@zivis/mcp 0.1.8 → 0.1.10

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -0,0 +1,167 @@
+{
+  "schema_version": "1.0.0",
+  "pack_id": "zivis-public",
+  "pack_name": "ZIVIS Public Pattern Pack",
+  "version": "0.2.0",
+  "built_at": "2026-08-31T00:01:43.737Z",
+  "tier": "customer_safe",
+  "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
+  "capsules": [
+    {
+      "id": "agents.privilege-separation",
+      "version": "0.1.0",
+      "path": "capsules/agents/privilege-separation.yaml",
+      "sha256": "716f9c766add6f51eac2568eefc328a030901520cf0d3098ed577651c98773ea",
+      "category": "agents",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prompting.self-consistency-no-isolation",
+      "version": "0.1.0",
+      "path": "capsules/prompting/self-consistency-no-isolation.yaml",
+      "sha256": "e1b11e02f7d13cfaeb8ed7f8ae7cae05062bcf8e6fbb226eed75e8bf7fa6e8d1",
+      "category": "prompting",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "retrieval.context-injection-no-validator",
+      "version": "0.1.0",
+      "path": "capsules/retrieval/context-injection-no-validator.yaml",
+      "sha256": "cb7ea3851894a946e34ab62ca42d1cce0a6f43c893f38cfd593b8daf32462fd8",
+      "category": "retrieval",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "security.late-org-filter",
+      "version": "0.1.0",
+      "path": "capsules/security/late-org-filter.yaml",
+      "sha256": "aeb9b327be936770ea6d208f6e687ae095a79976770e47b27ce5c97df3e43a3b",
+      "category": "security",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python",
+        "go"
+      ]
+    }
+  ],
+  "prompts": [
+    {
+      "path": "prompts/agents/privilege-separation/identify.md",
+      "sha256": "eda7d288f9d1c6f7dfc18d2856300df76e8c4fdb5f18f3490f39ddf7117853e4",
+      "capsule_id": "agents.privilege-separation"
+    },
+    {
+      "path": "prompts/prompting/self-consistency-no-isolation/identify.md",
+      "sha256": "e05ffb777550a2a79b3c5b8e75d3e3c7fb2da2cd43ab0fcf202a9eda0f29c10f",
+      "capsule_id": "prompting.self-consistency-no-isolation"
+    },
+    {
+      "path": "prompts/retrieval/context-injection-no-validator/identify.md",
+      "sha256": "31c0d67ffddc75e2d024eead7977c0b47342b4804663598f170aaabf24a5ed39",
+      "capsule_id": "retrieval.context-injection-no-validator"
+    },
+    {
+      "path": "prompts/security/late-org-filter/identify.md",
+      "sha256": "8e602179572ace5d457f8582b67e9d6ab29c675e82964481848c95e5ccb83e1e",
+      "capsule_id": "security.late-org-filter"
+    }
+  ],
+  "controls": [
+    {
+      "id": "external_validator_on_facts",
+      "path": "controls/external_validator_on_facts.yaml",
+      "sha256": "17ec428bf4cfc55b9f464d5c34e7a1ccc854a6c5822e1a4f6848db53ab3bccce",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "fact_validator_present",
+      "path": "controls/fact_validator_present.yaml",
+      "sha256": "4f7be51328f9a73be7846601a2aa2991364ed88bc2ae43a29ee0f0b4bc69da5f",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "human_approval_gate",
+      "path": "controls/human_approval_gate.yaml",
+      "sha256": "ccafcb0bbf0fc68bb02fd018f87a870471fa4653363459293a24f0a65dc53b99",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "langgraph_state_machine_with_per_node_tools",
+      "path": "controls/langgraph_state_machine_with_per_node_tools.yaml",
+      "sha256": "29b46ad213173c52b5d96f744d74179193e61a6dc9c43e6b0b94b013ec94a32c",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "per_sample_retrieval_diversification",
+      "path": "controls/per_sample_retrieval_diversification.yaml",
+      "sha256": "9b4db7c6d620f46e93887f793a3e77bdabe280521b5ce0320d84d0c6b31ae653",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prisma_extension_or_middleware_attaching_org_filter",
+      "path": "controls/prisma_extension_or_middleware_attaching_org_filter.yaml",
+      "sha256": "196676bebd107c4345a5f9227380982e5e2da0f2a8ad87e48517b5bd924abc31",
+      "applicable_languages": [
+        "typescript",
+        "javascript"
+      ]
+    },
+    {
+      "id": "row_level_security_policy",
+      "path": "controls/row_level_security_policy.yaml",
+      "sha256": "42d2a6f561a89b6dae80f04e25c65081fb22b660a59920e1f5c0ed438f394c68",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "source_attribution_present",
+      "path": "controls/source_attribution_present.yaml",
+      "sha256": "302c74045965b5452f5088b18cb86bf77a89f2de3a78015bf57d2845180b9465",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    }
+  ]
+}

