@zivis/mcp 0.1.6 → 0.1.7

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-08-25T22:25:05.314Z",
+  "built_at": "2026-08-27T22:39:07.661Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/server.js

@@ -89,13 +89,6 @@ import { DELETE_FINDING_NAME, DELETE_FINDING_DESCRIPTION, DELETE_FINDING_SCHEMA,
 import { UPDATE_DOCUMENT_NAME, UPDATE_DOCUMENT_DESCRIPTION, UPDATE_DOCUMENT_SCHEMA, createUpdateDocumentHandler, } from "./tools/update-document.js";
 import { SECURITY_REVIEW_NAME, SECURITY_REVIEW_DESCRIPTION, SECURITY_REVIEW_SCHEMA, createSecurityReviewHandler, } from "./tools/security-review.js";
 import { CHECK_PROJECT_NAME, CHECK_PROJECT_DESCRIPTION, CHECK_PROJECT_SCHEMA, createCheckProjectHandler, } from "./tools/check-project.js";
-import { GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler } from "./tools/enterprise/get-threat-model.js";
-import { LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler } from "./tools/enterprise/list-threat-models.js";
-import { LIST_ATTACK_SCENARIOS_NAME, LIST_ATTACK_SCENARIOS_DESCRIPTION, LIST_ATTACK_SCENARIOS_SCHEMA, createListAttackScenariosHandler } from "./tools/enterprise/list-attack-scenarios.js";
-import { MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler } from "./tools/enterprise/manage-actor.js";
-import { MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler } from "./tools/enterprise/manage-attack-scenario.js";
-import { MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler } from "./tools/enterprise/manage-security-control.js";
-import { MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler } from "./tools/enterprise/manage-data-asset.js";
 import { GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler } from "./tools/enterprise/get-org-zat.js";
 import { OPEN_IN_IDE_NAME, OPEN_IN_IDE_DESCRIPTION, OPEN_IN_IDE_SCHEMA, createOpenInIdeHandler, } from "./tools/open-in-ide.js";
 export async function startServer(incoming = DEFAULT_CONFIG) {
@@ -290,13 +283,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         };
     }
     const enterpriseTools = [
-        [GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler(apiClient)],
-        [LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler(apiClient)],
-        [LIST_ATTACK_SCENARIOS_NAME, LIST_ATTACK_SCENARIOS_DESCRIPTION, LIST_ATTACK_SCENARIOS_SCHEMA, createListAttackScenariosHandler(apiClient)],
-        [MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler(apiClient)],
-        [MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler(apiClient)],
-        [MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler(apiClient)],
-        [MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler(apiClient)],
         [GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler(apiClient)],
     ];
     for (const [name, description, schema, handler] of enterpriseTools) {

package/dist/tools/security-review.d.ts

@@ -2,16 +2,13 @@ import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 import type { ZivisConfig } from "../types.js";
 export declare const SECURITY_REVIEW_NAME = "zivis_security_review";
-export declare const SECURITY_REVIEW_DESCRIPTION = "Gather ZIVIS security intelligence for an AI-powered code review.\n\nPulls historical findings, open vulnerabilities, threat model controls, and attack scenarios to give you comprehensive security context. Use this BEFORE reviewing code to understand:\n\n1. **Regression risks** \u2014 Previously fixed vulnerabilities that could be reintroduced\n2. **Known vulnerabilities** \u2014 Open findings that may be relevant to the code being reviewed\n3. **Security controls** \u2014 What controls are expected (input validation, auth, rate limiting, etc.)\n4. **Attack scenarios** \u2014 Known attack vectors for this application (STRIDE-categorized)\n5. **Dependency risks** \u2014 OSS trust scores for dependencies in the code\n\nReturns structured security context that you should reference during code review. Focus on:\n- Code that touches areas where historical findings were fixed (regression check)\n- Missing or weak implementations of expected security controls\n- Code patterns that match known attack scenarios\n- Use of low-trust dependencies\n\nProvide at least one of: repo, application_id, threat_model_id, or campaign_id.";
+export declare const SECURITY_REVIEW_DESCRIPTION = "Gather ZIVIS security intelligence for an AI-powered code review.\n\nPulls historical findings and open vulnerabilities to give you comprehensive security context. Use this BEFORE reviewing code to understand:\n\n1. **Regression risks** \u2014 Previously fixed vulnerabilities that could be reintroduced\n2. **Known vulnerabilities** \u2014 Open findings that may be relevant to the code being reviewed\n3. **Dependency risks** \u2014 OSS trust scores for dependencies in the code\n\nReturns structured security context that you should reference during code review. Focus on:\n- Code that touches areas where historical findings were fixed (regression check)\n- Use of low-trust dependencies\n\nProvide at least one of: repo, application_id, or campaign_id.";
 export declare const SECURITY_REVIEW_SCHEMA: {
     repo: z.ZodOptional<z.ZodString>;
     application_id: z.ZodOptional<z.ZodString>;
-    threat_model_id: z.ZodOptional<z.ZodString>;
     campaign_id: z.ZodOptional<z.ZodString>;
     focus_areas: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         regression: "regression";
-        controls: "controls";
-        attack_scenarios: "attack_scenarios";
         dependencies: "dependencies";
         all: "all";
     }>>>;
@@ -28,7 +25,6 @@ export declare const SECURITY_REVIEW_SCHEMA: {
 export declare function createSecurityReviewHandler(apiClient: ApiClient, config: ZivisConfig): (params: {
     repo?: string;
     application_id?: string;
-    threat_model_id?: string;
     campaign_id?: string;
     focus_areas?: string[];
     severity_threshold?: string;

package/dist/tools/security-review.js

@@ -4,31 +4,26 @@ import { sanitizeResponse } from "../sanitize.js";
 export const SECURITY_REVIEW_NAME = "zivis_security_review";
 export const SECURITY_REVIEW_DESCRIPTION = `Gather ZIVIS security intelligence for an AI-powered code review.
 
