@zivis/mcp 0.1.8 → 0.1.10

package/dist/tools/threat-list-relevant-capsules.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_NAME = "zivis_threat_list_relevant_capsules";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION = "List threat-model patterns relevant to the user's current repo.\n\nUse this when the user asks any of:\n- \"what should I be worried about in this code\"\n- \"what threats apply to my app\"\n- \"are there known patterns that match my architecture\"\n- \"what's in my threat model\"\n- mid-conversation when the user describes a feature that touches deps the threat library covers\n\nReads the latest local repo graph artifact (produced by 'zivis inspect') from the user cache, runs every capsule's relevance_filter against it, and returns the subset whose filter passes \u2014 together with each capsule's safe_summary so you can frame the conversation in threat-model terms (component, flow, trust boundary, scenario).\n\nIf no graph artifact exists yet for this repo, the tool returns a next-step pointing to 'zivis inspect'. Always speak in threat-model vocabulary even when the user doesn't.";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_SCHEMA: {
+    artifact_path: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+};
+export declare function createThreatListRelevantCapsulesHandler(): (params: {
+    artifact_path?: string;
+    cwd?: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-list-relevant-capsules.js

@@ -0,0 +1,158 @@
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { loadActivePack, findRelevantCapsules, } from "../pattern-pack/index.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const THREAT_LIST_RELEVANT_CAPSULES_NAME = "zivis_threat_list_relevant_capsules";
+export const THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION = `List threat-model patterns relevant to the user's current repo.
+
+Use this when the user asks any of:
+- "what should I be worried about in this code"
+- "what threats apply to my app"
+- "are there known patterns that match my architecture"
+- "what's in my threat model"
+- mid-conversation when the user describes a feature that touches deps the threat library covers
+
+Reads the latest local repo graph artifact (produced by 'zivis inspect') from the user cache, runs every capsule's relevance_filter against it, and returns the subset whose filter passes — together with each capsule's safe_summary so you can frame the conversation in threat-model terms (component, flow, trust boundary, scenario).
+
+If no graph artifact exists yet for this repo, the tool returns a next-step pointing to 'zivis inspect'. Always speak in threat-model vocabulary even when the user doesn't.`;
+export const THREAT_LIST_RELEVANT_CAPSULES_SCHEMA = {
+    artifact_path: z
+        .string()
+        .optional()
+        .describe("Optional path to a specific RepoGraphArtifactV1 JSON. If omitted, the tool finds the most recent artifact in ~/Library/Caches/zivis/repos/<repo-id>/inspect/runs/ for the repo at cwd."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory whose repo cache to search (defaults to server cwd)."),
+};
+export function createThreatListRelevantCapsulesHandler() {
+    return async (params) => {
+        const cwd = params.cwd ?? process.cwd();
+        let artifact;
+        let artifactPath;
+        try {
+            const resolved = await resolveArtifactPath(params.artifact_path, cwd);
+            artifactPath = resolved;
+            const raw = await fs.readFile(resolved, "utf8");
+            artifact = JSON.parse(raw);
+        }
+        catch (err) {
+            return withNextStepsError(`No repo graph artifact found. ${err.message}`, [
+                {
+                    id: "run_zivis_inspect",
+                    label: "Run `zivis inspect` to build the local repo graph",
+                    tool: "zivis_inspect",
+                    why: "The relevance evaluation reads from the latest inspect run in the user cache.",
+                },
+            ], "Run `zivis inspect` first; this tool reads from its output.");
+        }
+        const handle = await loadActivePack();
+        const relevant = await findRelevantCapsules(handle, artifact);
+        const summaries = relevant.map((cap) => ({
+            id: cap.id,
+            title: cap.title,
+            category: cap.category,
+            safe_summary: cap.safe_summary,
+            applicable_languages: cap.applicable_languages,
+            matched_on: matchedTerms(cap, artifact),
+        }));
+        return withNextSteps({
+            artifact_path: artifactPath,
+            pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
+            languages_in_scope: artifact.scope.languages ?? [],
+            relevant_count: summaries.length,
+            relevant_capsules: summaries,
+        }, summaries.length > 0
+            ? [
+                {
+                    id: "get_capsule_details",
+                    label: "Pull the full capsule for any item the user wants to investigate",
+                    tool: "zivis_threat_get_capsule",