package/dist/pattern-packs/zivis-public-0.2.0/prompts/agents/privilege-separation/identify.md

@@ -0,0 +1,54 @@
+# Inference prompt: agents.privilege-separation — identify
+
+You are assisting with secure agentic-AI architecture review. The user is
+working on a codebase that has been flagged by deterministic detectors as
+*possibly* lacking privilege separation between agents. Your job is to
+look at the attached code context and produce a structured verdict.
+
+## Pattern definition
+
+**Privilege separation** means each agent in a multi-agent system is bound
+only to the minimum tools required for its role. The anti-pattern is a
+single shared tool registry that every agent inherits.
+
+## What you are evaluating
+
+1. Does the code construct two or more agents (or two or more entry points
+   that invoke the same agent factory) with a **shared** tool array?
+2. Is there a per-agent capability filter, authorization layer, or
+   capability-token check between an agent and its tool dispatch? If so,
+   the pattern does *not* fire even when tools appear shared.
+3. If LangGraph is used: are tools bound per node (good), or is one tool
+   list passed to a top-level `create_react_agent` covering every node
+   (anti-pattern)?
+
+## What does NOT count as privilege separation
+
+- Comments mentioning least privilege without code enforcing it.
+- A shared tool list with one agent renamed at runtime.
+- Defensive prompt instructions ("don't use the database tool unless…")
+  — prompts are not authorization.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "absent | present | unclear",
+  "confidence": 0.0,
+  "rationale": "one paragraph",
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `verdict: absent` — the anti-pattern fires (shared registry, no scoping).
+- `verdict: present` — privilege separation is correctly implemented.
+- `verdict: unclear` — the available context is ambiguous; do not guess.
+
+Cite line numbers from the snippet only. Do not invent files. Do not
+fabricate evidence. If a concept (e.g. "authorization layer") is mentioned
+but you cannot identify the line that implements it, mark `unclear` and
+explain.

package/dist/pattern-packs/zivis-public-0.2.0/prompts/prompting/self-consistency-no-isolation/identify.md

@@ -0,0 +1,60 @@
+# Inference prompt: prompting.self-consistency-no-isolation — identify
+
+You are reviewing code that has been flagged as *possibly* aggregating multiple
+LLM samples without context isolation. Your job is to determine whether each
+sample actually sees independent context, or whether they all share the same
+input — making the aggregation a confidence-amplifier rather than a
+confidence-filter.
+
+## What you are evaluating
+
+1. How many LLM completion calls happen for one user request? Identify the
+   loop, `Promise.all`, list comprehension, or fan-out construct.
+2. Does each sample receive the **same** `messages` / prompt argument verbatim,
+   or is there per-sample variation (different retrieval query, different
+   temperature, different seed, different context window)?
+3. How is the result aggregated? Voting, ranking, similarity-based merging,
+   first-passing-validator, or simple averaging?
+4. Is there an external check on the aggregated output — e.g. a fact validator,
+   tool-output validation, human approval gate?
+5. Does the user-facing surface advertise the vote count as a "confidence"
+   number? That's the strongest tell that independence is being assumed.
+
+## What does NOT count as context isolation
+
+- Different agent *names* with the same prompt and same retrieval.
+- Comments saying "ensemble" without per-sample variation in the call.
+- Setting `n=N` on a single OpenAI completion call (the model produces N
+  samples but they share the entire prompt and context — same problem).
+- Different temperatures on every sample WITH the same retrieval — partial
+  mitigation but not full isolation; mark `unclear` and explain.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "independence_assessment": "shared_context | isolated_context | unclear",
+  "confidence_claim_risk": "high | medium | low",
+  "rationale": "one paragraph",
+  "recommended_controls": [
+    "per_sample_retrieval_diversification",
+    "external_validator",
+    "human_approval"
+  ],
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `shared_context` — every sample sees identical input. The vote is
+  amplifying rather than filtering. `confidence_claim_risk` should be `high`
+  if any user-facing label calls the vote count a confidence.
+- `isolated_context` — per-sample retrieval, temperature, or seed variation
+  IS present. The aggregation is doing real work.
+- `unclear` — context plumbing is too complex to determine from the snippet,
+  or the code uses a custom aggregator. Don't guess; ask in the rationale.
+
+Cite line numbers from the snippet only. Do not fabricate evidence.