-Pulls historical findings, open vulnerabilities, threat model controls, and attack scenarios to give you comprehensive security context. Use this BEFORE reviewing code to understand:
+Pulls historical findings and open vulnerabilities to give you comprehensive security context. Use this BEFORE reviewing code to understand:
 
 1. **Regression risks** — Previously fixed vulnerabilities that could be reintroduced
 2. **Known vulnerabilities** — Open findings that may be relevant to the code being reviewed
-3. **Security controls** — What controls are expected (input validation, auth, rate limiting, etc.)
-4. **Attack scenarios** — Known attack vectors for this application (STRIDE-categorized)
-5. **Dependency risks** — OSS trust scores for dependencies in the code
+3. **Dependency risks** — OSS trust scores for dependencies in the code
 
 Returns structured security context that you should reference during code review. Focus on:
 - Code that touches areas where historical findings were fixed (regression check)
-- Missing or weak implementations of expected security controls
-- Code patterns that match known attack scenarios
 - Use of low-trust dependencies
 
-Provide at least one of: repo, application_id, threat_model_id, or campaign_id.`;
+Provide at least one of: repo, application_id, or campaign_id.`;
 export const SECURITY_REVIEW_SCHEMA = {
     repo: z.string().optional().describe("Repository name (owner/repo) — pulls findings and OSS trust data"),
     application_id: z
         .string()
         .optional()
         .describe("Application UUID — pulls findings scoped to this app. If omitted, uses applicationId from .zivis/project.json when set."),
-    threat_model_id: z.string().optional().describe("Threat model UUID — pulls controls, attack scenarios, and findings"),
     campaign_id: z.string().optional().describe("Campaign UUID — pulls campaign-specific findings"),
     focus_areas: z
-        .array(z.enum(["regression", "controls", "attack_scenarios", "dependencies", "all"]))
+        .array(z.enum(["regression", "dependencies", "all"]))
         .optional()
         .describe("Which intelligence to gather (default: all)"),
     severity_threshold: z
@@ -53,13 +48,13 @@ const SEVERITY_ORDER = {
 };
 export function createSecurityReviewHandler(apiClient, config) {
     return async (params) => {
-        const { repo, application_id: application_idParam, threat_model_id, campaign_id, focus_areas = ["all"], severity_threshold = "low", include_resolved = true, dependency_list, } = params;
+        const { repo, application_id: application_idParam, campaign_id, focus_areas = ["all"], severity_threshold = "low", include_resolved = true, dependency_list, } = params;
         const application_id = resolveApplicationId(application_idParam);
-        if (!repo && !application_id && !threat_model_id && !campaign_id) {
+        if (!repo && !application_id && !campaign_id) {
             return {
                 content: [{
                         type: "text",
-                        text: "Error: Provide at least one of: repo, application_id, threat_model_id, or campaign_id " +
+                        text: "Error: Provide at least one of: repo, application_id, or campaign_id " +
                             "(or set applicationId in .zivis/project.json for default app scope)",
                     }],
                 isError: true,
@@ -69,7 +64,7 @@ export function createSecurityReviewHandler(apiClient, config) {
         const context = {
             _description: "ZIVIS Security Review Context — use this intelligence during code review",
             generatedAt: new Date().toISOString(),
-            parameters: { repo, application_id, threat_model_id, campaign_id },
+            parameters: { repo, application_id, campaign_id },
         };
         const errors = [];
         if (shouldInclude("regression") && (repo || application_id)) {
@@ -117,76 +112,6 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Open findings: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
-        if ((shouldInclude("controls") || shouldInclude("attack_scenarios")) && threat_model_id) {
-            let tm = null;
-            try {
-                tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
-            }
-            catch (err) {
-                errors.push(`Threat model fetch: ${err instanceof Error ? err.message : "failed"}`);
-            }
-            const versions = Array.isArray(tm?.versions) ? tm.versions : [];
-            const latestVersion = versions[0] || {};
-            if (tm && shouldInclude("controls")) {
-                try {
-                    const controls = Array.isArray(latestVersion.securityControls)
-                        ? latestVersion.securityControls
-                        : [];
-                    const notImplemented = controls.filter((c) => c.status === "not_implemented");
-                    const partial = controls.filter((c) => c.status === "partial");
-                    const implemented = controls.filter((c) => c.status === "implemented");
-                    context.securityControls = {
-                        _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
-                        summary: {
-                            implemented: implemented.length,
-                            partial: partial.length,
-                            notImplemented: notImplemented.length,
-                        },
-                        gapControls: [...notImplemented, ...partial].map((c) => ({
-                            name: c.name,
-                            type: c.controlType,
-                            status: c.status,
-                            description: c.description,
-                            effectiveness: c.effectivenessRating,
-                        })),
-                        implementedControls: implemented.map((c) => ({
-                            name: c.name,
-                            type: c.controlType,
-                            description: c.description,
-                        })),
-                    };
-                }
-                catch (err) {
-                    errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
-                }
-            }
-            if (tm && shouldInclude("attack_scenarios")) {
-                try {
-                    const scenarios = Array.isArray(latestVersion.attackScenarios)
-                        ? latestVersion.attackScenarios
-                        : [];
-                    const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
-                    const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
-                    context.attackScenarios = {
-                        _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
-                        count: filtered.length,
-                        scenarios: filtered.map((s) => ({
-                            displayId: s.displayId,
-                            title: s.title,
-                            strideCategory: s.strideCategory,
-                            severity: s.severity,
-                            likelihood: s.likelihood,
-                            riskScore: s.riskScore,
-                            status: s.status,
-                            narrative: s.narrative,
-                        })),
-                    };
-                }
-                catch (err) {
-                    errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
-                }
-            }
-        }
         if (shouldInclude("dependencies") && dependency_list && dependency_list.length > 0) {
             const depResults = [];
             const baseUrl = config.apiBaseUrl;
@@ -330,17 +255,6 @@ function buildReviewGuidance(context) {
     if (open?.count > 0) {
         guidance.push(`OPEN VULNS: ${open.count} known vulnerabilities (${open.bySeverity?.critical || 0} critical, ${open.bySeverity?.high || 0} high). Verify changes don't worsen these.`);
     }
-    const controls = context.securityControls;
-    if (controls) {
-        const gaps = controls.summary?.notImplemented + controls.summary?.partial;
-        if (gaps > 0) {
-            guidance.push(`CONTROL GAPS: ${gaps} security controls are missing or partial. Check if code should implement them.`);
-        }
-    }
-    const attacks = context.attackScenarios;
-    if (attacks?.count > 0) {
-        guidance.push(`ATTACK VECTORS: ${attacks.count} known attack scenarios. Verify code is resilient to these.`);
-    }
     const deps = context.dependencyRisks;
     if (deps?.riskyCount > 0) {
         guidance.push(`RISKY DEPS: ${deps.riskyCount} dependencies with low trust scores. Consider alternatives.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",