+                    why: "The full capsule has threats (with STRIDE), risk_hints, repair_contract, related_patterns.",
+                },
+                {
+                    id: "get_inference_prompt",
+                    label: "Get the inference prompt for the host LLM to run a deeper check",
+                    tool: "zivis_threat_get_inference_prompt",
+                    why: "INFER strategies in each capsule reference a prompt template the user's IDE model executes.",
+                },
+            ]
+            : [
+                {
+                    id: "no_relevant_patterns",
+                    label: "No public-pack patterns matched this repo",
+                    tool: "zivis_threat_list_relevant_capsules",
+                    why: "This is normal for repos without agentic / RAG / self-consistency / multi-tenant patterns. Proprietary patterns may still apply server-side.",
+                },
+            ], summaries.length > 0
+            ? `Found ${summaries.length} relevant capsule(s) in the threat library.`
+            : "No public-pack capsules matched this repo. Proprietary patterns evaluated server-side may still apply.");
+    };
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function resolveArtifactPath(explicit, cwd) {
+    if (explicit) {
+        if (!fssync.existsSync(explicit)) {
+            throw new Error(`Artifact path does not exist: ${explicit}`);
+        }
+        return explicit;
+    }
+    const reposRoot = path.join(userCacheRoot(), "repos");
+    if (!fssync.existsSync(reposRoot)) {
+        throw new Error(`No inspect cache found at ${reposRoot}. Run \`zivis inspect\` from the repo to populate it.`);
+    }
+    const candidates = [];
+    for (const repo of await fs.readdir(reposRoot, { withFileTypes: true })) {
+        if (!repo.isDirectory())
+            continue;
+        const runs = path.join(reposRoot, repo.name, "inspect", "runs");
+        if (!fssync.existsSync(runs))
+            continue;
+        for (const entry of await fs.readdir(runs)) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const full = path.join(runs, entry);
+            const stat = await fs.stat(full);
+            candidates.push({ file: full, mtime: stat.mtimeMs });
+        }
+    }
+    if (candidates.length === 0) {
+        throw new Error(`No inspect runs found under ${reposRoot}. Run \`zivis inspect\` from the repo to produce one.`);
+    }
+    candidates.sort((a, b) => b.mtime - a.mtime);
+    return candidates[0].file;
+}
+function matchedTerms(cap, artifact) {
+    const matched = [];
+    const pkgs = new Set();
+    for (const node of artifact.nodes) {
+        if (node.type === "external_dependency" && node.attributes?.package) {
+            pkgs.add(node.attributes.package);
+        }
+    }
+    const langs = new Set(artifact.scope.languages ?? []);
+    const f = cap.relevance_filter;
+    if (!f)
+        return ["always-applicable (no relevance_filter set)"];
+    for (const term of [...(f.any_of ?? []), ...(f.all_of ?? [])]) {
+        if (term.dependency && pkgs.has(term.dependency))
+            matched.push(`dep:${term.dependency}`);
+        if (term.language && langs.has(term.language))
+            matched.push(`language:${term.language}`);
+    }
+    return matched.length > 0 ? matched : ["language match only"];
+}

package/dist/tools/threat-run-matcher.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+export declare const THREAT_RUN_MATCHER_NAME = "zivis_threat_run_matcher";
+export declare const THREAT_RUN_MATCHER_DESCRIPTION = "Run the local pattern matcher against the latest repo graph artifact and emit normalized threat findings.\n\nUse this when:\n- The user asks ZIVIS to actually evaluate (not just list) which patterns fire on their code\n- After 'zivis inspect' has produced an artifact and the user wants concrete findings\n- \"find security issues in my code\", \"check this against the threat library\", \"what's actually wrong here\"\n\nPhase 3 v1 evaluates AST strategies for real (via @ast-grep/napi for TS/JS, plus Python and Go via dynamic language packs). INFER strategies emit a candidate the host LLM is expected to pick up via zivis_threat_get_inference_prompt and run with its own model. GRAPH / META / DEP / CONFIG strategies are surfaced as fired_strategies with match_count: 0 \u2014 visible-but-not-evaluated for now.\n\nLane assignment per finding:\n- trusted: count of fired deterministic strategies meets the capsule's required_evidence_count\n- inferred: at least one strategy fired but the bar wasn't met (host should run inference to confirm)\n\nThe output is a normalized findings array with pattern_id, lane, confidence, evidence spans, and (for inferred-lane findings) an inference_candidate the host LLM uses to run deeper analysis.";
+export declare const THREAT_RUN_MATCHER_SCHEMA: {
+    artifact_path: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+};
+export declare function createThreatRunMatcherHandler(): (params: {
+    artifact_path?: string;
+    cwd?: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-run-matcher.js

