@zivis/mcp 0.1.8 → 0.1.10

package/dist/server.js

@@ -1,226 +1,152 @@
-/**
- * MCP Server
- *
- * Sets up the Model Context Protocol server using the official SDK
- * with stdio transport. Registers all ZIVIS security tools.
- *
- * IMPORTANT: This server communicates over stdout (JSON-RPC 2.0).
- * Never use console.log() — use console.error() for all logging.
- */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ApiClient } from "./api-client.js";
 import { resolveAuth } from "./auth/index.js";
-import { decodeJwtPayload } from "./auth/jwt.js";
-import { loadTokens } from "./auth/token-refresh.js";
-import { detectProjectBinding, validateProjectBinding } from "./project-binding.js";
+import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, validateProjectBinding, } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
-/**
- * Validate that the stored JWT's org matches the project binding's expected org.
- * This prevents cross-org data leaks when a user is a member of multiple orgs.
- *
- * The JWT org_id is the WorkOS org ID. The project binding stores both the
- * Zivis org UUID (orgId) and the WorkOS org ID (workosOrgId).
- */
-async function validateJwtOrgBinding(binding, config) {
+async function validateApiKeyMatchesBinding(binding, config) {
     if (!binding.workosOrgId) {
-        // No WorkOS org ID in binding — can't validate. Log warning but don't block.
-        console.error("[zivis] WARNING: Project binding has no workosOrgId — cannot verify JWT org scope.");
+        console.error("[zivis] WARNING: Project binding has no workosOrgId — cannot verify API key org scope.");
         console.error("[zivis] Run: zivis auth init --session <session> --org-id <zivis-uuid> --workos-org-id <workos-org-id>");
         return;
     }
-    const tokens = await loadTokens(config.session);
-    if (!tokens)
-        return; // No tokens stored yet — will fail at session check
-    const payload = decodeJwtPayload(tokens.access_token);
-    if (!payload) {
-        console.error("[zivis] WARNING: Could not decode JWT — cannot verify org scope");
+    const creds = await resolveAuth(config, "apikey");
+    if (creds.method !== "apikey" || !creds.apiKey) {
+        console.error("[zivis] INTERNAL: org verification skipped — no API key (session gate should have prevented this)");
         return;
     }
-    const jwtOrgId = payload.org_id;
-    if (!jwtOrgId) {
-        console.error("[zivis] WARNING: JWT has no org_id claim — cannot verify org scope");
+    let response;
+    try {
+        response = await fetch(`${config.apiBaseUrl}/api/mcp/session`, {
+            headers: {
+                "X-API-Key": creds.apiKey,
+                "User-Agent": "@zivis/mcp",
+            },
+        });
+    }
+    catch (err) {
+        console.error(`[zivis] WARNING: Could not reach API to verify org (${err instanceof Error ? err.message : err})`);
+        return;
+    }
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        console.error(`[zivis] WARNING: API key org probe failed (${response.status}): ${body.slice(0, 200)}`);
         return;
     }
-    if (jwtOrgId !== binding.workosOrgId) {
+    const payload = (await response.json());
+    const resolved = payload.org?.workosOrgId;
+    if (resolved !== binding.workosOrgId) {
         const orgLabel = binding.orgName ? ` (${binding.orgName})` : "";
-        console.error("[zivis] SECURITY ERROR: JWT org does not match project binding!");
-        console.error(`[zivis]   JWT org_id:      ${jwtOrgId}`);
-        console.error(`[zivis]   Expected org_id: ${binding.workosOrgId}${orgLabel}`);
+        console.error("[zivis] SECURITY ERROR: API key org does not match project binding!");
+        console.error(`[zivis]   API resolved WorkOS org: ${resolved ?? "missing"}`);
+        console.error(`[zivis]   Binding expects org:      ${binding.workosOrgId}${orgLabel}`);
         console.error("");
         console.error("[zivis] This prevents cross-org data leaks.");
-        console.error(`[zivis] Fix: Re-login for this project's org:`);
-        console.error(`[zivis]   zivis auth login --session ${config.session || "default"}`);
+        console.error(`[zivis] Mint a binding token for this repo's org:`);
+        console.error(`[zivis]   zivis auth bind`);
         process.exit(1);
     }
-    console.error(`[zivis] JWT org verified: ${jwtOrgId}${binding.orgName ? ` (${binding.orgName})` : ""}`);
+    console.error(`[zivis] API key org verified: ${resolved}${binding.orgName ? ` (${binding.orgName})` : ""}`);
 }
-// Tools — Findings
-import { GET_FINDINGS_NAME, GET_FINDINGS_DESCRIPTION, GET_FINDINGS_SCHEMA, createGetFindingsHandler, } from "./tools/get-findings.js";
-import { GET_FINDING_DETAILS_NAME, GET_FINDING_DETAILS_DESCRIPTION, GET_FINDING_DETAILS_SCHEMA, createGetFindingDetailsHandler, } from "./tools/get-finding-details.js";