package/dist/tools/enterprise/get-threat-model.d.ts

@@ -1,22 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const GET_THREAT_MODEL_NAME = "zivis_get_threat_model";
-export declare const GET_THREAT_MODEL_DESCRIPTION = "Get a threat model \u2014 its metadata, status, owning application, and linked diagrams.\n\nReturns:\n- The threat model row (name, status, application association, timestamps)\n- **Linked Diagrams** (`linked_diagrams`): first-class `Diagram` entities linked to this threat model. Use `zivis_get_diagram` for full content.\n- Threat-model documents are listed via `zivis_list_documents` with `threat_model_id`.\n\nIMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.";
-export declare const GET_THREAT_MODEL_SCHEMA: {
-    threat_model_id: z.ZodString;
-};
-export declare function createGetThreatModelHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-}>;

package/dist/tools/enterprise/get-threat-model.js

@@ -1,61 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const GET_THREAT_MODEL_NAME = "zivis_get_threat_model";
-export const GET_THREAT_MODEL_DESCRIPTION = `Get a threat model — its metadata, status, owning application, and linked diagrams.
-
-Returns:
-- The threat model row (name, status, application association, timestamps)
-- **Linked Diagrams** (\`linked_diagrams\`): first-class \`Diagram\` entities linked to this threat model. Use \`zivis_get_diagram\` for full content.
-- Threat-model documents are listed via \`zivis_list_documents\` with \`threat_model_id\`.
-
-IMPORTANT: The threat_model_id must be a threat model UUID from zivis_list_threat_models, NOT a scan ID or agent instance ID.`;
-export const GET_THREAT_MODEL_SCHEMA = {
-    threat_model_id: z
-        .string()
-        .describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-};
-export function createGetThreatModelHandler(apiClient) {
-    return async (params) => {
-        try {
-            const [threatModelData, diagramsData] = await Promise.all([
-                apiClient.get(`/api/threat-models/${params.threat_model_id}`),
-                apiClient
-                    .get(`/api/diagrams?linkedThreatModelId=${params.threat_model_id}&take=50`)
-                    .catch(() => ({ diagrams: [], total: 0 })),
-            ]);
-            const sanitized = sanitizeResponse(threatModelData);
-            const linkedDiagrams = Array.isArray(diagramsData.diagrams)
-                ? diagramsData.diagrams.map((d) => ({
-                    diagram_id: d.id,
-                    name: d.name,
-                    diagram_type: d.diagramType,
-                    content_type: d.contentType,
-                    description: d.description || null,
-                    node_count: d._count?.nodes ?? null,
-                    connection_count: d._count?.connections ?? null,
-                    updated_at: d.updatedAt,
-                }))
-                : [];
-            const result = {
-                ...sanitized,
-                linked_diagrams: linkedDiagrams,
-                linked_diagrams_count: diagramsData.total,
-            };
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify(result, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to get threat model";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/list-attack-scenarios.d.ts

@@ -1,24 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const LIST_ATTACK_SCENARIOS_NAME = "zivis_list_attack_scenarios";
-export declare const LIST_ATTACK_SCENARIOS_DESCRIPTION = "List attack scenarios for a threat model, including their path steps.\n\nUse this when you need scenario IDs or attack path step IDs for follow-up tools (for example, step-level library test mappings).\n\nIMPORTANT: threat_model_id must be a threat model UUID (from zivis_list_threat_models), not a scan ID.";
-export declare const LIST_ATTACK_SCENARIOS_SCHEMA: {
-    threat_model_id: z.ZodString;
-    limit: z.ZodDefault<z.ZodNumber>;
-};
-export declare function createListAttackScenariosHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-    limit?: number;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-}>;

package/dist/tools/enterprise/list-attack-scenarios.js

@@ -1,63 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const LIST_ATTACK_SCENARIOS_NAME = "zivis_list_attack_scenarios";
-export const LIST_ATTACK_SCENARIOS_DESCRIPTION = `List attack scenarios for a threat model, including their path steps.
-
-Use this when you need scenario IDs or attack path step IDs for follow-up tools (for example, step-level library test mappings).
-
-IMPORTANT: threat_model_id must be a threat model UUID (from zivis_list_threat_models), not a scan ID.`;
-export const LIST_ATTACK_SCENARIOS_SCHEMA = {
-    threat_model_id: z
-        .string()
-        .describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID)"),
-    limit: z
-        .number()
-        .min(1)
-        .max(200)
-        .default(50)
-        .describe("Maximum scenarios to return (1-200, default 50)"),
-};
-export function createListAttackScenariosHandler(apiClient) {
-    return async (params) => {
-        try {
-            const data = await apiClient.get(`/api/threat-models/${params.threat_model_id}/attack-scenarios`);
-            const limit = params.limit ?? 50;
-            const scenarios = (data.attackScenarios || []).slice(0, limit).map((scenario) => ({
-                scenario_id: scenario.id,
-                display_id: scenario.displayId,
-                title: scenario.title,
-                severity: scenario.severity,
-                likelihood: scenario.likelihood,
-                status: scenario.status,
-                review_status: scenario.reviewStatus,
-                risk_score: scenario.riskScore,
-                test_case_count: scenario._count?.testCases ?? 0,
-                step_count: scenario.pathSteps?.length ?? 0,
-                path_steps: (scenario.pathSteps || []).map((step) => ({
-                    step_id: step.id,
-                    step_order: step.stepOrder,
-                    action: step.action,
-                    library_test_count: step._count?.libraryTests ?? 0,
-                })),
-                created_at: scenario.createdAt,
-                updated_at: scenario.updatedAt,
-            }));
-            const sanitized = sanitizeResponse({
-                is_analyzing: data.isAnalyzing ?? false,
-                is_fallback_version: data.isFallback ?? false,
-                total_returned: scenarios.length,
-                scenarios,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to list attack scenarios";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/list-threat-models.d.ts