package/dist/pattern-packs/zivis-public-0.2.0/prompts/retrieval/context-injection-no-validator/identify.md

@@ -0,0 +1,109 @@
+# Inference prompt: retrieval.context-injection-no-validator — identify
+
+You are reviewing code that appears to implement retrieval-augmented
+generation (RAG): a retriever returns documents and an LLM call consumes
+them. The pattern flagged by ZIVIS suggests there is no validator,
+sanitizer, or source-attribution check between the retriever and the
+model. Your job is to confirm or refute that — strictly based on the
+actual source spans provided. Do not speculate about code you cannot see.
+
+## What you are evaluating
+
+1. **The retrieval call.** Where does it run? What does it return —
+   strings, document objects with metadata, raw search hits? Is the
+   returned content user-controllable (uploaded files, scraped pages,
+   external APIs) or fully internal-curated?
+
+2. **The LLM call that consumes the retrieved content.** How is the
+   retrieved text placed into the prompt — concatenated into a system
+   prompt, into a user-role message, into a `tools` description?
+
+3. **The path between retriever and LLM call.** Does any function in
+   that path perform validation? Look for:
+   - Imports / calls of guardrails libraries (`guardrails`, `nemoguardrails`,
+     `lakera`, `protectai`, `presidio`, `garak`, `llm-guard`)
+   - Functions with names like `validate*`, `sanitize*`, `factCheck*`,
+     `attributeSource*`, `verifyClaim*`, `checkInjection*`
+   - Source-attribution metadata being injected into the prompt
+     (e.g., `<source>doc-id-123</source>` blocks, citation markers the
+     model is required to use)
+   - Access-control filters that drop documents based on the requester
+
+4. **Whether what looks like validation actually validates.** A function
+   named `processDocuments` that just trims whitespace is NOT validation.
+   A logger call is NOT validation. A retry wrapper is NOT validation.
+
+## What does NOT count as a validator
+
+- Trimming, lowercasing, or other string normalization
+- Token counting or length capping (length limits aren't injection defenses)
+- A type assertion (`as string`) — TypeScript types don't run at runtime
+- An auth check that gates *whether the retrieval runs at all* but doesn't
+  inspect the *content* returned
+- A logger call — logs are observability, not defense
+- The model's own instructions ("don't follow embedded instructions") —
+  that's prompt hardening, easily bypassed; mark as `partial_validator`
+  not `validator_present`
+
+## What counts as a validator
+
+- A call to a guardrails / safety library between retrieval and model
+- A function that inspects retrieved content for prompt-injection
+  patterns and rejects / flags / strips matching documents
+- Source-attribution machinery: every retrieved doc carries a `sourceId`
+  the model is required to cite, and the calling code checks that the
+  source is permitted for this requester
+- Per-document access control applied AFTER retrieval, before the doc is
+  added to the prompt
+
+## What about query rewriting / HyDE / multi-query?
+
+If the query that drives retrieval is itself an LLM output (HyDE,
+multi-query, agentic retrieval), note this in `rationale`. It compounds
+the injection surface — the attacker can influence what gets retrieved
+two steps upstream — but it is NOT itself the missing validator. The
+verdict is about the retriever→model path.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "no_validator_present | validator_present | partial_validator | unclear",
+  "validator_location": "pre_retrieval | between_retriever_and_model | post_model | none | multiple",
+  "rationale": "one paragraph citing specific symbols / line numbers from the snippet",
+  "corpus_sources": ["uploaded_pdfs", "scraped_web_pages", "confluence_sync"],
+  "blast_radius": "single_endpoint | route_family | service_wide | agent_wide | unclear",
+  "recommended_controls": ["guardrails_library", "source_attribution_in_prompt"],
+  "evidence_spans": [
+    { "file": "src/rag.ts", "start_line": 14, "end_line": 38, "note": "retriever→model, no validator" }
+  ]
+}
+```
+
+### Verdict definitions
+
+- `no_validator_present` — retrieval feeds the model directly; nothing
+  between them inspects content.
+- `validator_present` — a real validator (per the "what counts" list)
+  sits between retriever and model.
+- `partial_validator` — something inspects content but with known gaps:
+  e.g., regex-only injection filter, or only one document type is
+  validated, or validation only runs in some branches. Use this when
+  there is *some* defense but it doesn't cover the full path.
+- `unclear` — the snippet doesn't show enough of the path to determine.
+  Don't guess. Surface what you'd need to see to decide.
+
+### Blast-radius guidance
+
+- `single_endpoint` — one route handler.
+- `route_family` — a helper / chain reused across a router.
+- `service_wide` — the retrieval helper is the shared way the service
+  answers questions.
+- `agent_wide` — an agent's tool-use path itself runs through this
+  retriever (more dangerous: agent can iterate on injections).
+
+Cite line numbers and symbol names from the snippet only. Do not invent
+files. If a control is named in code but you can't see its
+implementation, mark `unclear` and note which file you'd need.