@@ -0,0 +1,145 @@
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { runMatcher } from "../matcher/index.js";
+import { buildInferenceBundle } from "../matcher/inference-candidates.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+const execAsync = promisify(exec);
+export const THREAT_RUN_MATCHER_NAME = "zivis_threat_run_matcher";
+export const THREAT_RUN_MATCHER_DESCRIPTION = `Run the local pattern matcher against the latest repo graph artifact and emit normalized threat findings.
+
+Use this when:
+- The user asks ZIVIS to actually evaluate (not just list) which patterns fire on their code
+- After 'zivis inspect' has produced an artifact and the user wants concrete findings
+- "find security issues in my code", "check this against the threat library", "what's actually wrong here"
+
+Phase 3 v1 evaluates AST strategies for real (via @ast-grep/napi for TS/JS, plus Python and Go via dynamic language packs). INFER strategies emit a candidate the host LLM is expected to pick up via zivis_threat_get_inference_prompt and run with its own model. GRAPH / META / DEP / CONFIG strategies are surfaced as fired_strategies with match_count: 0 — visible-but-not-evaluated for now.
+
+Lane assignment per finding:
+- trusted: count of fired deterministic strategies meets the capsule's required_evidence_count
+- inferred: at least one strategy fired but the bar wasn't met (host should run inference to confirm)
+
+The output is a normalized findings array with pattern_id, lane, confidence, evidence spans, and (for inferred-lane findings) an inference_candidate the host LLM uses to run deeper analysis.`;
+export const THREAT_RUN_MATCHER_SCHEMA = {
+    artifact_path: z
+        .string()
+        .optional()
+        .describe("Path to a specific RepoGraphArtifactV1 JSON. If omitted, the most recent inspect run in the user cache is used."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Repo root for source-file walking — capsule AST strategies match against files in this directory. Defaults to server cwd."),
+};
+export function createThreatRunMatcherHandler() {
+    return async (params) => {
+        const cwd = params.cwd ?? process.cwd();
+        let artifactPath;
+        try {
+            artifactPath = await resolveArtifactPath(params.artifact_path, cwd);
+        }
+        catch (err) {
+            return withNextStepsError(`No repo graph artifact found. ${err.message}`, [
+                {
+                    id: "run_zivis_inspect",
+                    label: "Run `zivis inspect` to build the local repo graph first",
+                    tool: "zivis_inspect",
+                    why: "The matcher consumes the latest inspect artifact.",
+                },
+            ], "Run `zivis inspect` first; this tool reads from its output.");
+        }
+        const result = await runMatcher({ artifactPath, cwd });
+        const inferenceBundle = await buildInferenceBundle(result.findings);
+        const headline = result.summary.total === 0
+            ? "Matcher ran cleanly — no patterns fired against this repo."
+            : `Matcher emitted ${result.summary.total} finding(s): ${result.summary.trusted_count} trusted, ${result.summary.inferred_count} inferred. ` +
+                (inferenceBundle.inference_candidates.length > 0
+                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution — see host_required_action.`
+                    : "");
+        return withNextSteps({
+            ...result,
+            host_required_action: inferenceBundle.host_required_action,
+            inference_candidates: inferenceBundle.inference_candidates,
+        }, result.summary.inferred_count > 0
+            ? [
+                {
+                    id: "get_inference_prompts",
+                    label: "Pull inference prompts for inferred-lane findings and run them in your model",
+                    tool: "zivis_threat_get_inference_prompt",
+                    why: "Each inferred finding has an inference_candidate.prompt_ref. Pass it (or the capsule_id) to retrieve the prompt bundle.",
+                },
+                {
+                    id: "review_findings",
+                    label: "Review the trusted-lane findings first; they're evidence-backed and ready for the threat model",
+                    tool: "zivis_threat_run_matcher",
+                    why: "Trusted-lane findings can land in the threat model directly. Inferred require host-LLM confirmation.",
+                },
+            ]
+            : result.summary.total === 0
+                ? [
+                    {
+                        id: "expand_pack",
+                        label: "No matches today — proprietary patterns evaluated server-side may still apply",
+                        tool: "zivis_threat_run_matcher",
+                        why: "Public pack covers a curated subset. Phase 4 sends the artifact for proprietary platform evaluation.",
+                    },
+                ]
+                : [], headline);
+    };
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function resolveArtifactPath(explicit, cwd) {
+    if (explicit) {
+        if (!fssync.existsSync(explicit)) {
+            throw new Error(`Artifact path does not exist: ${explicit}`);
+        }
+        return explicit;
+    }
+    const repoId = await deriveRepoId(cwd);
+    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
+    if (!fssync.existsSync(runsDir)) {
+        throw new Error(`No inspect runs for this repo (looked under ${runsDir}). Run \`zivis inspect\` from this directory first.`);
+    }
+    const candidates = [];
+    for (const entry of await fs.readdir(runsDir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const full = path.join(runsDir, entry);
+        const stat = await fs.stat(full);
+        candidates.push({ file: full, mtime: stat.mtimeMs });
+    }
+    if (candidates.length === 0) {
+        throw new Error(`No inspect runs found under ${runsDir}.`);
+    }
+    candidates.sort((a, b) => b.mtime - a.mtime);
+    return candidates[0].file;
+}
+async function deriveRepoId(cwd) {
+    try {
+        const { stdout } = await execAsync("git remote get-url origin", { cwd });
+        const remote = stdout.trim();
+        if (remote)
+            return "remote-" + sha256Short(remote);
+    }
+    catch {
+    }
+    return "path-" + sha256Short(cwd);
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}

