export class ApiClient {
         const url = `${apiBaseUrl}${path}`;
         const headers = {
             "Content-Type": "application/json",
-            "User-Agent": "@zivis-ai/cli",
+            "User-Agent": USER_AGENT,
             ...this.buildAuthHeaders(creds),
         };
         const fetchOptions = { method, headers };
@@ -88,7 +97,7 @@ export class ApiClient {
         }
         const url = `${effectiveConfig.apiBaseUrl}${path}`;
         const headers = {
-            "User-Agent": "@zivis-ai/cli",
+            "User-Agent": USER_AGENT,
             ...this.buildAuthHeaders(creds),
         };
         const response = await fetch(url, { method: "GET", headers });

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-09-01T21:19:00.226Z",
+  "built_at": "2026-09-08T13:37:26.490Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/project-binding.d.ts

@@ -3,6 +3,7 @@ export declare function detectProjectBinding(cwd: string): {
     binding: ProjectBinding;
     filePath: string;
 } | null;
+export declare function sanitizeBindingOverrides(binding: ProjectBinding, filePath: string): Partial<Pick<ZivisConfig, "apiBaseUrl" | "oauthApiUrl" | "oauthClientId">>;
 export declare function resolveConfigFromBinding(cwd?: string): ZivisConfig;
 export declare function resolveMcpSessionForWorkspace(incoming: ZivisConfig, workspacePath: string, detected: ReturnType<typeof detectProjectBinding>, fromBinding: ZivisConfig): string;
 export declare function validateProjectBinding(binding: ProjectBinding, filePath: string, config: ZivisConfig): void;

package/dist/project-binding.js

@@ -27,19 +27,63 @@ export function detectProjectBinding(cwd) {
     }
     return null;
 }
+const TRUSTED_BINDING_HOST = "zivis.ai";
+const TRUSTED_BINDING_HOST_SUFFIX = ".zivis.ai";
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isTrustedBindingUrl(raw, envAnchor) {
+    if (envAnchor && raw === envAnchor)
+        return true;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (LOOPBACK_HOSTS.has(host))
+        return true;
+    if (parsed.protocol !== "https:")
+        return false;
+    return host === TRUSTED_BINDING_HOST || host.endsWith(TRUSTED_BINDING_HOST_SUFFIX);
+}
+function describeHost(raw) {
+    try {
+        return new URL(raw).host;
+    }
+    catch {
+        return "<unparseable url>";
+    }
+}
+export function sanitizeBindingOverrides(binding, filePath) {
+    const out = {};
+    const gate = (field, value, envName) => {
+        if (!value)
+            return;
+        if (isTrustedBindingUrl(value, process.env[envName])) {
+            out[field] = value;
+            return;
+        }
+        console.error(`[zivis] WARNING: ignoring untrusted "${field}" in ${filePath} ` +
+            `(host: ${describeHost(value)}). A repo binding may only point at ` +
+            `https://*.zivis.ai, localhost, or the exact value of ${envName}. ` +
+            `Falling back to the configured/default host.`);
+    };
+    gate("apiBaseUrl", binding.apiBaseUrl, "ZIVIS_API_URL");
+    gate("oauthApiUrl", binding.oauthApiUrl, "ZIVIS_OAUTH_API_URL");
+    if (binding.oauthClientId)
+        out.oauthClientId = binding.oauthClientId;
+    return out;
+}
 export function resolveConfigFromBinding(cwd) {
     const detected = detectProjectBinding(cwd ?? process.cwd());
     if (!detected)
         return DEFAULT_CONFIG;
-    const { binding } = detected;
+    const { binding, filePath } = detected;
     return {
         ...DEFAULT_CONFIG,
         ...(binding.session ? { session: binding.session } : {}),
-        ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
-        ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
-        ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
-        ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
-        ...(binding.configDir ? { configDir: binding.configDir } : {}),
+        ...sanitizeBindingOverrides(binding, filePath),
     };
 }
 export function resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding) {

package/dist/prompts/audit-dependencies.js

@@ -1,6 +1,6 @@
 export function registerAuditDependenciesPrompt(server) {
     server.registerPrompt("audit-dependencies", {
-        description: "Check the open source libraries this project depends on for security risks. No account setup needed.",
+        description: "Check the open source libraries this project depends on for security risks (requires a connected ZIVIS project — run `zivis init` first if needed).",
         argsSchema: {},
     }, async () => ({
         messages: [
@@ -12,33 +12,21 @@ export function registerAuditDependenciesPrompt(server) {
 
 Please do the following:
 
-1. Look at the dependency files in this project. In priority order, check:
-   - package.json (look for the "dependencies" and "devDependencies" keys)
-   - requirements.txt or pyproject.toml
-   - go.mod
-   - Any other manifest files you can see
+1. Check whether this repo is connected to ZIVIS: look for \`.zivis/project.json\`. If it's missing, run \`zivis init\` in the terminal first (interactive login + one-time setup) and only continue once that succeeds.
 
