@zivis/mcp 0.1.19 → 0.2.2

package/dist/tools/create-diagram.js

@@ -1,74 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../sanitize.js";
-export const CREATE_DIAGRAM_NAME = "zivis_create_diagram";
-export const CREATE_DIAGRAM_DESCRIPTION = `Create a new diagram from Mermaid source.
-
-Use this to record system architecture diagrams, data flow diagrams, attack chains, sequence diagrams, etc. from code analysis. Content is Mermaid syntax (flowchart, sequenceDiagram, etc.) — see zivis_update_mermaid_source for editing an existing diagram's source.`;
-export const CREATE_DIAGRAM_SCHEMA = {
-    name: z
-        .string()
-        .describe("Diagram name"),
-    description: z
-        .string()
-        .optional()
-        .describe("Diagram description"),
-    diagram_type: z
-        .enum(["architecture", "data_flow", "attack_chain", "sequence", "trust_boundary", "network", "deployment", "custom"])
-        .describe("Type of diagram"),
-    content: z
-        .string()
-        .describe("Mermaid diagram source (e.g., 'flowchart TD\\n  A[Client] --> B[Server]')"),
-    linked_threat_model_id: z
-        .string()
-        .optional()
-        .describe("Threat model UUID to link this diagram to after creation"),
-};
-export function createCreateDiagramHandler(apiClient) {
-    return async (params) => {
-        try {
-            const data = await apiClient.post("/api/diagrams", {
-                name: params.name,
-                description: params.description,
-                diagramType: params.diagram_type,
-                contentType: "mermaid",
-                content: params.content,
-                sourceType: "manual",
-            });
-            const sanitized = sanitizeResponse(data);
-            const diagramId = sanitized.id;
-            let linkedThreatModelId = null;
-            if (params.linked_threat_model_id && diagramId) {
-                try {
-                    await apiClient.post(`/api/diagrams/${diagramId}/link`, {
-                        threatModelId: params.linked_threat_model_id,
-                    });
-                    linkedThreatModelId = params.linked_threat_model_id;
-                }
-                catch {
-                }
-            }
-            const result = {
-                diagram_id: diagramId,
-                name: sanitized.name,
-                diagram_type: sanitized.diagramType,
-                linked_threat_model_id: linkedThreatModelId,
-                _instruction: "Diagram created. Use zivis_get_diagram to see full content, or zivis_manage_diagram to modify metadata/links, or zivis_update_mermaid_source to change the diagram source.",
-            };
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify(result, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to create diagram";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/create-document.d.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-export declare const CREATE_DOCUMENT_NAME = "zivis_create_document";
-export declare const CREATE_DOCUMENT_DESCRIPTION = "Create a new narrative markdown document under a ThreatModel.\n\nUse this when the user wants a rich written artifact to accompany the threat model \u2014 executive summary, remediation plan, architecture narrative, etc. The document can embed standalone Diagrams by reference.";
-export declare const CREATE_DOCUMENT_SCHEMA: {
-    threat_model_id: z.ZodString;
-    title: z.ZodString;
-    content: z.ZodOptional<z.ZodString>;
-    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-};
-type CreateDocumentParams = {
-    threat_model_id: string;
-    title: string;
-    content?: string;
-    tags?: string[];
-};
-export declare function createCreateDocumentHandler(apiClient: ApiClient): (params: CreateDocumentParams) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;
-export {};

package/dist/tools/create-document.js

@@ -1,47 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
-export const CREATE_DOCUMENT_NAME = "zivis_create_document";
-export const CREATE_DOCUMENT_DESCRIPTION = `Create a new narrative markdown document under a ThreatModel.
-
-Use this when the user wants a rich written artifact to accompany the threat model — executive summary, remediation plan, architecture narrative, etc. The document can embed standalone Diagrams by reference.`;
-export const CREATE_DOCUMENT_SCHEMA = {
-    threat_model_id: z.string().describe("UUID of the parent threat model"),
-    title: z.string().describe("Document title (e.g., 'System Architecture Narrative')"),
-    content: z
-        .string()
-        .optional()
-        .describe("Initial markdown content. Can include embedded diagrams via ```mermaid or ```zivis:diagram fenced blocks."),
-    tags: z.array(z.string()).optional().describe("Optional tags"),
-};
-function errorResult(message) {
-    return {
-        content: [{ type: "text", text: `Error: ${message}` }],
-        isError: true,
-    };
-}
-function successResult(data) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-    };
-}
-export function createCreateDocumentHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, title, content, tags } = params;
-            if (!threat_model_id)
-                return errorResult("threat_model_id is required");
-            if (!title || !title.trim())
-                return errorResult("title is required");
-            const data = await apiClient.post(`/api/documents`, {
-                threatModelId: threat_model_id,
-                title: sanitizeInboundText(title, 500),
-                content: sanitizeInboundText(content ?? "", 200_000),
-                tags: tags ?? [],
-            });
-            return successResult(data);
-        }
-        catch (err) {
-            return errorResult(err?.message ?? "Failed to create document");
-        }
-    };
-}