-import { TRIAGE_FINDING_NAME, TRIAGE_FINDING_DESCRIPTION, TRIAGE_FINDING_SCHEMA, createTriageFindingHandler, } from "./tools/triage-finding.js";
-// Tools — Scans & Artifacts
-import { LIST_SCANS_NAME, LIST_SCANS_DESCRIPTION, LIST_SCANS_SCHEMA, createListScansHandler, } from "./tools/list-scans.js";
-import { LIST_RECON_SCANS_NAME, LIST_RECON_SCANS_DESCRIPTION, LIST_RECON_SCANS_SCHEMA, createListReconScansHandler, } from "./tools/list-recon-scans.js";
-import { GET_RECON_SCAN_NAME, GET_RECON_SCAN_DESCRIPTION, GET_RECON_SCAN_SCHEMA, createGetReconScanHandler, } from "./tools/get-recon-scan.js";
-import { GET_SCAN_OUTPUT_NAME, GET_SCAN_OUTPUT_DESCRIPTION, GET_SCAN_OUTPUT_SCHEMA, createGetScanOutputHandler, } from "./tools/get-scan-output.js";
-import { GET_TEST_CASE_RESULTS_NAME, GET_TEST_CASE_RESULTS_DESCRIPTION, GET_TEST_CASE_RESULTS_SCHEMA, createGetTestCaseResultsHandler, } from "./tools/get-test-case-results.js";
-import { GET_AGENT_TEST_RESULTS_NAME, GET_AGENT_TEST_RESULTS_DESCRIPTION, GET_AGENT_TEST_RESULTS_SCHEMA, createGetAgentTestResultsHandler, } from "./tools/get-agent-test-results.js";
-import { LIST_SCAN_ARTIFACTS_NAME, LIST_SCAN_ARTIFACTS_DESCRIPTION, LIST_SCAN_ARTIFACTS_SCHEMA, createListScanArtifactsHandler, } from "./tools/list-scan-artifacts.js";
-import { GET_ARTIFACT_CONTENT_NAME, GET_ARTIFACT_CONTENT_DESCRIPTION, GET_ARTIFACT_CONTENT_SCHEMA, createGetArtifactContentHandler, } from "./tools/get-artifact-content.js";
-// Tools — PR Safety
-import { SCAN_PR_NAME, SCAN_PR_DESCRIPTION, SCAN_PR_SCHEMA, createScanPrHandler, } from "./tools/scan-pr.js";
-// Tools — OSS Trust
+import { registerAllPrompts } from "./prompts/index.js";
+import { GET_STARTED_NAME, GET_STARTED_DESCRIPTION, GET_STARTED_SCHEMA, createGetStartedHandler, } from "./tools/get-started.js";
+import { INSPECT_NAME, INSPECT_DESCRIPTION, INSPECT_SCHEMA, createInspectHandler, } from "./tools/inspect.js";
+import { THREAT_LIST_RELEVANT_CAPSULES_NAME, THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION, THREAT_LIST_RELEVANT_CAPSULES_SCHEMA, createThreatListRelevantCapsulesHandler, } from "./tools/threat-list-relevant-capsules.js";
+import { THREAT_GET_CAPSULE_NAME, THREAT_GET_CAPSULE_DESCRIPTION, THREAT_GET_CAPSULE_SCHEMA, createThreatGetCapsuleHandler, } from "./tools/threat-get-capsule.js";
+import { THREAT_GET_INFERENCE_PROMPT_NAME, THREAT_GET_INFERENCE_PROMPT_DESCRIPTION, THREAT_GET_INFERENCE_PROMPT_SCHEMA, createThreatGetInferencePromptHandler, } from "./tools/threat-get-inference-prompt.js";
+import { THREAT_RUN_MATCHER_NAME, THREAT_RUN_MATCHER_DESCRIPTION, THREAT_RUN_MATCHER_SCHEMA, createThreatRunMatcherHandler, } from "./tools/threat-run-matcher.js";
 import { CHECK_REPO_TRUST_NAME, CHECK_REPO_TRUST_DESCRIPTION, CHECK_REPO_TRUST_SCHEMA, createCheckRepoTrustHandler, } from "./tools/check-repo-trust.js";
-// Tools — ZAT & Trust Verification (public)
 import { GET_OSS_ZAT_NAME, GET_OSS_ZAT_DESCRIPTION, GET_OSS_ZAT_SCHEMA, createGetOssZatHandler, } from "./tools/get-oss-zat.js";
 import { VERIFY_TRUST_MARK_NAME, VERIFY_TRUST_MARK_DESCRIPTION, VERIFY_TRUST_MARK_SCHEMA, createVerifyTrustMarkHandler, } from "./tools/verify-trust-mark.js";
 import { GET_TRUST_KEYS_NAME, GET_TRUST_KEYS_DESCRIPTION, GET_TRUST_KEYS_SCHEMA, createGetTrustKeysHandler, } from "./tools/get-trust-keys.js";
 import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createInspectZatHandler, } from "./tools/inspect-zat.js";
-// Tools — Red Team Setup
-import { SETUP_RED_TEAM_TARGET_NAME, SETUP_RED_TEAM_TARGET_DESCRIPTION, SETUP_RED_TEAM_TARGET_SCHEMA, createSetupRedTeamTargetHandler, } from "./tools/setup-red-team-target.js";
-// Tools — Application & Endpoint Management
 import { LIST_APPLICATIONS_NAME, LIST_APPLICATIONS_DESCRIPTION, LIST_APPLICATIONS_SCHEMA, createListApplicationsHandler, } from "./tools/list-applications.js";
 import { GET_APPLICATION_NAME, GET_APPLICATION_DESCRIPTION, GET_APPLICATION_SCHEMA, createGetApplicationHandler, } from "./tools/get-application.js";
 import { GET_APPLICATION_OVERVIEW_NAME, GET_APPLICATION_OVERVIEW_DESCRIPTION, GET_APPLICATION_OVERVIEW_SCHEMA, createGetApplicationOverviewHandler, } from "./tools/get-application-overview.js";
+import { REVIEW_CHANGE_NAME, REVIEW_CHANGE_DESCRIPTION, REVIEW_CHANGE_SCHEMA, createReviewChangeHandler, } from "./tools/review-change.js";
+import { EXPLAIN_SIGNAL_FOR_DIFF_NAME, EXPLAIN_SIGNAL_FOR_DIFF_DESCRIPTION, EXPLAIN_SIGNAL_FOR_DIFF_SCHEMA, createExplainSignalForDiffHandler, } from "./tools/explain-signal-for-diff.js";
+import { LIST_SIGNALS_NAME, LIST_SIGNALS_DESCRIPTION, LIST_SIGNALS_SCHEMA, createListSignalsHandler, } from "./tools/list-signals.js";
+import { GET_SIGNAL_NAME, GET_SIGNAL_DESCRIPTION, GET_SIGNAL_SCHEMA, createGetSignalHandler, } from "./tools/get-signal.js";
 import { LIST_ENDPOINTS_NAME, LIST_ENDPOINTS_DESCRIPTION, LIST_ENDPOINTS_SCHEMA, createListEndpointsHandler, } from "./tools/list-endpoints.js";