-2. From those files, find all external dependencies that have a GitHub repository.
-   - Skip internal packages (those starting with "@my-company/" or similar private namespaces).
-   - Skip built-in packages (e.g. node built-ins like "fs", "path").
+2. Run \`zivis test dependencies\` in the terminal. This loads the ZIVIS dependency-risk methodology (reachability triage against the resolved lockfile — not just a CVE list) plus this project's prior ZIVIS security context, and hands you the grounding to do the actual analysis yourself.
 
-3. For each external dependency that has a public GitHub repo, call \`zivis_check_repo_trust\`
-   with the owner/repo string (e.g. "openai/openai-node").
+3. Follow the methodology it prints: build the dependency worklist from your lockfile, trace direct-runtime dependencies for reachability (is the vulnerable function actually imported, called, and fed attacker-controlled input?), and classify each as reachable-confirmed / reachable-but-contingent / not-imported / not-applicable / indeterminate.
 
-4. After checking each one, give me a summary table with columns:
-   - Package name
-   - Trust grade (A+ through F)
-   - Risk level (Safe / Low risk / Moderate / High / Critical)
-   - Any critical or high findings (one line each)
+4. Give me a summary table with columns: package, installed version, CVE(s), reachability verdict, and one-line reasoning.
 
-5. Flag any package with grade C or below and explain in plain English why it's risky.
+5. For anything reachable-confirmed, record it as a finding through the run's normal reporting flow so it's durable ZIVIS history, not just terminal output.
 
-6. At the end, suggest the two highest-priority actions to take based on the results.
+6. At the end, name any transitive-only dependencies you didn't trace this pass (an explicit coverage gap, not a silent pass) and suggest the two highest-priority actions.
 
 Ground rules:
-- Process dependencies one at a time so I can follow along.
-- If a package doesn't have a GitHub repo, skip it and say "(no GitHub repo found)".
-- Don't make up trust data — only use what zivis_check_repo_trust returns.
+- This requires a connected ZIVIS project — do not fabricate a trust score or skip straight to a verdict if \`zivis init\`/\`zivis test dependencies\` fails; report what went wrong instead.
+- A CVE with no confirmed reachable call site is not the same as a confirmed vulnerability — say so explicitly rather than flattening the distinction.
 - Speak in plain English. "High risk" is better than "critical severity threat vector".`,
                 },
             },

package/dist/server.js

@@ -55,8 +55,6 @@ import { THREAT_LIST_RELEVANT_CAPSULES_NAME, THREAT_LIST_RELEVANT_CAPSULES_DESCR
 import { THREAT_GET_CAPSULE_NAME, THREAT_GET_CAPSULE_DESCRIPTION, THREAT_GET_CAPSULE_SCHEMA, createThreatGetCapsuleHandler, } from "./tools/threat-get-capsule.js";
 import { THREAT_GET_INFERENCE_PROMPT_NAME, THREAT_GET_INFERENCE_PROMPT_DESCRIPTION, THREAT_GET_INFERENCE_PROMPT_SCHEMA, createThreatGetInferencePromptHandler, } from "./tools/threat-get-inference-prompt.js";
 import { THREAT_RUN_MATCHER_NAME, THREAT_RUN_MATCHER_DESCRIPTION, THREAT_RUN_MATCHER_SCHEMA, createThreatRunMatcherHandler, } from "./tools/threat-run-matcher.js";
-import { CHECK_REPO_TRUST_NAME, CHECK_REPO_TRUST_DESCRIPTION, CHECK_REPO_TRUST_SCHEMA, createCheckRepoTrustHandler, } from "./tools/check-repo-trust.js";
-import { GET_OSS_ZAT_NAME, GET_OSS_ZAT_DESCRIPTION, GET_OSS_ZAT_SCHEMA, createGetOssZatHandler, } from "./tools/get-oss-zat.js";
 import { VERIFY_TRUST_MARK_NAME, VERIFY_TRUST_MARK_DESCRIPTION, VERIFY_TRUST_MARK_SCHEMA, createVerifyTrustMarkHandler, } from "./tools/verify-trust-mark.js";
 import { GET_TRUST_KEYS_NAME, GET_TRUST_KEYS_DESCRIPTION, GET_TRUST_KEYS_SCHEMA, createGetTrustKeysHandler, } from "./tools/get-trust-keys.js";
 import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createInspectZatHandler, } from "./tools/inspect-zat.js";
@@ -142,14 +140,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: THREAT_RUN_MATCHER_DESCRIPTION,
         inputSchema: THREAT_RUN_MATCHER_SCHEMA,
     }, createThreatRunMatcherHandler());
-    server.registerTool(CHECK_REPO_TRUST_NAME, {
-        description: CHECK_REPO_TRUST_DESCRIPTION,
-        inputSchema: CHECK_REPO_TRUST_SCHEMA,
-    }, createCheckRepoTrustHandler(config));
-    server.registerTool(GET_OSS_ZAT_NAME, {
-        description: GET_OSS_ZAT_DESCRIPTION,
-        inputSchema: GET_OSS_ZAT_SCHEMA,
-    }, createGetOssZatHandler(config));
     server.registerTool(VERIFY_TRUST_MARK_NAME, {
         description: VERIFY_TRUST_MARK_DESCRIPTION,
         inputSchema: VERIFY_TRUST_MARK_SCHEMA,