package/dist/tools/create-finding.d.ts

@@ -1,85 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-export declare const CREATE_FINDING_NAME = "zivis_create_finding";
-export declare const CREATE_FINDING_DESCRIPTION = "Create a tracked security finding authored by hand (not from a scanner).\n\nUse when you've identified a vulnerability, misconfiguration, or weakness \u2014 for example one written into a README or surfaced while reviewing code \u2014 and the user wants it captured as a real finding. Provide a clear title and an honest severity. If the finding came from a specific document, pass source_document_id so it links back to that document.\n\nFor service-delivered results (an analyst-run pen test, red-team exercise, or ZRT run), pass source_type (pen_test | red_team | threat_model) so the finding flows to the Signal API, plus producer provenance describing who/what produced it. Non-manual source_type requires the run_agents org permission.";
-export declare const CREATE_FINDING_SCHEMA: {
-    title: z.ZodString;
-    severity: z.ZodEnum<{
-        critical: "critical";
-        high: "high";
-        medium: "medium";
-        low: "low";
-        info: "info";
-    }>;
-    description: z.ZodOptional<z.ZodString>;
-    category: z.ZodOptional<z.ZodEnum<{
-        vulnerability: "vulnerability";
-        misconfiguration: "misconfiguration";
-        secret: "secret";
-        anomaly: "anomaly";
-        other: "other";
-    }>>;
-    confidence: z.ZodOptional<z.ZodEnum<{
-        high: "high";
-        medium: "medium";
-        low: "low";
-    }>>;
-    application_id: z.ZodOptional<z.ZodString>;
-    source_document_id: z.ZodOptional<z.ZodString>;
-    excerpt: z.ZodOptional<z.ZodString>;
-    evidence_location: z.ZodOptional<z.ZodString>;
-    cwe_id: z.ZodOptional<z.ZodString>;
-    owasp_id: z.ZodOptional<z.ZodString>;
-    remediation_steps: z.ZodOptional<z.ZodString>;
-    source_type: z.ZodOptional<z.ZodEnum<{
-        threat_model: "threat_model";
-        red_team: "red_team";
-        pen_test: "pen_test";
-        manual: "manual";
-    }>>;
-    producer: z.ZodOptional<z.ZodObject<{
-        kind: z.ZodEnum<{
-            human: "human";
-            zrt: "zrt";
-            frontier_tool: "frontier_tool";
-            third_party: "third_party";
-        }>;
-        id: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-        toolVersion: z.ZodOptional<z.ZodString>;
-        engagementId: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    scenario_id: z.ZodOptional<z.ZodString>;
-    attack_step_id: z.ZodOptional<z.ZodString>;
-};
-type CreateFindingParams = {
-    title: string;
-    severity: "critical" | "high" | "medium" | "low" | "info";
-    description?: string;
-    category?: "vulnerability" | "misconfiguration" | "secret" | "anomaly" | "other";
-    confidence?: "high" | "medium" | "low";
-    application_id?: string;
-    source_document_id?: string;
-    excerpt?: string;
-    evidence_location?: string;
-    cwe_id?: string;
-    owasp_id?: string;
-    remediation_steps?: string;
-    source_type?: "manual" | "pen_test" | "red_team" | "threat_model";
-    producer?: {
-        kind: "human" | "zrt" | "frontier_tool" | "third_party";
-        id?: string;
-        name?: string;
-        toolVersion?: string;
-        engagementId?: string;
-    };
-    scenario_id?: string;
-    attack_step_id?: string;
-};
-export declare function createCreateFindingHandler(apiClient: ApiClient): (params: CreateFindingParams) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;
-export {};