package/dist/pattern-packs/zivis-public-0.2.0/prompts/security/late-org-filter/identify.md

@@ -0,0 +1,78 @@
+# Inference prompt: security.late-org-filter — identify
+
+You are reviewing a multi-tenant route handler, stream, or async iterator
+that has been flagged as *possibly* applying tenant scoping at the
+presentation layer rather than inside the data query. The pattern is one of
+the most common causes of cross-tenant data leaks in SaaS systems. Your job
+is to determine where in the stack the org/tenant filter actually lives.
+
+## What you are evaluating
+
+1. Where does the query that returns rows execute? Identify the call (raw
+   SQL, ORM method, repository call, fetch, etc.). Does its `WHERE` /
+   `where:` / equivalent clause include an org / tenant predicate?
+2. Where does the filter referencing `request.orgId` (or a session-scoped
+   tenant id) fire? In the query, in a middleware, in the response loop,
+   in the stream emit?
+3. Is there a row-level security policy, ORM middleware, or repository
+   pattern that *implicitly* scopes every query — even queries that don't
+   themselves mention tenant?
+4. For SSE / stream / async iterator responses: does the filter run per
+   emit, before any logging, tracing, or buffering hook?
+5. Does any logging or observability hook capture the row set BEFORE the
+   filter applies?
+
+## What does NOT count as data-layer scoping
+
+- A presentation-layer filter that "looks like" it's inside the query just
+  because it sits in the same function body. Trace where the SQL actually
+  runs.
+- A comment claiming the ORM is org-scoped without code enforcing it.
+- A type system that makes "OrgScopedQuery<T>" but is never actually
+  required at the call site.
+- An auth middleware that *checks* the user can access the org but does
+  not constrain what rows the subsequent query returns.
+
+## What counts as data-layer scoping
+
+- A `WHERE org_id = $1` (or equivalent) inside the query itself.
+- Postgres row-level security with a session GUC the connection sets.
+- Prisma extension / SQLAlchemy event listener / ORM middleware that
+  appends the predicate.
+- Repository pattern where the `findByX(ctx)` method takes the org from
+  `ctx` and mandates the predicate.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "late_filter_present | scoped_at_query | partial_scope | unclear",
+  "scope_location": "data_layer | query_layer | presentation_layer | multiple | none",
+  "rationale": "one paragraph",
+  "blast_radius": "single_endpoint | route_family | service_wide | unclear",
+  "recommended_controls": ["row_level_security", "query_helper"],
+  "evidence_spans": [
+    { "file": "routes/queue.ts", "start_line": 18, "end_line": 60, "note": "..." }
+  ]
+}
+```
+
+- `late_filter_present` — the query returns cross-tenant rows; the only
+  enforcement is at the response/emit layer.
+- `scoped_at_query` — the query itself filters by org/tenant; presentation
+  filter (if any) is defense in depth.
+- `partial_scope` — *some* queries are scoped at the data layer but at
+  least one in the path is not.
+- `unclear` — query plumbing crosses too many layers to determine from the
+  snippet. Don't guess.
+
+For `blast_radius`: estimate based on whether the unscoped query helper is
+used elsewhere. `service_wide` if the helper / repository method is shared
+across many routes; `route_family` if reused inside the same router;
+`single_endpoint` if isolated.
+
+Cite line numbers from the snippet only. Do not invent files. If a control
+(e.g. "RLS") is mentioned but you can't see the policy text, mark
+`unclear` and explain.