package/dist/tools/check-project.js

@@ -44,18 +44,12 @@ export function createCheckProjectHandler(apiClient, _config) {
                 {
                     id: "run_auth_init",
                     label: "Connect this project to your ZIVIS org",
-                    tool: "zivis_check_project",
-                    why: "Run 'zivis auth init' in your terminal to create the binding, then re-check.",
+                    tool: "cli_command",
+                    args_hint: { command: "zivis init" },
+                    why: "Every ZIVIS command requires a bound Application — this creates the binding, then re-check.",
                     requires_tier: "free",
                 },
-                {
-                    id: "check_deps_no_auth",
-                    label: "Check dependencies without a binding (no auth needed)",
-                    tool: "zivis_check_repo_trust",
-                    why: "You can check any GitHub repo for security issues right now — no binding required.",
-                    requires_tier: "free",
-                },
-            ], "Project is not bound to a ZIVIS org. Run 'zivis auth init' in your terminal to fix this.");
+            ], "Project is not bound to a ZIVIS org. Run 'zivis init' in your terminal to fix this.");
         }
         const { binding, filePath } = detected;
         const sessionMatches = currentSession === binding.session;
@@ -161,8 +155,9 @@ export function createCheckProjectHandler(apiClient, _config) {
                 {
                     id: "check_deps",
                     label: "Check the open source libraries you depend on",
-                    tool: "zivis_check_repo_trust",
-                    why: "Free and fast — catches risky AI SDKs and known-bad dependencies.",
+                    tool: "cli_command",
+                    args_hint: { command: "zivis test dependencies" },
+                    why: "Runs the ZIVIS dependency-risk methodology against your resolved lockfile — reachability triage, not just a CVE list.",
                     requires_tier: "free",
                 },
             ], `Project is correctly connected to ${binding.orgName ?? "your ZIVIS org"}.`);

package/dist/tools/devx-run.d.ts

@@ -54,7 +54,7 @@ export declare function createRunReportHandler(apiClient: ApiClient): (params: R
     }[];
 }>;
 export declare const RUN_COMPLETE_NAME = "zivis_run_complete";
-export declare const RUN_COMPLETE_DESCRIPTION = "Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) \u2014 the run's immutable close-out.\n\n`result` is the SAME envelope shape `zivis run complete --input` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } \u2014 validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus (on a fresh completion) the Application's Trust Room link, when one is provisioned.";
+export declare const RUN_COMPLETE_DESCRIPTION = "Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) \u2014 the run's immutable close-out.\n\n`result` is the SAME envelope shape `zivis run complete --input` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } \u2014 validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus the Application's stable Assurance Overview URL (`applicationAssuranceUrl`).";
 export declare const RUN_COMPLETE_SCHEMA: {
     run_id: z.ZodString;
     result: z.ZodRecord<z.ZodString, z.ZodUnknown>;

package/dist/tools/devx-run.js

@@ -124,7 +124,7 @@ export function createRunReportHandler(apiClient) {
 export const RUN_COMPLETE_NAME = "zivis_run_complete";
 export const RUN_COMPLETE_DESCRIPTION = `Complete a pending run with its final result envelope (ZIV-219 + ZIV-32) — the run's immutable close-out.
 