package/dist/tools/create-finding.js

@@ -1,136 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
-import { requireApplicationId } from "../resolve-application-id.js";
-export const CREATE_FINDING_NAME = "zivis_create_finding";
-export const CREATE_FINDING_DESCRIPTION = `Create a tracked security finding authored by hand (not from a scanner).
-
-Use when you've identified a vulnerability, misconfiguration, or weakness — for example one written into a README or surfaced while reviewing code — and the user wants it captured as a real finding. Provide a clear title and an honest severity. If the finding came from a specific document, pass source_document_id so it links back to that document.
-
-For service-delivered results (an analyst-run pen test, red-team exercise, or ZRT run), pass source_type (pen_test | red_team | threat_model) so the finding flows to the Signal API, plus producer provenance describing who/what produced it. Non-manual source_type requires the run_agents org permission.`;
-export const CREATE_FINDING_SCHEMA = {
-    title: z.string().describe("Short summary of the finding"),
-    severity: z
-        .enum(["critical", "high", "medium", "low", "info"])
-        .describe("Severity — be honest; reserve critical/high for genuinely exploitable issues"),
-    description: z
-        .string()
-        .optional()
-        .describe("Details: what the weakness is, why it matters, and any evidence/excerpt"),
-    category: z
-        .enum(["vulnerability", "misconfiguration", "secret", "anomaly", "other"])
-        .optional()
-        .describe("Finding category (default: vulnerability)"),
-    confidence: z
-        .enum(["high", "medium", "low"])
-        .optional()
-        .describe("How confident you are this is real (default: medium)"),
-    application_id: z
-        .string()
-        .optional()
-        .describe("Application UUID. Defaults to applicationId in .zivis/project.json if omitted."),
-    source_document_id: z
-        .string()
-        .optional()
-        .describe("UUID of a ZIVIS Document this finding came from. Links the finding back to it."),
-    excerpt: z
-        .string()
-        .optional()
-        .describe("The exact source text the finding was drawn from (e.g. the README snippet)."),
-    evidence_location: z
-        .string()
-        .optional()
-        .describe("Human-readable locator, e.g. 'README.md:L40-L51' or a file path."),
-    cwe_id: z.string().optional().describe("Optional CWE id, e.g. 'CWE-89'"),
-    owasp_id: z.string().optional().describe("Optional OWASP id, e.g. 'A01'"),
-    remediation_steps: z.string().optional().describe("Optional remediation guidance"),
-    source_type: z
-        .enum(["manual", "pen_test", "red_team", "threat_model"])
-        .optional()
-        .describe("Source family (default: manual). Non-manual values mark the finding as a service-delivered result that flows to the Signal API; requires the run_agents org permission."),
-    producer: z
-        .object({
-        kind: z
-            .enum(["human", "zrt", "frontier_tool", "third_party"])
-            .describe("Who/what produced the finding"),
-        id: z.string().optional().describe("Stable producer identifier (e.g. analyst email)"),
-        name: z.string().optional().describe("Display name (e.g. 'Jake Miller', 'ZRT')"),
-        toolVersion: z.string().optional().describe("Tool version, if applicable"),
-        engagementId: z.string().optional().describe("Engagement/campaign this run belongs to"),
-    })
-        .optional()
-        .describe("Producer provenance, stored on the finding as metadata.producer"),
-    scenario_id: z
-        .string()
-        .optional()
-        .describe("GraphNode logicalId (UUID) of the ATTACK_SCENARIO this finding proves out"),
-    attack_step_id: z
-        .string()
-        .optional()
-        .describe("GraphNode logicalId (UUID) of the ATTACK_STEP this finding corresponds to"),
-};
-function errorResult(message) {
-    return {
-        content: [{ type: "text", text: `Error: ${message}` }],
-        isError: true,
-    };
-}
-function successResult(data) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-    };
-}
-export function createCreateFindingHandler(apiClient) {
-    return async (params) => {
-        try {
-            if (!params.title || !params.title.trim())
-                return errorResult("title is required");
-            if (!params.severity)
-                return errorResult("severity is required");
-            let applicationId;
-            if (!params.source_document_id) {
-                const resolved = requireApplicationId(params.application_id);
-                if (!resolved.ok)
-                    return errorResult(resolved.message);
-                applicationId = resolved.id;
-            }
-            else {
-                applicationId = resolveApplicationIdSafe(params.application_id);
-            }
-            const data = await apiClient.post(`/api/findings/unified`, {
-                title: sanitizeInboundText(params.title, 500),
-                severity: params.severity,
-                description: sanitizeInboundText(params.description, 8000),
-                category: params.category,
-                confidence: params.confidence,
-                origin: "mcp",
-                applicationId,
-                sourceDocumentId: params.source_document_id,
-                excerpt: sanitizeInboundText(params.excerpt, 8000),
-                evidenceLocation: sanitizeInboundText(params.evidence_location, 500),
-                cweId: params.cwe_id,
-                owaspId: params.owasp_id,
-                remediationSteps: sanitizeInboundText(params.remediation_steps, 4000),
-                sourceType: params.source_type,
-                producer: params.producer
-                    ? {
-                        kind: params.producer.kind,
-                        id: sanitizeInboundText(params.producer.id, 300),
-                        name: sanitizeInboundText(params.producer.name, 300),
-                        toolVersion: sanitizeInboundText(params.producer.toolVersion, 300),
-                        engagementId: sanitizeInboundText(params.producer.engagementId, 300),
-                    }
-                    : undefined,
-                scenarioId: params.scenario_id,
-                attackStepId: params.attack_step_id,
-            });
-            return successResult(data);
-        }
-        catch (err) {
-            return errorResult(err?.message ?? "Failed to create finding");
-        }
-    };
-}
-function resolveApplicationIdSafe(explicit) {
-    const r = requireApplicationId(explicit);
-    return r.ok ? r.id : undefined;
-}