@@ -1,31 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const LIST_THREAT_MODELS_NAME = "zivis_list_threat_models";
-export declare const LIST_THREAT_MODELS_DESCRIPTION = "List all threat models for your organization. Returns name, status, summary info, and linked diagram counts for each threat model.\n\nAlso fetches any diagrams linked to each threat model, so you can see which threat models have associated architecture, data flow, or trust boundary diagrams. Use zivis_get_threat_model to see full diagram details.\n\nIMPORTANT: Threat models are NOT scans and NOT agents. They are separate entities:\n- A **threat model** (returned here) has its own UUID and contains components, data flows, actors, findings, etc.\n- A **scan** is an agent execution run (from zivis_list_scans) \u2014 scans may CREATE or UPDATE threat models, but scan IDs \u2260 threat model IDs.\n- An **agent instance** is a configured agent (from the UI) \u2014 agents RUN scans which produce threat models.\n\nUse the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_actor, zivis_manage_attack_scenario, etc. Do NOT pass scan IDs or agent instance IDs to those tools.";
-export declare const LIST_THREAT_MODELS_SCHEMA: {
-    status: z.ZodOptional<z.ZodEnum<{
-        draft: "draft";
-        analyzing: "analyzing";
-        analyzed: "analyzed";
-        reviewed: "reviewed";
-        approved: "approved";
-        archived: "archived";
-    }>>;
-    limit: z.ZodDefault<z.ZodNumber>;
-};
-export declare function createListThreatModelsHandler(apiClient: ApiClient): (params: {
-    status?: string;
-    limit?: number;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-}>;

package/dist/tools/enterprise/list-threat-models.js

@@ -1,74 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const LIST_THREAT_MODELS_NAME = "zivis_list_threat_models";
-export const LIST_THREAT_MODELS_DESCRIPTION = `List all threat models for your organization. Returns name, status, summary info, and linked diagram counts for each threat model.
-
-Also fetches any diagrams linked to each threat model, so you can see which threat models have associated architecture, data flow, or trust boundary diagrams. Use zivis_get_threat_model to see full diagram details.
-
-IMPORTANT: Threat models are NOT scans and NOT agents. They are separate entities:
-- A **threat model** (returned here) has its own UUID and contains components, data flows, actors, findings, etc.
-- A **scan** is an agent execution run (from zivis_list_scans) — scans may CREATE or UPDATE threat models, but scan IDs ≠ threat model IDs.
-- An **agent instance** is a configured agent (from the UI) — agents RUN scans which produce threat models.
-
-Use the threat model ID (from this tool's response) when calling zivis_get_threat_model, zivis_manage_actor, zivis_manage_attack_scenario, etc. Do NOT pass scan IDs or agent instance IDs to those tools.`;
-export const LIST_THREAT_MODELS_SCHEMA = {
-    status: z
-        .enum(["draft", "analyzing", "analyzed", "reviewed", "approved", "archived"])
-        .optional()
-        .describe("Filter by threat model status"),
-    limit: z
-        .number()
-        .min(1)
-        .max(100)
-        .default(20)
-        .describe("Maximum number of results (1-100, default 20)"),
-};
-export function createListThreatModelsHandler(apiClient) {
-    return async (params) => {
-        try {
-            const query = new URLSearchParams();
-            if (params.status)
-                query.set("status", params.status);
-            if (params.limit)
-                query.set("limit", String(params.limit));
-            const queryStr = query.toString();
-            const path = `/api/threat-models${queryStr ? `?${queryStr}` : ""}`;
-            const data = await apiClient.get(path);
-            const sanitized = sanitizeResponse(data);
-            const threatModels = Array.isArray(sanitized) ? sanitized : [];
-            const diagramCounts = await Promise.all(threatModels.map((tm) => apiClient
-                .get(`/api/diagrams?linkedThreatModelId=${tm.id}&take=1`)
-                .then((res) => res.total ?? 0)
-                .catch(() => 0)));
-            const summary = Array.isArray(sanitized)
-                ? sanitized.map((tm, i) => ({
-                    threat_model_id: tm.id,
-                    name: tm.name,
-                    status: tm.status,
-                    description: tm.description,
-                    application: tm.applicationName || null,
-                    campaign: tm.campaignName || null,
-                    latest_version: tm.latestVersion || null,
-                    linked_diagrams_count: diagramCounts[i],
-                    created_at: tm.createdAt,
-                    updated_at: tm.updatedAt,
-                }))
-                : sanitized;
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify(summary, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to list threat models";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/manage-actor.d.ts