-\`result\` is the SAME envelope shape \`zivis run complete --input\` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } — validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus (on a fresh completion) the Application's Trust Room link, when one is provisioned.`;
+\`result\` is the SAME envelope shape \`zivis run complete --input\` accepts: { summary?, coverage[]?, findings[]?, retests[]?, evidence[]?, observations[]?, generatedArtifacts?, risk_candidates? } — validated server-side, not here. It may safely repeat items already posted via zivis_run_report; the shared fingerprint/content-hash/observation-key upserts converge instead of duplicating. The response reports what was created/updated/matched, plus the Application's stable Assurance Overview URL (\`applicationAssuranceUrl\`).`;
 export const RUN_COMPLETE_SCHEMA = {
     run_id: z.string().min(1).describe("The runId returned by zivis_run_start. Must be pending — completing an already-completed run replays idempotently."),
     result: z

package/dist/tools/discover-local-infra.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
-export declare const DISCOVER_LOCAL_INFRA_DESCRIPTION = "Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.\n\nAnalyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns structured recommendations for red team testing via zivis_local_scan.\n\nWhat it reads:\n- docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml\n- Dockerfile(s) in the project root and subdirectories\n- .env files (structure only \u2014 values are redacted for safety)\n- package.json, requirements.txt, pyproject.toml, go.mod (to detect AI frameworks)\n\nWhat it checks:\n- Docker daemon status\n- Currently running containers (docker compose ps)\n- Port mappings and exposed services\n\nWhat it returns:\n- List of services with ports and images\n- Running vs stopped status per service\n- Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)\n- Suggested target_url, chat_endpoint, target_type for zivis_local_scan\n- Whether the zivis-local-runner Docker image is available\n\nThis tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.";
+export declare const DISCOVER_LOCAL_INFRA_DESCRIPTION = "Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.\n\nAnalyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns a suggested target shape (URL, chat endpoint) for the coding agent to use as grounding context before running `zivis test ai`.\n\nWhat it reads:\n- docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml\n- Dockerfile(s) in the project root and subdirectories\n- .env files (structure only \u2014 values are redacted for safety)\n- package.json, requirements.txt, pyproject.toml, go.mod (to detect AI frameworks)\n\nWhat it checks:\n- Docker daemon status\n- Currently running containers (docker compose ps)\n- Port mappings and exposed services\n\nWhat it returns:\n- List of services with ports and images\n- Running vs stopped status per service\n- Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)\n- Suggested target_url/target_type/chat_endpoint \u2014 informational context, not a tool call to make\n- Whether the zivis-local-runner Docker image is available\n\nFor actually testing the discovered AI system, run `zivis test ai` in the terminal \u2014 this tool only maps what's running locally.\n\nThis tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.";
 export declare const DISCOVER_LOCAL_INFRA_SCHEMA: {
     project_dir: z.ZodOptional<z.ZodString>;
 };

package/dist/tools/discover-local-infra.js

@@ -7,7 +7,7 @@ const execAsync = promisify(exec);
 export const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
 export const DISCOVER_LOCAL_INFRA_DESCRIPTION = `Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.
 
-Analyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns structured recommendations for red team testing via zivis_local_scan.
+Analyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns a suggested target shape (URL, chat endpoint) for the coding agent to use as grounding context before running \`zivis test ai\`.
 
 What it reads:
 - docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml
@@ -24,9 +24,11 @@ What it returns:
 - List of services with ports and images
 - Running vs stopped status per service
 - Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)
-- Suggested target_url, chat_endpoint, target_type for zivis_local_scan
+- Suggested target_url/target_type/chat_endpoint — informational context, not a tool call to make
 - Whether the zivis-local-runner Docker image is available
 
+For actually testing the discovered AI system, run \`zivis test ai\` in the terminal — this tool only maps what's running locally.
+
 This tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.`;
 export const DISCOVER_LOCAL_INFRA_SCHEMA = {
     project_dir: z
@@ -127,7 +129,7 @@ export function createDiscoverLocalInfraHandler() {
             aiFrameworks: { detected: [], envHints: [] },
             runnerImage: { available: false },
             suggestion: null,
-            localScanCommand: null,
+            nextStep: null,
         };
         try {
             const { stdout } = await execAsync("docker version --format '{{.Server.Version}}'", {
@@ -344,19 +346,10 @@ export function createDiscoverLocalInfraHandler() {
         }
         result.suggestion = generateSuggestion(result.compose.services, result.aiFrameworks.detected, result.aiFrameworks.envHints, result.dockerfiles);
         if (result.suggestion) {
-            const parts = [`target_url="${result.suggestion.target_url}"`];
-            parts.push(`target_type="${result.suggestion.target_type}"`);
-            if (result.suggestion.chat_endpoint) {
-                parts.push(`chat_endpoint="${result.suggestion.chat_endpoint}"`);
-            }
-            if (result.suggestion.request_template) {
-                parts.push(`request_template='${result.suggestion.request_template}'`);
-            }
-            if (result.suggestion.response_path) {
-                parts.push(`response_path="${result.suggestion.response_path}"`);
-            }
-            parts.push(`scan_depth="standard"`);
-            result.localScanCommand = `zivis_local_scan(${parts.join(", ")})`;
+            result.nextStep =
+                `Detected ${result.suggestion.target_type} target at ${result.suggestion.target_url}` +
+                    (result.suggestion.chat_endpoint ? ` (chat endpoint: ${result.suggestion.chat_endpoint})` : "") +
+                    `. Run \`zivis test ai\` to test it.`;
         }
         return {
             content: [