 import { IMPORT_OPENAPI_ENDPOINTS_NAME, IMPORT_OPENAPI_ENDPOINTS_DESCRIPTION, IMPORT_OPENAPI_ENDPOINTS_SCHEMA, createImportOpenApiEndpointsHandler, } from "./tools/import-openapi-endpoints.js";
 import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHEMA, createUpdateEndpointHandler, } from "./tools/update-endpoint.js";
-// Tools — Local Scan
-import { LOCAL_SCAN_NAME, LOCAL_SCAN_DESCRIPTION, LOCAL_SCAN_SCHEMA, createLocalScanHandler, } from "./tools/local-scan.js";
-// Tools — Local Infrastructure Discovery
+import { MANAGE_APPLICATION_NAME, MANAGE_APPLICATION_DESCRIPTION, MANAGE_APPLICATION_SCHEMA, createManageApplicationHandler, } from "./tools/manage-application.js";
+import { MANAGE_ENDPOINT_LIFECYCLE_NAME, MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION, MANAGE_ENDPOINT_LIFECYCLE_SCHEMA, createManageEndpointLifecycleHandler, } from "./tools/manage-endpoint-lifecycle.js";
 import { DISCOVER_LOCAL_INFRA_NAME, DISCOVER_LOCAL_INFRA_DESCRIPTION, DISCOVER_LOCAL_INFRA_SCHEMA, createDiscoverLocalInfraHandler, } from "./tools/discover-local-infra.js";
-// Tools — Diagram Generation
 import { GENERATE_DIAGRAM_NAME, GENERATE_DIAGRAM_DESCRIPTION, GENERATE_DIAGRAM_SCHEMA, createGenerateDiagramHandler, } from "./tools/generate-diagram.js";
-// Tools — Diagram CRUD
 import { LIST_DIAGRAMS_NAME, LIST_DIAGRAMS_DESCRIPTION, LIST_DIAGRAMS_SCHEMA, createListDiagramsHandler, } from "./tools/list-diagrams.js";
 import { GET_DIAGRAM_NAME, GET_DIAGRAM_DESCRIPTION, GET_DIAGRAM_SCHEMA, createGetDiagramHandler, } from "./tools/get-diagram.js";
 import { CREATE_DIAGRAM_NAME, CREATE_DIAGRAM_DESCRIPTION, CREATE_DIAGRAM_SCHEMA, createCreateDiagramHandler, } from "./tools/create-diagram.js";
 import { MANAGE_DIAGRAM_NAME, MANAGE_DIAGRAM_DESCRIPTION, MANAGE_DIAGRAM_SCHEMA, createManageDiagramHandler, } from "./tools/manage-diagram.js";
 import { UPDATE_MERMAID_SOURCE_NAME, UPDATE_MERMAID_SOURCE_DESCRIPTION, UPDATE_MERMAID_SOURCE_SCHEMA, createUpdateMermaidSourceHandler, } from "./tools/update-mermaid-source.js";
 import { LIST_DOCUMENTS_NAME, LIST_DOCUMENTS_DESCRIPTION, LIST_DOCUMENTS_SCHEMA, createListDocumentsHandler, } from "./tools/list-documents.js";
+import { CREATE_ARTIFACT_NAME, CREATE_ARTIFACT_DESCRIPTION, CREATE_ARTIFACT_SCHEMA, createCreateArtifactHandler, GET_ARTIFACT_NAME, GET_ARTIFACT_DESCRIPTION, GET_ARTIFACT_SCHEMA, createGetArtifactHandler, UPDATE_ARTIFACT_CONTENT_NAME, UPDATE_ARTIFACT_CONTENT_DESCRIPTION, UPDATE_ARTIFACT_CONTENT_SCHEMA, createUpdateArtifactContentHandler, LIST_ARTIFACT_VERSIONS_NAME, LIST_ARTIFACT_VERSIONS_DESCRIPTION, LIST_ARTIFACT_VERSIONS_SCHEMA, createListArtifactVersionsHandler, } from "./tools/artifacts.js";
+import { MEMORY_PRIOR_FINDINGS_NAME, MEMORY_PRIOR_FINDINGS_DESCRIPTION, MEMORY_PRIOR_FINDINGS_SCHEMA, createMemoryPriorFindingsHandler, MEMORY_RETEST_CANDIDATES_NAME, MEMORY_RETEST_CANDIDATES_DESCRIPTION, MEMORY_RETEST_CANDIDATES_SCHEMA, createMemoryRetestCandidatesHandler, MEMORY_THREAT_MODEL_SECTION_NAME, MEMORY_THREAT_MODEL_SECTION_DESCRIPTION, MEMORY_THREAT_MODEL_SECTION_SCHEMA, createMemoryThreatModelSectionHandler, MEMORY_COVERAGE_NAME, MEMORY_COVERAGE_DESCRIPTION, MEMORY_COVERAGE_SCHEMA, createMemoryCoverageHandler, } from "./tools/security-memory.js";
+import { RUN_START_NAME, RUN_START_DESCRIPTION, RUN_START_SCHEMA, createRunStartHandler, RUN_REPORT_NAME, RUN_REPORT_DESCRIPTION, RUN_REPORT_SCHEMA, createRunReportHandler, RUN_COMPLETE_NAME, RUN_COMPLETE_DESCRIPTION, RUN_COMPLETE_SCHEMA, createRunCompleteHandler, RUN_CANCEL_NAME, RUN_CANCEL_DESCRIPTION, RUN_CANCEL_SCHEMA, createRunCancelHandler, } from "./tools/devx-run.js";
 import { GET_DOCUMENT_NAME, GET_DOCUMENT_DESCRIPTION, GET_DOCUMENT_SCHEMA, createGetDocumentHandler, } from "./tools/get-document.js";
 import { CREATE_DOCUMENT_NAME, CREATE_DOCUMENT_DESCRIPTION, CREATE_DOCUMENT_SCHEMA, createCreateDocumentHandler, } from "./tools/create-document.js";
+import { CREATE_FINDING_NAME, CREATE_FINDING_DESCRIPTION, CREATE_FINDING_SCHEMA, createCreateFindingHandler, } from "./tools/create-finding.js";
+import { UPDATE_FINDING_NAME, UPDATE_FINDING_DESCRIPTION, UPDATE_FINDING_SCHEMA, createUpdateFindingHandler, } from "./tools/update-finding.js";
+import { DELETE_FINDING_NAME, DELETE_FINDING_DESCRIPTION, DELETE_FINDING_SCHEMA, createDeleteFindingHandler, } from "./tools/delete-finding.js";
 import { UPDATE_DOCUMENT_NAME, UPDATE_DOCUMENT_DESCRIPTION, UPDATE_DOCUMENT_SCHEMA, createUpdateDocumentHandler, } from "./tools/update-document.js";
-// Tools — Security Review (composite intelligence)
 import { SECURITY_REVIEW_NAME, SECURITY_REVIEW_DESCRIPTION, SECURITY_REVIEW_SCHEMA, createSecurityReviewHandler, } from "./tools/security-review.js";
-// Tools — Project Binding
 import { CHECK_PROJECT_NAME, CHECK_PROJECT_DESCRIPTION, CHECK_PROJECT_SCHEMA, createCheckProjectHandler, } from "./tools/check-project.js";