@@ -1,53 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const MANAGE_ACTOR_NAME = "zivis_manage_actor";
-export declare const MANAGE_ACTOR_DESCRIPTION = "Create, update, or delete a threat actor in a threat model.\n\nWhen to use (plain English): call this when the user describes who interacts with or threatens the app. Common phrasings:\n- \"users / end users / customers / our users can ...\"\n- \"admins / support team / internal employees ...\"\n- \"attacker / adversary / bad actor / malicious user ...\"\n- \"insider / rogue employee ...\"\n- \"vendor / partner / integration partner ...\"\n- \"bot / scraper / automated agent ...\"\n- \"<external service> calls our API\" (the external service is an actor too)\n\n\nThreat actors represent entities that interact with or threaten the system. Each actor has a trust level, type, and capabilities.\n\nAfter create: ask which components this actor interacts with so a data flow can be modeled.\n\nActions:\n- create: Add a new threat actor (requires name, actor_type, trust_level)\n- update: Modify an existing actor (requires actor_id)\n- delete: Remove an actor (requires actor_id)";
-export declare const MANAGE_ACTOR_SCHEMA: {
-    threat_model_id: z.ZodString;
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-    }>;
-    actor_id: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    actor_type: z.ZodOptional<z.ZodEnum<{
-        third_party: "third_party";
-        external: "external";
-        internal: "internal";
-        system: "system";
-    }>>;
-    trust_level: z.ZodOptional<z.ZodEnum<{
-        high: "high";
-        medium: "medium";
-        low: "low";
-        untrusted: "untrusted";
-        privileged: "privileged";
-    }>>;
-    description: z.ZodOptional<z.ZodString>;
-    motivation: z.ZodOptional<z.ZodString>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
-};
-export declare function createManageActorHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-    action: "create" | "update" | "delete";
-    actor_id?: string;
-    name?: string;
-    actor_type?: string;
-    trust_level?: string;
-    description?: string;
-    motivation?: string;
-    capabilities?: string[];
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/enterprise/manage-actor.js

@@ -1,105 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const MANAGE_ACTOR_NAME = "zivis_manage_actor";
-export const MANAGE_ACTOR_DESCRIPTION = `Create, update, or delete a threat actor in a threat model.
-
-When to use (plain English): call this when the user describes who interacts with or threatens the app. Common phrasings:
-- "users / end users / customers / our users can ..."
-- "admins / support team / internal employees ..."
-- "attacker / adversary / bad actor / malicious user ..."
-- "insider / rogue employee ..."
-- "vendor / partner / integration partner ..."
-- "bot / scraper / automated agent ..."
-- "<external service> calls our API" (the external service is an actor too)
-
-
-Threat actors represent entities that interact with or threaten the system. Each actor has a trust level, type, and capabilities.
-
-After create: ask which components this actor interacts with so a data flow can be modeled.
-
-Actions:
-- create: Add a new threat actor (requires name, actor_type, trust_level)
-- update: Modify an existing actor (requires actor_id)
-- delete: Remove an actor (requires actor_id)`;
-export const MANAGE_ACTOR_SCHEMA = {
-    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
-    actor_id: z.string().optional().describe("Actor UUID (required for update/delete)"),
-    name: z.string().optional().describe("Actor name (e.g., 'External Attacker', 'API Consumer')"),
-    actor_type: z
-        .enum(["external", "internal", "system", "third_party"])
-        .optional()
-        .describe("Type of threat actor"),
-    trust_level: z
-        .enum(["untrusted", "low", "medium", "high", "privileged"])
-        .optional()
-        .describe("Trust level assigned to this actor"),
-    description: z.string().optional().describe("Description of the actor's role and intent"),
-    motivation: z.string().optional().describe("Actor's motivation (e.g., financial gain, espionage)"),
-    capabilities: z.array(z.string()).optional().describe("Actor capabilities (e.g., ['network_access', 'social_engineering'])"),
-};
-export function createManageActorHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, action, actor_id } = params;
-            if ((action === "update" || action === "delete") && !actor_id) {
-                return {
-                    content: [{ type: "text", text: "Error: actor_id is required for update/delete" }],
-                    isError: true,
-                };
-            }
-            let data;
-            if (action === "create") {
-                if (!params.name || !params.actor_type || !params.trust_level) {
-                    return {
-                        content: [{ type: "text", text: "Error: name, actor_type, and trust_level are required for create" }],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/actors`, {
-                    name: params.name,
-                    actorType: params.actor_type,
-                    trustLevel: params.trust_level,
-                    description: params.description,
-                    motivation: params.motivation,
-                    capabilities: params.capabilities,
-                });
-            }
-            else if (action === "update") {
-                const body = {};
-                if (params.name)
-                    body.name = params.name;
-                if (params.actor_type)
-                    body.actorType = params.actor_type;
-                if (params.trust_level)
-                    body.trustLevel = params.trust_level;
-                if (params.description !== undefined)
-                    body.description = params.description;
-                if (params.motivation !== undefined)
-                    body.motivation = params.motivation;
-                if (params.capabilities)
-                    body.capabilities = params.capabilities;
-                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/actors/${actor_id}`, body);
-            }
-            else {
-                data = await apiClient.del(`/api/threat-models/${threat_model_id}/actors/${actor_id}`);
-            }
-            const sanitized = sanitizeResponse(data);
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify(sanitized, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage actor";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/manage-attack-scenario.d.ts