package/dist/tools/get-started.d.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 import type { ZivisConfig } from "../types.js";
 export declare const GET_STARTED_NAME = "zivis_get_started";
-export declare const GET_STARTED_DESCRIPTION = "Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or \"what should I do next.\" Idempotent and safe to call repeatedly \u2014 detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.\n\nUse this when the user says any of:\n- \"what should I do for security on this app\"\n- \"uhh, where do I start\"\n- \"is my app safe\" / \"is my chatbot safe\"\n- \"I need to do security stuff before launch\"\n- \"I have an audit / pen test / customer asking about security\"\n- \"check my dependencies / libraries / repos\"\n- \"how do I use ZIVIS\"\n- \"what can ZIVIS do for me\"\n\nThis tool inspects the current project state \u2014 binding, application, scans, findings \u2014\nAND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local\nthreat library against it to surface architectural patterns ZIVIS thinks may apply\n(self-consistency without context isolation, late org filter, privilege separation, etc.).\nThe 'relevant_threats' field in the response is what makes this tool different from a\ngeneric security menu: ZIVIS is reading the user's actual codebase via the graph\nartifact and naming threats by their architectural shape.\n\nAlways speak to the user in threat-model language: components, flows, trust boundaries,\nattack scenarios. Even when they don't yet know those terms \u2014 that's how they learn.\n\nOutput is a structured JSON object. Present recommended_next_steps as a numbered list\nto the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead\nwith that \u2014 it's the most concrete thing ZIVIS knows about their repo. Use the label\nand why fields verbatim; do not invent new steps. If the user is unsure which to pick,\nrecommend the item flagged in if_user_unsure.";
+export declare const GET_STARTED_DESCRIPTION = "Call this FIRST on any turn where the user asks about security, vulnerabilities, code review, deployment readiness, threat modeling, dependencies, or \"what should I do next.\" Idempotent and safe to call repeatedly \u2014 detects prior inspect runs and never re-inspects unnecessarily. Prefer this over calling zivis_inspect directly.\n\nUse this when the user says any of:\n- \"what should I do for security on this app\"\n- \"uhh, where do I start\"\n- \"is my app safe\" / \"is my chatbot safe\"\n- \"I need to do security stuff before launch\"\n- \"I have an audit / pen test / customer asking about security\"\n- \"check my dependencies / libraries / repos\"\n- \"how do I use ZIVIS\"\n- \"what can ZIVIS do for me\"\n\nThis tool inspects the current project state \u2014 binding, application, scans, findings \u2014\nAND if a recent 'zivis inspect' artifact exists for this repo, evaluates the local\nthreat library against it to surface architectural patterns ZIVIS thinks may apply\n(self-consistency without context isolation, late org filter, privilege separation, etc.).\nThe 'relevant_threats' field in the response is what makes this tool different from a\ngeneric security menu: ZIVIS is reading the user's actual codebase via the graph\nartifact and naming threats by their architectural shape.\n\nSpeak in plain developer language by default \u2014 do not introduce jargon (actor, STRIDE,\nkill chain, TTPs) unless the user already used it. Naming the actual product concepts\n(\"your threat model\", `zivis threatmodel`) is fine when they are the literal thing being\ndiscussed; that is a product noun, not jargon to avoid.\n\nOutput is a structured JSON object. Present recommended_next_steps as a numbered list\nto the user, in order, and ask them to pick one. If relevant_threats is non-empty, lead\nwith that \u2014 it's the most concrete thing ZIVIS knows about their repo. Use the label\nand why fields verbatim; do not invent new steps. If the user is unsure which to pick,\nrecommend the item flagged in if_user_unsure.";
 export declare const GET_STARTED_SCHEMA: {
     concern: z.ZodOptional<z.ZodString>;
     cwd: z.ZodOptional<z.ZodString>;