-// Tools — Test Library (IP-protected: metadata only, no prompts/patterns)
-import { LIST_TEST_LIBRARY_NAME, LIST_TEST_LIBRARY_DESCRIPTION, LIST_TEST_LIBRARY_SCHEMA, createListTestLibraryHandler, } from "./tools/list-test-library.js";
-import { GET_TEST_DETAILS_NAME, GET_TEST_DETAILS_DESCRIPTION, GET_TEST_DETAILS_SCHEMA, createGetTestDetailsHandler, } from "./tools/get-test-details.js";
-import { LIST_TEST_SCENARIOS_NAME, LIST_TEST_SCENARIOS_DESCRIPTION, LIST_TEST_SCENARIOS_SCHEMA, createListTestScenariosHandler, } from "./tools/list-test-scenarios.js";
-import { GET_SCENARIO_DETAILS_NAME, GET_SCENARIO_DETAILS_DESCRIPTION, GET_SCENARIO_DETAILS_SCHEMA, createGetScenarioDetailsHandler, } from "./tools/get-scenario-details.js";
-import { LIST_AGENT_TEST_CASES_NAME, LIST_AGENT_TEST_CASES_DESCRIPTION, LIST_AGENT_TEST_CASES_SCHEMA, createListAgentTestCasesHandler, } from "./tools/list-agent-test-cases.js";
-import { RUN_TEST_SCENARIO_NAME, RUN_TEST_SCENARIO_DESCRIPTION, RUN_TEST_SCENARIO_SCHEMA, createRunTestScenarioHandler, } from "./tools/run-test-scenario.js";
-// ── Enterprise Tools — Threat Model Management ──
-import { GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler } from "./tools/enterprise/get-threat-model.js";
-import { LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler } from "./tools/enterprise/list-threat-models.js";
-import { MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler } from "./tools/enterprise/manage-actor.js";
-import { MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler } from "./tools/enterprise/manage-component.js";
-import { MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler } from "./tools/enterprise/manage-data-flow.js";
-import { MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler } from "./tools/enterprise/manage-attack-scenario.js";
-import { MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler } from "./tools/enterprise/manage-security-control.js";
-import { MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler } from "./tools/enterprise/manage-data-asset.js";
-import { MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler } from "./tools/enterprise/manage-test-case.js";
-import { MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler } from "./tools/enterprise/manage-finding.js";
-// ── Enterprise Tools — Pen Test Sessions ──
-import { START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler } from "./tools/enterprise/start-pentest-session.js";
-import { RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler } from "./tools/enterprise/record-test-result.js";
-import { END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler } from "./tools/enterprise/end-pentest-session.js";
-import { PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler } from "./tools/enterprise/publish-test-to-library.js";
-// ── Enterprise Tools — Evidence & Reports ──
-import { CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler } from "./tools/enterprise/capture-evidence.js";
-import { GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler } from "./tools/enterprise/generate-report.js";
-import { GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler } from "./tools/enterprise/get-report-status.js";
-// ── Enterprise Tools — Report Issues & Remediation ──
-import { PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler } from "./tools/enterprise/promote-finding-to-issue.js";
-import { LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler } from "./tools/enterprise/list-report-issues.js";
-import { UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler } from "./tools/enterprise/update-report-issue.js";
-import { SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler } from "./tools/enterprise/sync-report-section.js";
-import { PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler } from "./tools/enterprise/publish-report-version.js";
-import { CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler } from "./tools/enterprise/create-report-ticket.js";
-// ── Enterprise Tools — ZAT ──
 import { GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler } from "./tools/enterprise/get-org-zat.js";
-// ── Enterprise Tools — Agent Instances ──
-import { LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler } from "./tools/enterprise/list-agents.js";
-// ── IDE Bridge ──
 import { OPEN_IN_IDE_NAME, OPEN_IN_IDE_DESCRIPTION, OPEN_IN_IDE_SCHEMA, createOpenInIdeHandler, } from "./tools/open-in-ide.js";
-/**
- * Create and start the MCP server with all tools registered
- */
-export async function startServer(config = DEFAULT_CONFIG) {
-    // Detect the project binding FIRST so we can auto-adopt its session
-    // when no explicit ZIVIS_SESSION was passed. This makes .zivis/project.json
-    // the single source of truth — cd into a project and the correct tokens
-    // are used without any IDE config to go stale.