@@ -1,65 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const MANAGE_ATTACK_SCENARIO_NAME = "zivis_manage_attack_scenario";
-export declare const MANAGE_ATTACK_SCENARIO_DESCRIPTION = "Create, update, or delete an attack scenario in a threat model.\n\nWhen to use (plain English): call this when the user describes a security worry, \"what if\" question, or specific failure mode. Common phrasings:\n- \"what if <bad thing happens>\"\n- \"could someone <attack action>\"\n- \"I'm worried about <X> being abused / leaked / hacked\"\n- \"how would an attacker <do X>\"\n- \"is <Y> safe from <Z>\"\n- mentions of: prompt injection, jailbreak, data exfiltration, privilege escalation, account takeover, supply chain, abuse\n\nBefore creating a scenario, the threat model needs at least one entry_point component (where the attack starts) and a target component (where the attacker wants to go). If either is missing, model components first.\n\nThe narrative should be a 2\u20135 sentence story: who attacks, where they enter, what they exploit, what they achieve. Don't write a textbook chapter.\n\n\nActions:\n- create: Add a new scenario (requires title, narrative, entry_point_id, target_id)\n- update: Update scenario status/notes (requires scenario_id)\n- delete: Remove a scenario (requires scenario_id)";
-export declare const MANAGE_ATTACK_SCENARIO_SCHEMA: {
-    threat_model_id: z.ZodString;
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-    }>;
-    scenario_id: z.ZodOptional<z.ZodString>;
-    title: z.ZodOptional<z.ZodString>;
-    narrative: z.ZodOptional<z.ZodString>;
-    entry_point_id: z.ZodOptional<z.ZodString>;
-    target_id: z.ZodOptional<z.ZodString>;
-    severity: z.ZodOptional<z.ZodEnum<{
-        critical: "critical";
-        high: "high";
-        medium: "medium";
-        low: "low";
-        info: "info";
-    }>>;
-    likelihood: z.ZodOptional<z.ZodEnum<{
-        almost_certain: "almost_certain";
-        likely: "likely";
-        possible: "possible";
-        unlikely: "unlikely";
-    }>>;
-    actor_id: z.ZodOptional<z.ZodString>;
-    goal_category: z.ZodOptional<z.ZodString>;
-    goal_description: z.ZodOptional<z.ZodString>;
-    business_impact: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodString>;
-    user_notes: z.ZodOptional<z.ZodString>;
-};
-export declare function createManageAttackScenarioHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-    action: "create" | "update" | "delete";
-    scenario_id?: string;
-    title?: string;
-    narrative?: string;
-    entry_point_id?: string;
-    target_id?: string;
-    severity?: string;
-    likelihood?: string;
-    actor_id?: string;
-    goal_category?: string;
-    goal_description?: string;
-    business_impact?: string;
-    status?: string;
-    user_notes?: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/enterprise/manage-attack-scenario.js

@@ -1,94 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const MANAGE_ATTACK_SCENARIO_NAME = "zivis_manage_attack_scenario";
-export const MANAGE_ATTACK_SCENARIO_DESCRIPTION = `Create, update, or delete an attack scenario in a threat model.
-
-When to use (plain English): call this when the user describes a security worry, "what if" question, or specific failure mode. Common phrasings:
-- "what if <bad thing happens>"
-- "could someone <attack action>"
-- "I'm worried about <X> being abused / leaked / hacked"
-- "how would an attacker <do X>"
-- "is <Y> safe from <Z>"
-- mentions of: prompt injection, jailbreak, data exfiltration, privilege escalation, account takeover, supply chain, abuse
-
-Before creating a scenario, the threat model needs at least one entry_point component (where the attack starts) and a target component (where the attacker wants to go). If either is missing, model components first.
-
-The narrative should be a 2–5 sentence story: who attacks, where they enter, what they exploit, what they achieve. Don't write a textbook chapter.
-
-
-Actions:
-- create: Add a new scenario (requires title, narrative, entry_point_id, target_id)
-- update: Update scenario status/notes (requires scenario_id)
-- delete: Remove a scenario (requires scenario_id)`;
-export const MANAGE_ATTACK_SCENARIO_SCHEMA = {
-    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
-    scenario_id: z.string().optional().describe("Scenario UUID (required for update/delete)"),
-    title: z.string().optional().describe("Scenario title (e.g., 'Privilege Escalation via API') — required for create"),
-    narrative: z.string().optional().describe("Detailed narrative of the attack path (markdown supported) — required for create"),
-    entry_point_id: z.string().optional().describe("Entry point component UUID — required for create"),
-    target_id: z.string().optional().describe("Target component UUID — required for create"),
-    severity: z.enum(["critical", "high", "medium", "low", "info"]).optional().describe("Severity of this scenario (for create)"),
-    likelihood: z.enum(["almost_certain", "likely", "possible", "unlikely"]).optional().describe("Likelihood of this scenario being exploited (for create)"),
-    actor_id: z.string().optional().describe("Threat actor UUID who would execute this scenario (for create)"),
-    goal_category: z.string().optional().describe("Terminal goal category (for create)"),
-    goal_description: z.string().optional().describe("Description of the attacker's goal (for create)"),
-    business_impact: z.string().optional().describe("Business impact if the attack succeeds (for create)"),
-    status: z.string().optional().describe("Scenario status (for update)"),
-    user_notes: z.string().optional().describe("Review notes (for update)"),
-};
-export function createManageAttackScenarioHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, action, scenario_id } = params;
-            if ((action === "update" || action === "delete") && !scenario_id) {
-                return {
-                    content: [{ type: "text", text: "Error: scenario_id is required for update/delete" }],
-                    isError: true,
-                };
-            }
-            let data;
-            if (action === "create") {
-                if (!params.title || !params.narrative || !params.entry_point_id || !params.target_id) {
-                    return {
-                        content: [{ type: "text", text: "Error: title, narrative, entry_point_id, and target_id are required for create" }],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/attack-scenarios`, {
-                    title: params.title,
-                    narrative: params.narrative,
-                    entryPointId: params.entry_point_id,
-                    targetId: params.target_id,
-                    severity: params.severity,
-                    likelihood: params.likelihood,
-                    actorId: params.actor_id,
-                    goalCategory: params.goal_category,
-                    goalDescription: params.goal_description,
-                    businessImpact: params.business_impact,
-                });
-            }
-            else if (action === "update") {
-                const body = {};
-                if (params.status !== undefined)
-                    body.status = params.status;
-                if (params.user_notes !== undefined)
-                    body.userNotes = params.user_notes;
-                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/attack-scenarios/${scenario_id}`, body);
-            }
-            else {
-                data = await apiClient.del(`/api/threat-models/${threat_model_id}/attack-scenarios/${scenario_id}`);
-            }
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage attack scenario";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/manage-data-asset.d.ts