package/dist/project-binding.d.ts

@@ -1,25 +1,8 @@
-/**
- * Project Binding
- *
- * Detects and validates `.zivis/project.json` files that bind a project
- * directory to a specific ZIVIS session/org. This prevents accidentally
- * using the wrong org's MCP connection in a project.
- *
- * The binding file is optional — if absent, the server starts normally.
- * If present, the configured ZIVIS_SESSION must match the binding's
- * session field or the server refuses to start.
- */
 import type { ProjectBinding, ZivisConfig } from "./types.js";
-/**
- * Walk up from `cwd` looking for `.zivis/project.json`.
- * Returns the parsed binding or null if not found.
- */
 export declare function detectProjectBinding(cwd: string): {
     binding: ProjectBinding;
     filePath: string;
 } | null;
-/**
- * Validate that the project binding matches the current MCP session.
- * Exits with code 1 on mismatch.
- */
+export declare function resolveConfigFromBinding(cwd?: string): ZivisConfig;
+export declare function resolveMcpSessionForWorkspace(incoming: ZivisConfig, workspacePath: string, detected: ReturnType<typeof detectProjectBinding>, fromBinding: ZivisConfig): string;
 export declare function validateProjectBinding(binding: ProjectBinding, filePath: string, config: ZivisConfig): void;

package/dist/project-binding.js

@@ -1,22 +1,8 @@
-/**
- * Project Binding
- *
- * Detects and validates `.zivis/project.json` files that bind a project
- * directory to a specific ZIVIS session/org. This prevents accidentally
- * using the wrong org's MCP connection in a project.
- *
- * The binding file is optional — if absent, the server starts normally.
- * If present, the configured ZIVIS_SESSION must match the binding's
- * session field or the server refuses to start.
- */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { DEFAULT_CONFIG } from "./types.js";
 const BINDING_DIR = ".zivis";
 const BINDING_FILE = "project.json";
-/**
- * Walk up from `cwd` looking for `.zivis/project.json`.
- * Returns the parsed binding or null if not found.
- */
 export function detectProjectBinding(cwd) {
     let dir = path.resolve(cwd);
     const root = path.parse(dir).root;
@@ -41,12 +27,44 @@ export function detectProjectBinding(cwd) {
     }
     return null;
 }
-/**
- * Validate that the project binding matches the current MCP session.
- * Exits with code 1 on mismatch.
- */
+export function resolveConfigFromBinding(cwd) {
+    const detected = detectProjectBinding(cwd ?? process.cwd());
+    if (!detected)
+        return DEFAULT_CONFIG;
+    const { binding } = detected;
+    return {
+        ...DEFAULT_CONFIG,
+        ...(binding.session ? { session: binding.session } : {}),
+        ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
+        ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
+        ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
+        ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
+        ...(binding.configDir ? { configDir: binding.configDir } : {}),
+    };
+}
+export function resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding) {
+    const envSession = process.env.ZIVIS_SESSION?.trim();
+    if (envSession !== undefined && envSession !== "") {
+        if (envSession === "default" &&
+            detected?.binding.session &&
+            detected.binding.session !== "default") {
+            return detected.binding.session;
+        }
+        return envSession;
+    }
+    if (detected?.binding.session) {
+        return detected.binding.session;
+    }
+    if (incoming.session !== undefined && incoming.session !== "") {
+        return incoming.session;
+    }
+    if (fromBinding.session) {
+        return fromBinding.session;
+    }
+    return "default";
+}
 export function validateProjectBinding(binding, filePath, config) {
-    const currentSession = config.session || "default";
+    const currentSession = config.session ?? "default";
     const expectedSession = binding.session;
     if (currentSession !== expectedSession) {
         const orgLabel = binding.orgName
@@ -64,4 +82,3 @@ export function validateProjectBinding(binding, filePath, config) {
     const orgLabel = binding.orgName ? ` (${binding.orgName})` : "";
     console.error(`[zivis] Project binding verified: session "${expectedSession}"${orgLabel}`);
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/prompts/audit-dependencies.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAuditDependenciesPrompt(server: McpServer): void;