-    const detected = detectProjectBinding(process.cwd());
-    if (detected && !config.session) {
-        config = { ...config, session: detected.binding.session };
-        console.error(`[zivis] Auto-adopted session "${config.session}" from ${detected.filePath}`);
+export async function startServer(incoming = DEFAULT_CONFIG) {
+    const workspacePath = incoming.workspacePath ?? process.cwd();
+    const detected = detectProjectBinding(workspacePath);
+    const fromBinding = resolveConfigFromBinding(workspacePath);
+    const overlay = {
+        ...incoming,
+        ...fromBinding,
+        workspacePath: incoming.workspacePath,
+    };
+    const config = {
+        ...overlay,
+        session: resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding),
+    };
+    if (detected) {
+        console.error(`[zivis] Project binding: ${detected.filePath} (session "${detected.binding.session}")`);
     }
     const server = new McpServer({
         name: "zivis-security",
         version: "0.2.0",
+    }, {
+        capabilities: {
+            tools: {},
+            prompts: {},
+        },
     });
     const apiClient = new ApiClient(config);
-    // ── Register Tools: Findings ──
-    server.registerTool(GET_FINDINGS_NAME, {
-        description: GET_FINDINGS_DESCRIPTION,
-        inputSchema: GET_FINDINGS_SCHEMA,
-    }, createGetFindingsHandler(apiClient));
-    server.registerTool(GET_FINDING_DETAILS_NAME, {
-        description: GET_FINDING_DETAILS_DESCRIPTION,
-        inputSchema: GET_FINDING_DETAILS_SCHEMA,
-    }, createGetFindingDetailsHandler(apiClient));
-    server.registerTool(TRIAGE_FINDING_NAME, {
-        description: TRIAGE_FINDING_DESCRIPTION,
-        inputSchema: TRIAGE_FINDING_SCHEMA,
-    }, createTriageFindingHandler(apiClient));
-    // ── Register Tools: Scans & Artifacts ──
-    server.registerTool(LIST_SCANS_NAME, {
-        description: LIST_SCANS_DESCRIPTION,
-        inputSchema: LIST_SCANS_SCHEMA,
-    }, createListScansHandler(apiClient));
-    server.registerTool(LIST_RECON_SCANS_NAME, {
-        description: LIST_RECON_SCANS_DESCRIPTION,
-        inputSchema: LIST_RECON_SCANS_SCHEMA,
-    }, createListReconScansHandler(apiClient));
-    server.registerTool(GET_RECON_SCAN_NAME, {
-        description: GET_RECON_SCAN_DESCRIPTION,
-        inputSchema: GET_RECON_SCAN_SCHEMA,
-    }, createGetReconScanHandler(apiClient));
-    server.registerTool(GET_SCAN_OUTPUT_NAME, {
-        description: GET_SCAN_OUTPUT_DESCRIPTION,
-        inputSchema: GET_SCAN_OUTPUT_SCHEMA,
-    }, createGetScanOutputHandler(apiClient));
-    server.registerTool(GET_TEST_CASE_RESULTS_NAME, {
-        description: GET_TEST_CASE_RESULTS_DESCRIPTION,
-        inputSchema: GET_TEST_CASE_RESULTS_SCHEMA,
-    }, createGetTestCaseResultsHandler(apiClient));
-    server.registerTool(GET_AGENT_TEST_RESULTS_NAME, {
-        description: GET_AGENT_TEST_RESULTS_DESCRIPTION,
-        inputSchema: GET_AGENT_TEST_RESULTS_SCHEMA,
-    }, createGetAgentTestResultsHandler(apiClient));
-    server.registerTool(LIST_SCAN_ARTIFACTS_NAME, {
-        description: LIST_SCAN_ARTIFACTS_DESCRIPTION,
-        inputSchema: LIST_SCAN_ARTIFACTS_SCHEMA,
-    }, createListScanArtifactsHandler(apiClient));
-    server.registerTool(GET_ARTIFACT_CONTENT_NAME, {
-        description: GET_ARTIFACT_CONTENT_DESCRIPTION,
-        inputSchema: GET_ARTIFACT_CONTENT_SCHEMA,
-    }, createGetArtifactContentHandler(apiClient));
-    // ── Register Tools: PR Safety ──
-    server.registerTool(SCAN_PR_NAME, {
-        description: SCAN_PR_DESCRIPTION,
-        inputSchema: SCAN_PR_SCHEMA,
-    }, createScanPrHandler(apiClient));
-    // ── Register Tools: OSS Trust ──
+    server.registerTool(GET_STARTED_NAME, {
+        description: GET_STARTED_DESCRIPTION,
+        inputSchema: GET_STARTED_SCHEMA,
+    }, createGetStartedHandler(apiClient, config));
+    server.registerTool(INSPECT_NAME, {
+        description: INSPECT_DESCRIPTION,
+        inputSchema: INSPECT_SCHEMA,
+    }, createInspectHandler(apiClient, config));
+    server.registerTool(THREAT_LIST_RELEVANT_CAPSULES_NAME, {
+        description: THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION,
+        inputSchema: THREAT_LIST_RELEVANT_CAPSULES_SCHEMA,
+    }, createThreatListRelevantCapsulesHandler());
+    server.registerTool(THREAT_GET_CAPSULE_NAME, {
+        description: THREAT_GET_CAPSULE_DESCRIPTION,
+        inputSchema: THREAT_GET_CAPSULE_SCHEMA,
+    }, createThreatGetCapsuleHandler());
+    server.registerTool(THREAT_GET_INFERENCE_PROMPT_NAME, {
+        description: THREAT_GET_INFERENCE_PROMPT_DESCRIPTION,
+        inputSchema: THREAT_GET_INFERENCE_PROMPT_SCHEMA,
+    }, createThreatGetInferencePromptHandler());
+    server.registerTool(THREAT_RUN_MATCHER_NAME, {