package/dist/tools/update-document.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_update_document — Update a document's title, markdown content, or tags.
- *
- * Maps to: PATCH /api/documents/:id
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_DOCUMENT_NAME = "zivis_update_document";

package/dist/tools/update-document.js

@@ -1,10 +1,5 @@
-/**
- * zivis_update_document — Update a document's title, markdown content, or tags.
- *
- * Maps to: PATCH /api/documents/:id
- */
 import { z } from "zod";
-import { sanitizeResponse } from "../sanitize.js";
+import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
 export const UPDATE_DOCUMENT_NAME = "zivis_update_document";
 export const UPDATE_DOCUMENT_DESCRIPTION = `Update a document's title, markdown content, or tags. At least one of these fields must be provided.
 
@@ -47,9 +42,9 @@ export function createUpdateDocumentHandler(apiClient) {
             }
             const body = {};
             if (title !== undefined)
-                body.title = title;
+                body.title = sanitizeInboundText(title, 500);
             if (content !== undefined)
-                body.content = content;
+                body.content = sanitizeInboundText(content, 200_000);
             if (tags !== undefined)
                 body.tags = tags;
             const data = await apiClient.patch(`/api/documents/${document_id}`, body);
@@ -60,4 +55,3 @@ export function createUpdateDocumentHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-document.js.map

package/dist/tools/update-endpoint.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_update_endpoint — Update a specific endpoint's configuration
- *
- * Maps to: PATCH /api/rt/applications/:id/endpoints/:endpointId
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_ENDPOINT_NAME = "zivis_update_endpoint";
@@ -15,8 +10,8 @@ export declare const UPDATE_ENDPOINT_SCHEMA: {
         POST: "POST";
         GET: "GET";
         PATCH: "PATCH";
-        DELETE: "DELETE";
         PUT: "PUT";
+        DELETE: "DELETE";
         HEAD: "HEAD";
         OPTIONS: "OPTIONS";
     }>>;