package/dist/prompts/audit-dependencies.js

@@ -0,0 +1,47 @@
+export function registerAuditDependenciesPrompt(server) {
+    server.registerPrompt("audit-dependencies", {
+        description: "Check the open source libraries this project depends on for security risks. No account setup needed.",
+        argsSchema: {},
+    }, async () => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `I want to check whether the open source libraries I'm using are safe.
+
+Please do the following:
+
+1. Look at the dependency files in this project. In priority order, check:
+   - package.json (look for the "dependencies" and "devDependencies" keys)
+   - requirements.txt or pyproject.toml
+   - go.mod
+   - Any other manifest files you can see
+
+2. From those files, find all external dependencies that have a GitHub repository.
+   - Skip internal packages (those starting with "@my-company/" or similar private namespaces).
+   - Skip built-in packages (e.g. node built-ins like "fs", "path").
+
+3. For each external dependency that has a public GitHub repo, call \`zivis_check_repo_trust\`
+   with the owner/repo string (e.g. "openai/openai-node").
+
+4. After checking each one, give me a summary table with columns:
+   - Package name
+   - Trust grade (A+ through F)
+   - Risk level (Safe / Low risk / Moderate / High / Critical)
+   - Any critical or high findings (one line each)
+
+5. Flag any package with grade C or below and explain in plain English why it's risky.
+
+6. At the end, suggest the two highest-priority actions to take based on the results.
+
+Ground rules:
+- Process dependencies one at a time so I can follow along.
+- If a package doesn't have a GitHub repo, skip it and say "(no GitHub repo found)".
+- Don't make up trust data — only use what zivis_check_repo_trust returns.
+- Speak in plain English. "High risk" is better than "critical severity threat vector".`,
+                },
+            },
+        ],
+    }));
+}

package/dist/prompts/getting-started.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerGettingStartedPrompt(server: McpServer): void;

package/dist/prompts/getting-started.js

@@ -0,0 +1,37 @@
+export function registerGettingStartedPrompt(server) {
+    server.registerPrompt("getting-started", {
+        description: "Walk me through ZIVIS for this project. Use this if you're new or unsure what to test.",
+        argsSchema: {},
+    }, async () => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `I want to use ZIVIS for security on this project but I'm not sure where to start.
+
+Please do the following, in order:
+
+1. Call \`zivis_check_project\` (no arguments) to confirm the project is connected correctly.
+   - If it returns any problems, explain them in plain English and tell me the exact terminal command to run to fix them. Stop here and wait for me.
+   - If it's OK, continue to step 2.
+
+2. Call \`zivis_get_started\` (no arguments).
+
+3. Present the \`recommended_next_steps\` from the response as a numbered list.
+   - Use the \`label\` as the item text.
+   - Add one sentence from the \`why\` field below each item.
+   - Do NOT invent additional steps or add security advice of your own.
+
+4. Ask me which number I want to do. Wait for my answer before calling anything else.
+
+Ground rules for this conversation:
+- I'm a developer, not a security person. Speak plainly.
+- Avoid these words unless I use them first: "actor", "attack vector", "threat model", "STRIDE", "kill chain", "TTPs".
+- Use plain alternatives: "tester", "how someone might break in", "security plan", "types of attacks".
+- If I seem unsure which option to pick, suggest the one flagged as \`if_user_unsure\` in the response.`,
+                },
+            },
+        ],
+    }));
+}