@zivis/mcp 0.1.8 → 0.1.11

package/dist/http-probe/capture.d.ts

@@ -0,0 +1,51 @@
+export interface CaptureRequestSpec {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string | Record<string, unknown> | unknown[];
+    label?: string;
+    timeoutMs?: number;
+}
+export interface CapturedRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string;
+    label?: string;
+}
+export interface CapturedResponse {
+    status: number;
+    status_text?: string;
+    headers: Record<string, string>;
+    body?: string;
+    body_json?: unknown;
+}
+export interface HttpCapture {
+    request: CapturedRequest;
+    response: CapturedResponse;
+    meta: {
+        captured_at: string;
+        duration_ms: number;
+        request_fingerprint: string;
+        redacted: boolean;
+        error?: string;
+    };
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    statusText?: string;
+    headers: {
+        forEach(cb: (value: string, key: string) => void): void;
+    };
+    text(): Promise<string>;
+}>;
+export declare function requestFingerprint(req: CapturedRequest): string;
+export declare function captureRequest(spec: CaptureRequestSpec, deps?: {
+    fetchImpl?: FetchLike;
+}): Promise<HttpCapture>;
+export declare function redactCapture(capture: HttpCapture): HttpCapture;

package/dist/http-probe/capture.js

@@ -0,0 +1,96 @@
+import * as crypto from "node:crypto";
+import { redactValue } from "../redact.js";
+function normalizeHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers ?? {}))
+        out[k.toLowerCase()] = String(v);
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+}
+function bodyToString(body) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    try {
+        return JSON.stringify(body);
+    }
+    catch {
+        return String(body);
+    }
+}
+export function requestFingerprint(req) {
+    const headerLines = Object.entries(req.headers)
+        .map(([k, v]) => `${k}: ${v}`)
+        .join("\n");
+    const canonical = `${req.method} ${req.url}\n${headerLines}\n\n${req.body ?? ""}`;
+    return crypto.createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+function tryJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function captureRequest(spec, deps = {}) {
+    const method = (spec.method ?? "GET").toUpperCase();
+    const headers = normalizeHeaders(spec.headers);
+    const body = bodyToString(spec.body);
+    const request = { method, url: spec.url, headers, body, label: spec.label };
+    const fingerprint = requestFingerprint(request);
+    const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), spec.timeoutMs ?? 30_000);
+    const started = Date.now();
+    try {
+        const res = await fetchImpl(spec.url, { method, headers, body, signal: controller.signal });
+        const respHeaders = {};
+        res.headers.forEach((value, key) => {
+            respHeaders[key.toLowerCase()] = value;
+        });
+        const text = await res.text();
+        const bodyJson = tryJson(text);
+        return {
+            request,
+            response: {
+                status: res.status,
+                status_text: res.statusText,
+                headers: Object.fromEntries(Object.entries(respHeaders).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))),
+                body: text,
+                body_json: bodyJson,
+            },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            request,
+            response: { status: 0, headers: {} },
+            meta: {
+                captured_at: new Date().toISOString(),
+                duration_ms: Date.now() - started,
+                request_fingerprint: fingerprint,
+                redacted: false,
+                error: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export function redactCapture(capture) {
+    const request = redactValue(capture.request).value;
+    const response = redactValue(capture.response).value;
+    return {
+        request,
+        response,
+        meta: { ...capture.meta, redacted: true },
+    };
+}

package/dist/http-probe/compare.d.ts

@@ -0,0 +1,43 @@
+import type { HttpCapture } from "./capture.js";
+export interface StatusComparison {
+    a: number;
+    b: number;
+    changed: boolean;
+}
+export interface JsonPathDiff {
+    path: string;
+    kind: "added" | "removed" | "changed";
+    a?: unknown;
+    b?: unknown;
+}
+export interface BodyComparison {
+    equal: boolean;
+    json_diffs?: JsonPathDiff[];
+    opaque_change?: boolean;
+}
+export interface HeaderDiff {
+    header: string;
+    kind: "added" | "removed" | "changed";
+    a?: string;
+    b?: string;
+}
+export type AccessSignal = "same_status" | "both_success" | "both_denied" | "access_differential" | "one_error" | "mixed";
+export interface CaptureComparison {
+    equal: boolean;
+    labels: {
+        a?: string;
+        b?: string;
+    };
+    status: StatusComparison;
+    headers: HeaderDiff[];
+    body: BodyComparison;
+    access_signal: AccessSignal;
+    summary: string;
+    same_request: boolean;
+}
+export interface CompareOptions {
+    headerAllowlist?: string[];
+    allHeaders?: boolean;
+}
+export declare function diffJson(a: unknown, b: unknown, basePath?: string): JsonPathDiff[];
+export declare function compareCaptures(a: HttpCapture, b: HttpCapture, opts?: CompareOptions): CaptureComparison;