package/dist/tools/update-endpoint.js

@@ -1,8 +1,3 @@
-/**
- * zivis_update_endpoint — Update a specific endpoint's configuration
- *
- * Maps to: PATCH /api/rt/applications/:id/endpoints/:endpointId
- */
 import { z } from "zod";
 import { requireApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -79,7 +74,6 @@ export function createUpdateEndpointHandler(apiClient) {
         }
         const application_id = req.id;
         const apiPath = `/api/rt/applications/${application_id}/endpoints/${params.endpoint_id}`;
-        // Map snake_case params to camelCase API fields, only including provided values
         const body = {};
         if (params.path !== undefined)
             body.path = params.path;
@@ -142,4 +136,3 @@ export function createUpdateEndpointHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-endpoint.js.map

package/dist/tools/update-finding.d.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const UPDATE_FINDING_NAME = "zivis_update_finding";
+export declare const UPDATE_FINDING_DESCRIPTION = "Update an existing security finding \u2014 edit its fields or change its status.\n\nUse to correct or flesh out a finding (title, severity, description, category, remediation, CWE/OWASP), or to move it through its lifecycle (triaged, resolved, dismissed, suppressed). Only pass the fields you want to change. Every change is audited. Pass the finding's id (from zivis_create_finding or the findings list). To delete a finding, use zivis_delete_finding instead.";
+export declare const UPDATE_FINDING_SCHEMA: {
+    finding_id: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodEnum<{
+        vulnerability: "vulnerability";
+        misconfiguration: "misconfiguration";
+        secret: "secret";
+        anomaly: "anomaly";
+        other: "other";
+    }>>;
+    remediation_steps: z.ZodOptional<z.ZodString>;
+    cwe_id: z.ZodOptional<z.ZodString>;
+    owasp_id: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        open: "open";
+        in_progress: "in_progress";
+        resolved: "resolved";
+        dismissed: "dismissed";
+        triaged: "triaged";
+        suppressed: "suppressed";
+    }>>;
+    dismiss_reason: z.ZodOptional<z.ZodEnum<{
+        false_positive: "false_positive";
+        risk_accepted: "risk_accepted";
+        duplicate: "duplicate";
+        wont_fix: "wont_fix";
+    }>>;
+    note: z.ZodOptional<z.ZodString>;
+};
+type UpdateFindingParams = {
+    finding_id: string;
+    title?: string;
+    severity?: "critical" | "high" | "medium" | "low" | "info";
+    description?: string;
+    category?: "vulnerability" | "misconfiguration" | "secret" | "anomaly" | "other";
+    remediation_steps?: string;
+    cwe_id?: string;
+    owasp_id?: string;
+    status?: "open" | "triaged" | "in_progress" | "resolved" | "dismissed" | "suppressed";
+    dismiss_reason?: "false_positive" | "risk_accepted" | "duplicate" | "wont_fix";
+    note?: string;
+};
+export declare function createUpdateFindingHandler(apiClient: ApiClient): (params: UpdateFindingParams) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;
+export {};