package/dist/tools/delete-finding.d.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-export declare const DELETE_FINDING_NAME = "zivis_delete_finding";
-export declare const DELETE_FINDING_DESCRIPTION = "Delete a manually-created security finding (soft-delete \u2014 it's retained for audit and removed from the default views).\n\nUse when a hand-authored finding (from zivis_create_finding or a document highlight) is no longer wanted \u2014 e.g. a mistake or a duplicate. Only manual findings can be deleted; scanner findings should be dismissed or suppressed via zivis_update_finding instead. Pass the finding's id and, ideally, a short reason for the audit trail.";
-export declare const DELETE_FINDING_SCHEMA: {
-    finding_id: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-};
-type DeleteFindingParams = {
-    finding_id: string;
-    reason?: string;
-};
-export declare function createDeleteFindingHandler(apiClient: ApiClient): (params: DeleteFindingParams) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;
-export {};

package/dist/tools/delete-finding.js

@@ -1,36 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../sanitize.js";
-export const DELETE_FINDING_NAME = "zivis_delete_finding";
-export const DELETE_FINDING_DESCRIPTION = `Delete a manually-created security finding (soft-delete — it's retained for audit and removed from the default views).
-
-Use when a hand-authored finding (from zivis_create_finding or a document highlight) is no longer wanted — e.g. a mistake or a duplicate. Only manual findings can be deleted; scanner findings should be dismissed or suppressed via zivis_update_finding instead. Pass the finding's id and, ideally, a short reason for the audit trail.`;
-export const DELETE_FINDING_SCHEMA = {
-    finding_id: z.string().describe("UUID of the manual finding to delete"),
-    reason: z.string().optional().describe("Short reason for deleting (recorded in audit history)"),
-};
-function errorResult(message) {
-    return {
-        content: [{ type: "text", text: `Error: ${message}` }],
-        isError: true,
-    };
-}
-function successResult(data) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-    };
-}
-export function createDeleteFindingHandler(apiClient) {
-    return async (params) => {
-        try {
-            if (!params.finding_id || !params.finding_id.trim()) {
-                return errorResult("finding_id is required");
-            }
-            const query = params.reason ? `?reason=${encodeURIComponent(params.reason)}` : "";
-            const data = await apiClient.del(`/api/findings/unified/${encodeURIComponent(params.finding_id)}${query}`);
-            return successResult(data);
-        }
-        catch (err) {
-            return errorResult(err?.message ?? "Failed to delete finding");
-        }
-    };
-}

package/dist/tools/discover-local-infra.d.ts

@@ -1,14 +0,0 @@
-import { z } from "zod";
-export declare const DISCOVER_LOCAL_INFRA_NAME = "zivis_discover_local_infra";
-export declare const DISCOVER_LOCAL_INFRA_DESCRIPTION = "Discover AI infrastructure in a local project directory by reading Docker, compose, and dependency files.\n\nAnalyzes the project to understand what services are defined, which are running, and what AI/LLM frameworks are in use. Returns a suggested target shape (URL, chat endpoint) for the coding agent to use as grounding context before running `zivis test ai`.\n\nWhat it reads:\n- docker-compose.yml / docker-compose.yaml / compose.yml / compose.yaml\n- Dockerfile(s) in the project root and subdirectories\n- .env files (structure only \u2014 values are redacted for safety)\n- package.json, requirements.txt, pyproject.toml, go.mod (to detect AI frameworks)\n\nWhat it checks:\n- Docker daemon status\n- Currently running containers (docker compose ps)\n- Port mappings and exposed services\n\nWhat it returns:\n- List of services with ports and images\n- Running vs stopped status per service\n- Detected AI/LLM patterns (OpenAI, Anthropic, LangChain, etc.)\n- Suggested target_url/target_type/chat_endpoint \u2014 informational context, not a tool call to make\n- Whether the zivis-local-runner Docker image is available\n\nFor actually testing the discovered AI system, run `zivis test ai` in the terminal \u2014 this tool only maps what's running locally.\n\nThis tool makes NO network requests and requires NO authentication. It only reads local files and queries the Docker daemon.";
-export declare const DISCOVER_LOCAL_INFRA_SCHEMA: {
-    project_dir: z.ZodOptional<z.ZodString>;
-};
-export declare function createDiscoverLocalInfraHandler(): (params: {
-    project_dir?: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;