@@ -1,48 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const MANAGE_DATA_ASSET_NAME = "zivis_manage_data_asset";
-export declare const MANAGE_DATA_ASSET_DESCRIPTION = "Create, update, or delete a data asset in a threat model.\n\nWhen to use (plain English): call this when the user names something the app stores or processes. Common phrasings:\n- \"we store <PII / credit card / passwords / session tokens / api keys / audit logs>\"\n- \"the <user / customer / patient> data is in <storage>\"\n- \"we keep <emails / phone numbers / SSN / addresses>\"\n- \"<asset> is encrypted at rest\" \u2014 model the asset, then a security control on top of it\n- \"we hold cardholder data\" / \"we handle payment cards\" \u2192 classification=restricted, data_type=payment_data\n\nPick classification:\n- public \u2014 anyone can see (marketing copy)\n- internal \u2014 employees only (org chart, internal docs)\n- confidential \u2014 PII, business confidential\n- restricted \u2014 payment data, health records, anything regulated\n- critical \u2014 credentials, secrets, root keys, anything an attacker would target first\n\n\nAfter create: ask which components store, process, or transmit this asset so coverage can be linked. If the asset is sensitive (confidential or higher) and no security control covers it, surface that gap.\n\nActions:\n- create: Add a new data asset (requires name, classification)\n- update: Modify an existing data asset (requires asset_id)\n- delete: Remove a data asset (requires asset_id)";
-export declare const MANAGE_DATA_ASSET_SCHEMA: {
-    threat_model_id: z.ZodString;
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-    }>;
-    asset_id: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    classification: z.ZodOptional<z.ZodEnum<{
-        critical: "critical";
-        public: "public";
-        internal: "internal";
-        confidential: "confidential";
-        restricted: "restricted";
-    }>>;
-    description: z.ZodOptional<z.ZodString>;
-    data_type: z.ZodOptional<z.ZodString>;
-    storage_location: z.ZodOptional<z.ZodString>;
-    retention_policy: z.ZodOptional<z.ZodString>;
-};
-export declare function createManageDataAssetHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-    action: "create" | "update" | "delete";
-    asset_id?: string;
-    name?: string;
-    classification?: string;
-    description?: string;
-    data_type?: string;
-    storage_location?: string;
-    retention_policy?: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/enterprise/manage-data-asset.js

@@ -1,99 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const MANAGE_DATA_ASSET_NAME = "zivis_manage_data_asset";
-export const MANAGE_DATA_ASSET_DESCRIPTION = `Create, update, or delete a data asset in a threat model.
-
-When to use (plain English): call this when the user names something the app stores or processes. Common phrasings:
-- "we store <PII / credit card / passwords / session tokens / api keys / audit logs>"
-- "the <user / customer / patient> data is in <storage>"
-- "we keep <emails / phone numbers / SSN / addresses>"
-- "<asset> is encrypted at rest" — model the asset, then a security control on top of it
-- "we hold cardholder data" / "we handle payment cards" → classification=restricted, data_type=payment_data
-
-Pick classification:
-- public — anyone can see (marketing copy)
-- internal — employees only (org chart, internal docs)
-- confidential — PII, business confidential
-- restricted — payment data, health records, anything regulated
-- critical — credentials, secrets, root keys, anything an attacker would target first
-
-
-After create: ask which components store, process, or transmit this asset so coverage can be linked. If the asset is sensitive (confidential or higher) and no security control covers it, surface that gap.
-
-Actions:
-- create: Add a new data asset (requires name, classification)
-- update: Modify an existing data asset (requires asset_id)
-- delete: Remove a data asset (requires asset_id)`;
-export const MANAGE_DATA_ASSET_SCHEMA = {
-    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
-    asset_id: z.string().optional().describe("Asset UUID (required for update/delete)"),
-    name: z.string().optional().describe("Asset name (e.g., 'User PII', 'API Keys')"),
-    classification: z
-        .enum(["public", "internal", "confidential", "restricted", "critical"])
-        .optional()
-        .describe("Data classification level"),
-    description: z.string().optional().describe("Description of the data asset"),
-    data_type: z.string().optional().describe("Type of data (e.g., 'credentials', 'pii', 'financial')"),
-    storage_location: z.string().optional().describe("Where this data is stored"),
-    retention_policy: z.string().optional().describe("Data retention policy"),
-};
-export function createManageDataAssetHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, action, asset_id } = params;
-            if ((action === "update" || action === "delete") && !asset_id) {
-                return {
-                    content: [{ type: "text", text: "Error: asset_id is required for update/delete" }],
-                    isError: true,
-                };
-            }
-            let data;
-            if (action === "create") {
-                if (!params.name || !params.classification) {
-                    return {
-                        content: [{ type: "text", text: "Error: name and classification are required for create" }],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/data-assets`, {
-                    name: params.name,
-                    classification: params.classification,
-                    description: params.description,
-                    dataType: params.data_type,
-                    storageLocation: params.storage_location,
-                    retentionPolicy: params.retention_policy,
-                });
-            }
-            else if (action === "update") {
-                const body = {};
-                if (params.name)
-                    body.name = params.name;
-                if (params.classification)
-                    body.classification = params.classification;
-                if (params.description !== undefined)
-                    body.description = params.description;
-                if (params.data_type)
-                    body.dataType = params.data_type;
-                if (params.storage_location !== undefined)
-                    body.storageLocation = params.storage_location;
-                if (params.retention_policy !== undefined)
-                    body.retentionPolicy = params.retention_policy;
-                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/data-assets/${asset_id}`, body);
-            }
-            else {
-                data = await apiClient.del(`/api/threat-models/${threat_model_id}/data-assets/${asset_id}`);
-            }
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage data asset";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/enterprise/manage-security-control.d.ts