package/dist/http-probe/compare.js

@@ -0,0 +1,117 @@
+const VOLATILE_HEADERS = new Set([
+    "date",
+    "age",
+    "etag",
+    "last-modified",
+    "expires",
+    "set-cookie",
+    "x-request-id",
+    "x-correlation-id",
+    "cf-ray",
+    "x-amz-request-id",
+    "x-amz-id-2",
+    "x-served-by",
+    "x-timer",
+    "x-runtime",
+    "server-timing",
+    "content-length",
+]);
+function isDenied(status) {
+    return status === 401 || status === 403;
+}
+function isSuccess(status) {
+    return status >= 200 && status < 300;
+}
+function isError(status) {
+    return status === 0 || status >= 500;
+}
+function classifyAccess(a, b) {
+    if (isError(a) || isError(b))
+        return "one_error";
+    if (isSuccess(a) && isSuccess(b))
+        return "both_success";
+    if (isDenied(a) && isDenied(b))
+        return "both_denied";
+    if ((isSuccess(a) && isDenied(b)) || (isDenied(a) && isSuccess(b)))
+        return "access_differential";
+    if (a === b)
+        return "same_status";
+    return "mixed";
+}
+function diffHeaders(a, b, opts) {
+    const allow = opts.headerAllowlist ? new Set(opts.headerAllowlist.map((h) => h.toLowerCase())) : null;
+    const keep = (h) => (allow ? allow.has(h) : opts.allHeaders ? true : !VOLATILE_HEADERS.has(h));
+    const keys = new Set([...Object.keys(a), ...Object.keys(b)].filter(keep));
+    const out = [];
+    for (const h of [...keys].sort()) {
+        const av = a[h];
+        const bv = b[h];
+        if (av === bv)
+            continue;
+        if (av === undefined)
+            out.push({ header: h, kind: "added", b: bv });
+        else if (bv === undefined)
+            out.push({ header: h, kind: "removed", a: av });
+        else
+            out.push({ header: h, kind: "changed", a: av, b: bv });
+    }
+    return out;
+}
+export function diffJson(a, b, basePath = "$") {
+    const diffs = [];
+    const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    if (Array.isArray(a) && Array.isArray(b)) {
+        const max = Math.max(a.length, b.length);
+        for (let i = 0; i < max; i++) {
+            const p = `${basePath}[${i}]`;
+            if (i >= a.length)
+                diffs.push({ path: p, kind: "added", b: b[i] });
+            else if (i >= b.length)
+                diffs.push({ path: p, kind: "removed", a: a[i] });
+            else
+                diffs.push(...diffJson(a[i], b[i], p));
+        }
+        return diffs;
+    }
+    if (isObj(a) && isObj(b)) {
+        const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+        for (const k of [...keys].sort()) {
+            const p = `${basePath}.${k}`;
+            if (!(k in a))
+                diffs.push({ path: p, kind: "added", b: b[k] });
+            else if (!(k in b))
+                diffs.push({ path: p, kind: "removed", a: a[k] });
+            else
+                diffs.push(...diffJson(a[k], b[k], p));
+        }
+        return diffs;
+    }
+    if (JSON.stringify(a) !== JSON.stringify(b)) {
+        diffs.push({ path: basePath, kind: "changed", a, b });
+    }
+    return diffs;
+}
+function compareBodies(a, b) {
+    const aHasJson = a.body_json !== undefined;
+    const bHasJson = b.body_json !== undefined;
+    if (aHasJson && bHasJson) {
+        const json_diffs = diffJson(a.body_json, b.body_json);
+        return { equal: json_diffs.length === 0, json_diffs };
+    }
+    const equal = (a.body ?? "") === (b.body ?? "");
+    return { equal, opaque_change: !equal };
+}
+export function compareCaptures(a, b, opts = {}) {
+    const status = { a: a.response.status, b: b.response.status, changed: a.response.status !== b.response.status };
+    const headers = diffHeaders(a.response.headers, b.response.headers, opts);
+    const body = compareBodies(a.response, b.response);
+    const access_signal = classifyAccess(a.response.status, b.response.status);
+    const same_request = a.meta.request_fingerprint === b.meta.request_fingerprint;
+    const equal = !status.changed && headers.length === 0 && body.equal;
+    const la = a.request.label ?? "A";
+    const lb = b.request.label ?? "B";
+    const summary = equal
+        ? `${la} and ${lb} are equivalent (status ${status.a}, no header/body differences).`
+        : `${la}=${status.a} vs ${lb}=${status.b}; ${headers.length} header diff(s), body ${body.equal ? "identical" : "differs"}; access_signal=${access_signal}.`;
+    return { equal, labels: { a: a.request.label, b: b.request.label }, status, headers, body, access_signal, summary, same_request };
+}