+        description: THREAT_RUN_MATCHER_DESCRIPTION,
+        inputSchema: THREAT_RUN_MATCHER_SCHEMA,
+    }, createThreatRunMatcherHandler());
     server.registerTool(CHECK_REPO_TRUST_NAME, {
         description: CHECK_REPO_TRUST_DESCRIPTION,
         inputSchema: CHECK_REPO_TRUST_SCHEMA,
     }, createCheckRepoTrustHandler(config));
-    // ── Register Tools: ZAT & Trust Verification ──
     server.registerTool(GET_OSS_ZAT_NAME, {
         description: GET_OSS_ZAT_DESCRIPTION,
         inputSchema: GET_OSS_ZAT_SCHEMA,
@@ -237,12 +163,6 @@ export async function startServer(config = DEFAULT_CONFIG) {
         description: INSPECT_ZAT_DESCRIPTION,
         inputSchema: INSPECT_ZAT_SCHEMA,
     }, createInspectZatHandler());
-    // ── Register Tools: Red Team Setup ──
-    server.registerTool(SETUP_RED_TEAM_TARGET_NAME, {
-        description: SETUP_RED_TEAM_TARGET_DESCRIPTION,
-        inputSchema: SETUP_RED_TEAM_TARGET_SCHEMA,
-    }, createSetupRedTeamTargetHandler(apiClient));
-    // ── Register Tools: Application & Endpoint Management ──
     server.registerTool(LIST_APPLICATIONS_NAME, {
         description: LIST_APPLICATIONS_DESCRIPTION,
         inputSchema: LIST_APPLICATIONS_SCHEMA,
@@ -255,6 +175,22 @@ export async function startServer(config = DEFAULT_CONFIG) {
         description: GET_APPLICATION_OVERVIEW_DESCRIPTION,
         inputSchema: GET_APPLICATION_OVERVIEW_SCHEMA,
     }, createGetApplicationOverviewHandler(apiClient));
+    server.registerTool(REVIEW_CHANGE_NAME, {
+        description: REVIEW_CHANGE_DESCRIPTION,
+        inputSchema: REVIEW_CHANGE_SCHEMA,
+    }, createReviewChangeHandler(apiClient));
+    server.registerTool(EXPLAIN_SIGNAL_FOR_DIFF_NAME, {
+        description: EXPLAIN_SIGNAL_FOR_DIFF_DESCRIPTION,
+        inputSchema: EXPLAIN_SIGNAL_FOR_DIFF_SCHEMA,
+    }, createExplainSignalForDiffHandler(apiClient));
+    server.registerTool(LIST_SIGNALS_NAME, {
+        description: LIST_SIGNALS_DESCRIPTION,
+        inputSchema: LIST_SIGNALS_SCHEMA,
+    }, createListSignalsHandler(apiClient));
+    server.registerTool(GET_SIGNAL_NAME, {
+        description: GET_SIGNAL_DESCRIPTION,
+        inputSchema: GET_SIGNAL_SCHEMA,
+    }, createGetSignalHandler(apiClient));
     server.registerTool(LIST_ENDPOINTS_NAME, {
         description: LIST_ENDPOINTS_DESCRIPTION,
         inputSchema: LIST_ENDPOINTS_SCHEMA,
@@ -267,22 +203,22 @@ export async function startServer(config = DEFAULT_CONFIG) {
         description: UPDATE_ENDPOINT_DESCRIPTION,
         inputSchema: UPDATE_ENDPOINT_SCHEMA,
     }, createUpdateEndpointHandler(apiClient));
-    // ── Register Tools: Local Scan ──
-    server.registerTool(LOCAL_SCAN_NAME, {
-        description: LOCAL_SCAN_DESCRIPTION,
-        inputSchema: LOCAL_SCAN_SCHEMA,
-    }, createLocalScanHandler(apiClient));
-    // ── Register Tools: Local Infrastructure Discovery ──
+    server.registerTool(MANAGE_APPLICATION_NAME, {
+        description: MANAGE_APPLICATION_DESCRIPTION,
+        inputSchema: MANAGE_APPLICATION_SCHEMA,
+    }, createManageApplicationHandler(apiClient));
+    server.registerTool(MANAGE_ENDPOINT_LIFECYCLE_NAME, {
+        description: MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION,
+        inputSchema: MANAGE_ENDPOINT_LIFECYCLE_SCHEMA,
+    }, createManageEndpointLifecycleHandler(apiClient));
     server.registerTool(DISCOVER_LOCAL_INFRA_NAME, {
         description: DISCOVER_LOCAL_INFRA_DESCRIPTION,
         inputSchema: DISCOVER_LOCAL_INFRA_SCHEMA,
     }, createDiscoverLocalInfraHandler());
-    // ── Register Tools: Diagram Generation ──
     server.registerTool(GENERATE_DIAGRAM_NAME, {
         description: GENERATE_DIAGRAM_DESCRIPTION,
         inputSchema: GENERATE_DIAGRAM_SCHEMA,
     }, createGenerateDiagramHandler(apiClient));
-    // ── Register Tools: Diagram CRUD ──
     server.registerTool(LIST_DIAGRAMS_NAME, {
         description: LIST_DIAGRAMS_DESCRIPTION,
         inputSchema: LIST_DIAGRAMS_SCHEMA,
@@ -304,64 +240,42 @@ export async function startServer(config = DEFAULT_CONFIG) {
         inputSchema: UPDATE_MERMAID_SOURCE_SCHEMA,
     }, createUpdateMermaidSourceHandler(apiClient));
     server.registerTool(LIST_DOCUMENTS_NAME, { description: LIST_DOCUMENTS_DESCRIPTION, inputSchema: LIST_DOCUMENTS_SCHEMA }, createListDocumentsHandler(apiClient));
+    server.registerTool(CREATE_ARTIFACT_NAME, { description: CREATE_ARTIFACT_DESCRIPTION, inputSchema: CREATE_ARTIFACT_SCHEMA }, createCreateArtifactHandler(apiClient));
+    server.registerTool(GET_ARTIFACT_NAME, { description: GET_ARTIFACT_DESCRIPTION, inputSchema: GET_ARTIFACT_SCHEMA }, createGetArtifactHandler(apiClient));
+    server.registerTool(UPDATE_ARTIFACT_CONTENT_NAME, { description: UPDATE_ARTIFACT_CONTENT_DESCRIPTION, inputSchema: UPDATE_ARTIFACT_CONTENT_SCHEMA }, createUpdateArtifactContentHandler(apiClient));