@@ -1,54 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../../api-client.js";
-export declare const MANAGE_SECURITY_CONTROL_NAME = "zivis_manage_security_control";
-export declare const MANAGE_SECURITY_CONTROL_DESCRIPTION = "Create, update, or delete a security control in a threat model.\n\nWhen to use (plain English): call this when the user mentions a protective mechanism that's in place (or planned). Common phrasings:\n- \"we have <rate limiting / WAF / firewall / MFA / 2FA / encryption>\"\n- \"we sanitize / validate <inputs>\"\n- \"we encrypt <X> at rest / in transit\"\n- \"we audit log all <Y>\"\n- \"<Z> is behind auth / behind a VPN\"\n- \"we use TLS for everything\"\n\nPick control_type:\n- preventive \u2014 stops the threat before it happens (input validation, rate limiting, encryption, MFA)\n- detective \u2014 notices when something bad happens (audit logging, monitoring, alerts, anomaly detection)\n- responsive \u2014 reacts to a known incident (auto-block, key rotation, account lockout)\n\nSet component_id when the control applies to one specific component. Leave it blank for org-wide controls (e.g., \"we use a WAF in front of everything\").\n\n\nAfter create: if a sensitive data asset (PII / payment / credentials) exists with no controls covering it, that's a high-priority gap \u2014 flag it.\n\nActions:\n- create: Add a new control (requires name, control_type)\n- update: Modify an existing control (requires control_id)\n- delete: Remove a control (requires control_id)";
-export declare const MANAGE_SECURITY_CONTROL_SCHEMA: {
-    threat_model_id: z.ZodString;
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-    }>;
-    control_id: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    control_type: z.ZodOptional<z.ZodEnum<{
-        preventive: "preventive";
-        detective: "detective";
-        responsive: "responsive";
-    }>>;
-    description: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodEnum<{
-        not_implemented: "not_implemented";
-        partial: "partial";
-        implemented: "implemented";
-    }>>;
-    effectiveness_rating: z.ZodOptional<z.ZodEnum<{
-        high: "high";
-        medium: "medium";
-        low: "low";
-    }>>;
-    component_id: z.ZodOptional<z.ZodString>;
-};
-export declare function createManageSecurityControlHandler(apiClient: ApiClient): (params: {
-    threat_model_id: string;
-    action: "create" | "update" | "delete";
-    control_id?: string;
-    name?: string;
-    control_type?: string;
-    description?: string;
-    status?: string;
-    effectiveness_rating?: string;
-    component_id?: string;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/enterprise/manage-security-control.js

@@ -1,106 +0,0 @@
-import { z } from "zod";
-import { sanitizeResponse } from "../../sanitize.js";
-export const MANAGE_SECURITY_CONTROL_NAME = "zivis_manage_security_control";
-export const MANAGE_SECURITY_CONTROL_DESCRIPTION = `Create, update, or delete a security control in a threat model.
-
-When to use (plain English): call this when the user mentions a protective mechanism that's in place (or planned). Common phrasings:
-- "we have <rate limiting / WAF / firewall / MFA / 2FA / encryption>"
-- "we sanitize / validate <inputs>"
-- "we encrypt <X> at rest / in transit"
-- "we audit log all <Y>"
-- "<Z> is behind auth / behind a VPN"
-- "we use TLS for everything"
-
-Pick control_type:
-- preventive — stops the threat before it happens (input validation, rate limiting, encryption, MFA)
-- detective — notices when something bad happens (audit logging, monitoring, alerts, anomaly detection)
-- responsive — reacts to a known incident (auto-block, key rotation, account lockout)
-
-Set component_id when the control applies to one specific component. Leave it blank for org-wide controls (e.g., "we use a WAF in front of everything").
-
-
-After create: if a sensitive data asset (PII / payment / credentials) exists with no controls covering it, that's a high-priority gap — flag it.
-
-Actions:
-- create: Add a new control (requires name, control_type)
-- update: Modify an existing control (requires control_id)
-- delete: Remove a control (requires control_id)`;
-export const MANAGE_SECURITY_CONTROL_SCHEMA = {
-    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
-    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
-    control_id: z.string().optional().describe("Control UUID (required for update/delete)"),
-    name: z.string().optional().describe("Control name (e.g., 'Input Validation', 'Rate Limiting')"),
-    control_type: z
-        .enum(["preventive", "detective", "responsive"])
-        .optional()
-        .describe("Type of security control"),
-    description: z.string().optional().describe("Description of how the control works"),
-    status: z
-        .enum(["not_implemented", "partial", "implemented"])
-        .optional()
-        .describe("Current implementation status"),
-    effectiveness_rating: z
-        .enum(["high", "medium", "low"])
-        .optional()
-        .describe("Estimated effectiveness of the control"),
-    component_id: z.string().optional().describe("Component UUID this control applies to"),
-};
-export function createManageSecurityControlHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { threat_model_id, action, control_id } = params;
-            if ((action === "update" || action === "delete") && !control_id) {
-                return {
-                    content: [{ type: "text", text: "Error: control_id is required for update/delete" }],
-                    isError: true,
-                };
-            }
-            let data;
-            if (action === "create") {
-                if (!params.name || !params.control_type) {
-                    return {
-                        content: [{ type: "text", text: "Error: name and control_type are required for create" }],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post(`/api/threat-models/${threat_model_id}/security-controls`, {
-                    name: params.name,
-                    controlType: params.control_type,
-                    description: params.description,
-                    status: params.status,
-                    effectivenessRating: params.effectiveness_rating,
-                    componentId: params.component_id,
-                });
-            }
-            else if (action === "update") {
-                const body = {};
-                if (params.name)
-                    body.name = params.name;
-                if (params.control_type)
-                    body.controlType = params.control_type;
-                if (params.description !== undefined)
-                    body.description = params.description;
-                if (params.status)
-                    body.status = params.status;
-                if (params.effectiveness_rating)
-                    body.effectivenessRating = params.effectiveness_rating;
-                if (params.component_id)
-                    body.componentId = params.component_id;
-                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/security-controls/${control_id}`, body);
-            }
-            else {
-                data = await apiClient.del(`/api/threat-models/${threat_model_id}/security-controls/${control_id}`);
-            }
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage security control";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}