package/dist/http-probe/index.d.ts

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, type CaptureRequestSpec, type CapturedRequest, type CapturedResponse, type HttpCapture, type FetchLike, } from "./capture.js";
+export { compareCaptures, diffJson, type CaptureComparison, type CompareOptions, type StatusComparison, type BodyComparison, type HeaderDiff, type JsonPathDiff, type AccessSignal, } from "./compare.js";

package/dist/http-probe/index.js

@@ -0,0 +1,2 @@
+export { captureRequest, redactCapture, requestFingerprint, } from "./capture.js";
+export { compareCaptures, diffJson, } from "./compare.js";

package/dist/index.d.ts

@@ -1,8 +1,2 @@
 #!/usr/bin/env node
-/**
- * ZIVIS MCP Security Server — Entry Point
- *
- * CLI tool and MCP server for AI-assisted security finding remediation.
- * Connects AI coding assistants to the ZIVIS security platform.
- */
 export {};

package/dist/index.js

@@ -1,10 +1,4 @@
 #!/usr/bin/env node
-/**
- * ZIVIS MCP Security Server — Entry Point
- *
- * CLI tool and MCP server for AI-assisted security finding remediation.
- * Connects AI coding assistants to the ZIVIS security platform.
- */
 import { parseArgs, runCli } from "./cli.js";
 import { DEFAULT_CONFIG } from "./types.js";
 const { command, options } = parseArgs(process.argv);
@@ -12,4 +6,3 @@ runCli(command, options, DEFAULT_CONFIG).catch((err) => {
     console.error("Fatal error:", err instanceof Error ? err.message : err);
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map

package/dist/lib/inspect-cache.d.ts

@@ -0,0 +1,10 @@
+export interface LocatedArtifact {
+    path: string;
+    mtimeMs: number;
+}
+export declare function userCacheRoot(): string;
+export declare function deriveRepoId(cwd: string): Promise<string>;
+export declare function locateLatestArtifact(cwd: string): Promise<LocatedArtifact | undefined>;
+export declare const DEFAULT_INSPECT_CACHE_TTL_MS: number;
+export declare function inspectCacheTtlMs(): number;
+export declare function isFresh(mtimeMs: number, now?: number): boolean;

package/dist/lib/inspect-cache.js

@@ -0,0 +1,75 @@
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+const execAsync = promisify(exec);
+export function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+export async function deriveRepoId(cwd) {
+    const remote = await tryGit(cwd, "remote get-url origin");
+    if (remote) {
+        return "remote-" + sha256Short(remote);
+    }
+    return "path-" + sha256Short(cwd);
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+export async function locateLatestArtifact(cwd) {
+    const repoId = await deriveRepoId(cwd);
+    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
+    if (!fssync.existsSync(runsDir))
+        return undefined;
+    const candidates = [];
+    for (const entry of await fs.readdir(runsDir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const full = path.join(runsDir, entry);
+        try {
+            const stat = await fs.stat(full);
+            candidates.push({ path: full, mtimeMs: stat.mtimeMs });
+        }
+        catch {
+        }
+    }
+    if (candidates.length === 0)
+        return undefined;
+    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return candidates[0];
+}
+export const DEFAULT_INSPECT_CACHE_TTL_MS = 15 * 60 * 1000;
+export function inspectCacheTtlMs() {
+    const raw = process.env.ZIVIS_INSPECT_CACHE_TTL_MS;
+    if (!raw)
+        return DEFAULT_INSPECT_CACHE_TTL_MS;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return DEFAULT_INSPECT_CACHE_TTL_MS;
+    return parsed;
+}
+export function isFresh(mtimeMs, now = Date.now()) {
+    return now - mtimeMs <= inspectCacheTtlMs();
+}

package/dist/lib/next-steps.d.ts

@@ -0,0 +1,27 @@
+export interface NextStep {
+    id: string;
+    label: string;
+    tool: string;
+    args_hint?: Record<string, unknown>;
+    why: string;
+    requires_tier?: "free" | "pro" | "enterprise";
+}
+export interface ZivisToolPayload<T> {
+    result: T;
+    next_steps?: NextStep[];
+    summary?: string;
+}
+export declare function withNextSteps<T>(result: T, nextSteps: NextStep[], summary?: string): {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+export declare function withNextStepsError(message: string, nextSteps: NextStep[], summary?: string): {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError: true;
+};

package/dist/lib/next-steps.js

@@ -0,0 +1,21 @@
+export function withNextSteps(result, nextSteps, summary) {
+    const payload = {
+        result,
+        next_steps: nextSteps,
+        ...(summary ? { summary } : {}),
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    };
+}
+export function withNextStepsError(message, nextSteps, summary) {
+    const payload = {
+        result: { error: message },
+        next_steps: nextSteps,
+        ...(summary ? { summary } : {}),
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+        isError: true,
+    };
+}