+    server.registerTool(LIST_ARTIFACT_VERSIONS_NAME, { description: LIST_ARTIFACT_VERSIONS_DESCRIPTION, inputSchema: LIST_ARTIFACT_VERSIONS_SCHEMA }, createListArtifactVersionsHandler(apiClient));
     server.registerTool(GET_DOCUMENT_NAME, { description: GET_DOCUMENT_DESCRIPTION, inputSchema: GET_DOCUMENT_SCHEMA }, createGetDocumentHandler(apiClient));
     server.registerTool(CREATE_DOCUMENT_NAME, { description: CREATE_DOCUMENT_DESCRIPTION, inputSchema: CREATE_DOCUMENT_SCHEMA }, createCreateDocumentHandler(apiClient));
+    server.registerTool(CREATE_FINDING_NAME, { description: CREATE_FINDING_DESCRIPTION, inputSchema: CREATE_FINDING_SCHEMA }, createCreateFindingHandler(apiClient));
+    server.registerTool(UPDATE_FINDING_NAME, { description: UPDATE_FINDING_DESCRIPTION, inputSchema: UPDATE_FINDING_SCHEMA }, createUpdateFindingHandler(apiClient));
+    server.registerTool(DELETE_FINDING_NAME, { description: DELETE_FINDING_DESCRIPTION, inputSchema: DELETE_FINDING_SCHEMA }, createDeleteFindingHandler(apiClient));
     server.registerTool(UPDATE_DOCUMENT_NAME, { description: UPDATE_DOCUMENT_DESCRIPTION, inputSchema: UPDATE_DOCUMENT_SCHEMA }, createUpdateDocumentHandler(apiClient));
-    // ── Register Tools: IDE Bridge ──
+    server.registerTool(MEMORY_PRIOR_FINDINGS_NAME, { description: MEMORY_PRIOR_FINDINGS_DESCRIPTION, inputSchema: MEMORY_PRIOR_FINDINGS_SCHEMA }, createMemoryPriorFindingsHandler(apiClient));
+    server.registerTool(MEMORY_RETEST_CANDIDATES_NAME, { description: MEMORY_RETEST_CANDIDATES_DESCRIPTION, inputSchema: MEMORY_RETEST_CANDIDATES_SCHEMA }, createMemoryRetestCandidatesHandler(apiClient));
+    server.registerTool(MEMORY_THREAT_MODEL_SECTION_NAME, { description: MEMORY_THREAT_MODEL_SECTION_DESCRIPTION, inputSchema: MEMORY_THREAT_MODEL_SECTION_SCHEMA }, createMemoryThreatModelSectionHandler(apiClient));
+    server.registerTool(MEMORY_COVERAGE_NAME, { description: MEMORY_COVERAGE_DESCRIPTION, inputSchema: MEMORY_COVERAGE_SCHEMA }, createMemoryCoverageHandler(apiClient));
+    server.registerTool(RUN_START_NAME, { description: RUN_START_DESCRIPTION, inputSchema: RUN_START_SCHEMA }, createRunStartHandler(apiClient));
+    server.registerTool(RUN_REPORT_NAME, { description: RUN_REPORT_DESCRIPTION, inputSchema: RUN_REPORT_SCHEMA }, createRunReportHandler(apiClient));
+    server.registerTool(RUN_COMPLETE_NAME, { description: RUN_COMPLETE_DESCRIPTION, inputSchema: RUN_COMPLETE_SCHEMA }, createRunCompleteHandler(apiClient));
+    server.registerTool(RUN_CANCEL_NAME, { description: RUN_CANCEL_DESCRIPTION, inputSchema: RUN_CANCEL_SCHEMA }, createRunCancelHandler(apiClient));
     server.registerTool(OPEN_IN_IDE_NAME, { description: OPEN_IN_IDE_DESCRIPTION, inputSchema: OPEN_IN_IDE_SCHEMA }, createOpenInIdeHandler());
-    // ── Register Tools: Security Review ──
     server.registerTool(SECURITY_REVIEW_NAME, {
         description: SECURITY_REVIEW_DESCRIPTION,
         inputSchema: SECURITY_REVIEW_SCHEMA,
     }, createSecurityReviewHandler(apiClient, config));
-    // ── Register Tools: Project Binding ──
     server.registerTool(CHECK_PROJECT_NAME, {
         description: CHECK_PROJECT_DESCRIPTION,
         inputSchema: CHECK_PROJECT_SCHEMA,
     }, createCheckProjectHandler(apiClient, config));
-    // ── Register Tools: Test Library (IP-protected) ──
-    server.registerTool(LIST_TEST_LIBRARY_NAME, {
-        description: LIST_TEST_LIBRARY_DESCRIPTION,
-        inputSchema: LIST_TEST_LIBRARY_SCHEMA,
-    }, createListTestLibraryHandler(apiClient));
-    server.registerTool(GET_TEST_DETAILS_NAME, {
-        description: GET_TEST_DETAILS_DESCRIPTION,
-        inputSchema: GET_TEST_DETAILS_SCHEMA,
-    }, createGetTestDetailsHandler(apiClient));
-    server.registerTool(LIST_TEST_SCENARIOS_NAME, {
-        description: LIST_TEST_SCENARIOS_DESCRIPTION,
-        inputSchema: LIST_TEST_SCENARIOS_SCHEMA,
-    }, createListTestScenariosHandler(apiClient));
-    server.registerTool(GET_SCENARIO_DETAILS_NAME, {
-        description: GET_SCENARIO_DETAILS_DESCRIPTION,
-        inputSchema: GET_SCENARIO_DETAILS_SCHEMA,
-    }, createGetScenarioDetailsHandler(apiClient));
-    server.registerTool(LIST_AGENT_TEST_CASES_NAME, {
-        description: LIST_AGENT_TEST_CASES_DESCRIPTION,
-        inputSchema: LIST_AGENT_TEST_CASES_SCHEMA,
-    }, createListAgentTestCasesHandler(apiClient));
-    server.registerTool(RUN_TEST_SCENARIO_NAME, {
-        description: RUN_TEST_SCENARIO_DESCRIPTION,
-        inputSchema: RUN_TEST_SCENARIO_SCHEMA,
-    }, createRunTestScenarioHandler(apiClient));
-    // ── Register Enterprise Tools ──
-    // These tools are visible to all orgs but return upgrade prompts for non-enterprise.