package/dist/tools/update-finding.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { sanitizeResponse, sanitizeInboundText } from "../sanitize.js";
+export const UPDATE_FINDING_NAME = "zivis_update_finding";
+export const UPDATE_FINDING_DESCRIPTION = `Update an existing security finding — edit its fields or change its status.
+
+Use to correct or flesh out a finding (title, severity, description, category, remediation, CWE/OWASP), or to move it through its lifecycle (triaged, resolved, dismissed, suppressed). Only pass the fields you want to change. Every change is audited. Pass the finding's id (from zivis_create_finding or the findings list). To delete a finding, use zivis_delete_finding instead.`;
+export const UPDATE_FINDING_SCHEMA = {
+    finding_id: z.string().describe("UUID of the finding to update"),
+    title: z.string().optional().describe("New title"),
+    severity: z
+        .enum(["critical", "high", "medium", "low", "info"])
+        .optional()
+        .describe("New severity"),
+    description: z.string().optional().describe("New description / details (markdown allowed)"),
+    category: z
+        .enum(["vulnerability", "misconfiguration", "secret", "anomaly", "other"])
+        .optional()
+        .describe("New category"),
+    remediation_steps: z.string().optional().describe("New remediation guidance"),
+    cwe_id: z.string().optional().describe("CWE id, e.g. 'CWE-89'"),
+    owasp_id: z.string().optional().describe("OWASP id, e.g. 'A01'"),
+    status: z
+        .enum(["open", "triaged", "in_progress", "resolved", "dismissed", "suppressed"])
+        .optional()
+        .describe("New lifecycle status. Use zivis_delete_finding to delete."),
+    dismiss_reason: z
+        .enum(["false_positive", "risk_accepted", "duplicate", "wont_fix"])
+        .optional()
+        .describe("Reason, when status=dismissed"),
+    note: z.string().optional().describe("Optional note recorded in the audit history"),
+};
+function errorResult(message) {
+    return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true,
+    };
+}
+function successResult(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+    };
+}
+export function createUpdateFindingHandler(apiClient) {
+    return async (params) => {
+        try {
+            if (!params.finding_id || !params.finding_id.trim()) {
+                return errorResult("finding_id is required");
+            }
+            const body = {};
+            if (params.title !== undefined)
+                body.title = sanitizeInboundText(params.title, 500);
+            if (params.severity !== undefined)
+                body.severity = params.severity;
+            if (params.description !== undefined)
+                body.description = sanitizeInboundText(params.description, 8000);
+            if (params.category !== undefined)
+                body.category = params.category;
+            if (params.remediation_steps !== undefined)
+                body.remediationSteps = sanitizeInboundText(params.remediation_steps, 4000);
+            if (params.cwe_id !== undefined)
+                body.cweId = params.cwe_id;
+            if (params.owasp_id !== undefined)
+                body.owaspId = params.owasp_id;
+            if (params.status !== undefined)
+                body.status = params.status;
+            if (params.dismiss_reason !== undefined)
+                body.dismissReason = sanitizeInboundText(params.dismiss_reason, 2000);
+            if (params.note !== undefined)
+                body.note = sanitizeInboundText(params.note, 4000);
+            if (Object.keys(body).length === 0) {
+                return errorResult("Provide at least one field to update");
+            }
+            const data = await apiClient.patch(`/api/findings/unified/${encodeURIComponent(params.finding_id)}`, body);
+            return successResult(data);
+        }
+        catch (err) {
+            return errorResult(err?.message ?? "Failed to update finding");
+        }
+    };
+}

package/dist/tools/update-mermaid-source.d.ts

@@ -1,16 +1,3 @@
-/**
- * zivis_update_mermaid_source — Update the Mermaid source of a diagram
- *
- * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
- *
- * Workflow for an editing AI:
- *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
- *   2. Reason about the change the user requested. Produce a new Mermaid source string.
- *   3. Call this tool with the new source to persist it.
- *
- * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
- * (contentType = "canvas"), use zivis_manage_diagram instead.
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";

package/dist/tools/update-mermaid-source.js

@@ -1,16 +1,3 @@
-/**
- * zivis_update_mermaid_source — Update the Mermaid source of a diagram
- *
- * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
- *
- * Workflow for an editing AI:
- *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
- *   2. Reason about the change the user requested. Produce a new Mermaid source string.
- *   3. Call this tool with the new source to persist it.
- *
- * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
- * (contentType = "canvas"), use zivis_manage_diagram instead.
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";
@@ -73,4 +60,3 @@ export function createUpdateMermaidSourceHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=update-mermaid-source.js.map

package/dist/tools/verify-trust-mark.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
- *
- * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
- */
 import { z } from "zod";
 import type { ZivisConfig } from "../types.js";
 export declare const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";

package/dist/tools/verify-trust-mark.js

@@ -1,8 +1,3 @@
-/**
- * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
- *
- * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
- */
 import { z } from "zod";
 export const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";
 export const VERIFY_TRUST_MARK_DESCRIPTION = `Verify a ZIVIS Trust Mark by its SHA-256 hash or Ed25519 compact token.
@@ -105,4 +100,3 @@ export function createVerifyTrustMarkHandler(config) {
         }
     };
 }
-//# sourceMappingURL=verify-trust-mark.js.map