package/dist/matcher/ast-eval.d.ts

@@ -0,0 +1,8 @@
+export type AstLanguage = "typescript" | "javascript" | "python" | "go";
+export interface AstMatch {
+    file: string;
+    start_line: number;
+    end_line: number;
+    matched_text: string;
+}
+export declare function evaluateAstStrategy(expression: unknown, language: AstLanguage, files: string[], rootDir: string): Promise<AstMatch[]>;

package/dist/matcher/ast-eval.js

@@ -0,0 +1,95 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+import * as napi from "@ast-grep/napi";
+let registered = false;
+async function ensureLanguagesRegistered() {
+    if (registered)
+        return;
+    const py = (await import("@ast-grep/lang-python")).default;
+    const go = (await import("@ast-grep/lang-go")).default;
+    napi.registerDynamicLanguage({ python: py, go: go });
+    registered = true;
+}
+export async function evaluateAstStrategy(expression, language, files, rootDir) {
+    await ensureLanguagesRegistered();
+    const rule = normalizeExpressionToRule(expression);
+    if (!rule)
+        return [];
+    const matches = [];
+    const langKey = languageKey(language);
+    for (const file of files) {
+        let raw;
+        try {
+            raw = await fs.readFile(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (!raw)
+            continue;
+        let root;
+        try {
+            root = napi.parse(langKey, raw);
+        }
+        catch {
+            continue;
+        }
+        let foundNodes;
+        try {
+            foundNodes = root.root().findAll(rule);
+        }
+        catch {
+            continue;
+        }
+        for (const node of foundNodes) {
+            const range = node.range();
+            matches.push({
+                file: relPosix(rootDir, file),
+                start_line: (range.start.line ?? 0) + 1,
+                end_line: (range.end.line ?? 0) + 1,
+                matched_text: truncate(node.text(), 240),
+            });
+        }
+    }
+    return matches;
+}
+function normalizeExpressionToRule(expression) {
+    if (typeof expression === "string") {
+        try {
+            return ensureRuleWrapper(yaml.load(expression));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (expression && typeof expression === "object") {
+        return ensureRuleWrapper(expression);
+    }
+    return undefined;
+}
+function ensureRuleWrapper(parsed) {
+    if (!parsed || typeof parsed !== "object")
+        return parsed;
+    const obj = parsed;
+    if ("rule" in obj)
+        return obj;
+    return { rule: obj };
+}
+function languageKey(lang) {
+    switch (lang) {
+        case "typescript": return "ts";
+        case "javascript": return "js";
+        case "python": return "python";
+        case "go": return "go";
+    }
+}
+function relPosix(rootDir, abs) {
+    const rel = path.relative(rootDir, abs);
+    return rel.split(path.sep).join("/");
+}
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max) + "…";
+}

package/dist/matcher/finding.d.ts

@@ -0,0 +1,55 @@
+export type Lane = "trusted" | "inferred";
+export interface MatchedEvidence {
+    file: string;
+    start_line: number;
+    end_line?: number;
+    matched_text?: string;
+    strategy_code: string;
+}
+export interface FiredStrategy {
+    code: string;
+    language?: string;
+    trusted: boolean;
+    confidence_weight: number;
+    match_count: number;
+}
+export interface InferenceCandidate {
+    prompt_ref: string;
+    expected_output_schema?: unknown;
+    minimum_context_required?: {
+        lines?: number;
+        symbols?: string[];
+    };
+    reason: string;
+}
+export interface Finding {
+    pattern_id: string;
+    pattern_version: string;
+    lane: Lane;
+    confidence: number;
+    fired_strategies: FiredStrategy[];
+    evidence: MatchedEvidence[];
+    inference_candidate?: InferenceCandidate;
+    safe_summary?: string;
+    threats?: unknown[];
+    repair_contract?: unknown;
+}
+export interface MatcherSummary {
+    trusted_count: number;
+    inferred_count: number;
+    total: number;
+}
+export interface MatcherResult {
+    pack: {
+        id: string;
+        version: string;
+    };
+    artifact_path: string;
+    cwd: string;
+    capsules_relevant: number;
+    capsules_evaluated: number;
+    ast_files_scanned: number;
+    duration_ms: number;
+    summary: MatcherSummary;
+    findings: Finding[];
+}

package/dist/matcher/finding.js

@@ -0,0 +1 @@
+export {};

package/dist/matcher/index.d.ts

@@ -0,0 +1,8 @@
+import type { MatcherResult } from "./finding.js";
+export type { Finding, FiredStrategy, MatchedEvidence, MatcherResult, Lane } from "./finding.js";
+export interface RunMatcherOpts {
+    artifactPath: string;
+    cwd: string;
+    packId?: string;
+}
+export declare function runMatcher(opts: RunMatcherOpts): Promise<MatcherResult>;