-    // The handler wrapper checks features at call time via /api/mcp/features.
     let enterpriseFeatures = null;
-    /**
-     * Wraps an enterprise tool handler to check feature access at call time.
-     * Non-enterprise orgs see the tools but get an upgrade message.
-     */
     function wrapEnterpriseHandler(handler, featureKey = "mcpEnterpriseTools") {
         return async (params) => {
-            // Lazy-load features on first enterprise tool call
             if (enterpriseFeatures === null) {
                 try {
                     const resp = await apiClient.get("/api/mcp/features");
                     enterpriseFeatures = resp.features;
                 }
                 catch {
-                    // If feature check fails, allow the call (API will enforce access)
                     enterpriseFeatures = {};
                 }
             }
@@ -370,7 +284,7 @@ export async function startServer(config = DEFAULT_CONFIG) {
                     content: [
                         {
                             type: "text",
-                            text: `This tool requires a Pro+, Enterprise, or Demo plan.\n\nUpgrade at https://app.zivis.ai/settings/billing to access enterprise MCP tools including:\n- Threat model management\n- Pen test session tracking\n- Evidence capture\n- Report generation\n\nContact sales@zivis.ai for enterprise pricing.`,
+                            text: `This tool requires a Pro+, Enterprise, or Demo plan.\n\nUpgrade at https://app.zivis.ai/settings/billing to access enterprise MCP tools including:\n- Threat model management\n- Actor / component / data-flow / data-asset CRUD\n- Attack scenario and security control curation\n- Test case curation\n- Organizational attestation tokens (ZAT)\n\nContact sales@zivis.ai for enterprise pricing.`,
                         },
                     ],
                 };
@@ -378,70 +292,33 @@ export async function startServer(config = DEFAULT_CONFIG) {
             return handler(params);
         };
     }
-    // Agent Instances
     const enterpriseTools = [
-        [LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler(apiClient)],
-        // Threat Model Management
-        [GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler(apiClient)],
-        [LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler(apiClient)],
-        [MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler(apiClient)],
-        [MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler(apiClient)],
-        [MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler(apiClient)],
-        [MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler(apiClient)],
-        [MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler(apiClient)],
-        [MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler(apiClient)],
-        [MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler(apiClient)],
-        [MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler(apiClient)],
-        // Pen Test Sessions
-        [START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler(apiClient)],
-        [RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler(apiClient)],
-        [END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler(apiClient)],
-        [PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler(apiClient)],
-        // Evidence & Reports
-        [CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler(apiClient)],
-        [GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler(apiClient)],
-        [GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler(apiClient)],
-        // Report Issues & Remediation
-        [PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler(apiClient)],
-        [LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler(apiClient)],
-        [UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler(apiClient)],
-        [SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler(apiClient)],
-        [PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler(apiClient)],
-        [CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler(apiClient)],
-        // ZAT
         [GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler(apiClient)],
     ];
     for (const [name, description, schema, handler] of enterpriseTools) {
         server.registerTool(name, { description: description, inputSchema: schema }, wrapEnterpriseHandler(handler));
     }
-    // ── Project binding check ──
-    // `detected` was resolved at the top of this function so its session could
-    // be auto-adopted into config when no explicit ZIVIS_SESSION was set.
     if (detected) {
         validateProjectBinding(detected.binding, detected.filePath, config);
     }
-    // ── Session safety check ──
     if (config.session) {
         console.error(`[zivis] Session: ${config.session}`);
-        // Verify the session has credentials before starting
-        const creds = await resolveAuth(config);
+        const creds = await resolveAuth(config, "apikey");
         if (creds.method === "none") {
-            console.error(`[zivis] ERROR: Session "${config.session}" has no credentials.`);
-            console.error(`[zivis] Run: zivis auth login --session ${config.session}`);
+            console.error(`[zivis] ERROR: Session "${config.session}" has no API key for MCP.`);
+            console.error("[zivis] OAuth is used only to mint an org-scoped API key:");
+            console.error("[zivis]   zivis auth bind");
+            console.error(`[zivis] Or paste a platform token: zivis auth token sk_<...> --session ${config.session}`);
             process.exit(1);
         }
     }
-    // ── JWT org isolation check ──
-    // Must run AFTER session check (needs valid tokens) but BEFORE connecting.
-    // Prevents cross-org data leaks by verifying the JWT's org matches the project binding.
     if (detected?.binding.workosOrgId) {
-        await validateJwtOrgBinding(detected.binding, config);
+        await validateApiKeyMatchesBinding(detected.binding, config);
     }
-    // ── Connect via stdio ──
+    registerAllPrompts(server);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error("[zivis] MCP server running on stdio");
     console.error(`[zivis] API: ${config.apiBaseUrl}`);
-    console.error(`[zivis] Tools: 31 public + ${enterpriseTools.length} enterprise`);
+    console.error(`[zivis] Tools: public + ${enterpriseTools.length} enterprise registered`);
 }
-//# sourceMappingURL=server.js.map