@zivis/mcp 0.1.8 → 0.1.11

package/dist/pattern-packs/zivis-public-0.2.0/controls/fact_validator_present.yaml

@@ -0,0 +1,68 @@
+# Control: fact_validator_present
+# Referenced by:
+#   - retrieval.context-injection-no-validator (META: none_of_controls)
+#
+# A validator that inspects retrieved or LLM-generated content for
+# prompt-injection patterns, factual inconsistency, or policy violations
+# before the content reaches the model (or the user). Presence of any of
+# the well-known guardrails libraries OR a custom validator with a
+# recognizable name counts.
+
+id: fact_validator_present
+description: >
+  A validator step that inspects content for injection / hallucination /
+  policy violations between the data source (retriever, tool, user input)
+  and the model — or between the model and the user. Either a recognizable
+  third-party guardrails library or a custom validator with a clear name.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Third-party guardrails libraries (presence of the import or call)
+        - pattern: from "guardrails"
+        - pattern: from "@guardrails-ai/core"
+        - pattern: from "nemoguardrails"
+        - pattern: from "@nvidia/nemo-guardrails"
+        - pattern: from "lakera-guard"
+        - pattern: from "@lakera/guard"
+        - pattern: from "llm-guard"
+        - pattern: from "@protectai/llm-guard"
+        - pattern: from "presidio-analyzer"
+        # Conventional function names — broad on purpose so customer
+        # codebases register when they roll their own
+        - pattern: validateRetrievedContent($$$)
+        - pattern: validateContent($$$)
+        - pattern: factCheck($$$)
+        - pattern: checkForInjection($$$)
+        - pattern: sanitizeRetrieved($$$)
+        - pattern: detectPromptInjection($$$)
+        - pattern: $_.validate($DOCS)
+        - pattern: $_.guard($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: import guardrails
+        - pattern: from guardrails import $$$
+        - pattern: import nemoguardrails
+        - pattern: from nemoguardrails import $$$
+        - pattern: import lakera_guard
+        - pattern: from lakera_guard import $$$
+        - pattern: import llm_guard
+        - pattern: from llm_guard import $$$
+        - pattern: from presidio_analyzer import $$$
+        # Conventional function names
+        - pattern: validate_retrieved_content($$$)
+        - pattern: validate_content($$$)
+        - pattern: fact_check($$$)
+        - pattern: check_for_injection($$$)
+        - pattern: sanitize_retrieved($$$)
+        - pattern: detect_prompt_injection($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/human_approval_gate.yaml

@@ -0,0 +1,44 @@
+# Control: human_approval_gate
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#   - agents.privilege-separation (potential — high-impact tool dispatch)
+#
+# Defines what "the codebase has a human-in-the-loop approval before
+# committing a high-impact action" looks like. Detection is intentionally
+# fuzzy — we'd rather over-detect approval gates (and miss firing META)
+# than under-detect (and fire false-positive findings).
+
+id: human_approval_gate
+description: >
+  Detects code that pauses execution to wait for human approval before
+  committing a high-impact action. Common shapes: humanInTheLoop helpers,
+  LangGraph interrupts, await-on-approval queue reads, request-confirmation
+  prompts.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        - pattern: humanInTheLoop($$$)
+        - pattern: humanApproval($$$)
+        - pattern: requireApproval($$$)
+        - pattern: await $_.waitForApproval($$$)
+        - pattern: await $_.awaitApproval($$$)
+        - pattern: $_.interrupt($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: human_in_the_loop($$$)
+        - pattern: human_approval($$$)
+        - pattern: require_approval($$$)
+        - pattern: wait_for_user($$$)
+        - pattern: await_approval($$$)
+        - pattern: $_.interrupt($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/langgraph_state_machine_with_per_node_tools.yaml

@@ -0,0 +1,35 @@
+# Control: langgraph_state_machine_with_per_node_tools
+# Referenced by:
+#   - agents.privilege-separation (META: none_of_controls)
+#
+# LangGraph's idiom for privilege separation: a StateGraph with multiple
+# nodes, each binding a different (smaller) tool set. When present, the
+# capsule's anti-pattern (one shared tool list) is mitigated.
+
+id: langgraph_state_machine_with_per_node_tools
+description: >
+  LangGraph StateGraph with multiple add_node calls — each node typically
+  binds its own tools. Even imperfect detection of LangGraph node-graph
+  construction is enough to suppress the capsule's META rule, since the
+  customer is clearly using the right idiom.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: python
+    rule:
+      any:
+        - pattern: $_.add_node($$$)
+        - pattern: StateGraph($$$)
+        - pattern: builder.add_node($$$)
+  - language: typescript
+    rule:
+      any:
+        - pattern: $_.addNode($$$)
+        - pattern: new StateGraph($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/per_sample_retrieval_diversification.yaml

@@ -0,0 +1,38 @@
+# Control: per_sample_retrieval_diversification
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#
+# Different samples in a self-consistency loop pull from different
+# retrieval queries / different stores / different rerank seeds, instead
+# of all sharing the same RAG context.
+
+id: per_sample_retrieval_diversification
+description: >
+  When a self-consistency aggregator pulls retrieval per-sample from
+  varied queries (i.e. retrieval is INSIDE the per-sample lambda, not
+  hoisted above the loop). The shape is a .map over generation function
+  that itself contains a similaritySearch / vectorStore call.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      pattern: $_.similaritySearch($$$)
+      inside:
+        stopBy: end
+        any:
+          - pattern: $_.map($$$)
+          - kind: for_statement
+  - language: python
+    rule:
+      pattern: $_.similarity_search($$$)
+      inside:
+        stopBy: end
+        kind: for_statement
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/prisma_extension_or_middleware_attaching_org_filter.yaml

@@ -0,0 +1,31 @@
+# Control: prisma_extension_or_middleware_attaching_org_filter
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# A Prisma extension (or legacy $use middleware) that automatically appends
+# a where-clause scoping every query by org/tenant. When present, the
+# late-filter pattern is defense in depth, not the primary control.
+
+id: prisma_extension_or_middleware_attaching_org_filter
+description: >
+  Prisma client extension (post-5.x) or legacy $use middleware that injects
+  org/tenant scoping into every query. Detected by the call shape that
+  registers the extension/middleware referencing org_id, orgId, or tenant_id.
+
+applicable_languages:
+  - typescript
+  - javascript
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Modern Prisma client extension intercepting query operations
+        - pattern: "$_.$$extends({ query: $$$ })"
+        - pattern: "prisma.$$extends($$$)"
+        # Legacy Prisma middleware
+        - pattern: "$_.$$use($$$)"
+        - pattern: "prisma.$$use($$$)"
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/row_level_security_policy.yaml

@@ -0,0 +1,37 @@
+# Control: row_level_security_policy
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# Detection of Postgres RLS policies in the codebase — either authored as
+# SQL migration text inside a string literal, or invoked via session GUC
+# setters that scope the connection by tenant.
+
+id: row_level_security_policy
+description: >
+  Postgres row-level security policy authored in the codebase, or session
+  GUCs that scope a connection by tenant for the duration of a request.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # SET LOCAL app.org_id pattern (per-request connection scoping)
+        - pattern: $_.$$queryRaw`SET LOCAL $$$`
+        - pattern: $_.$$executeRaw`SET LOCAL $$$`
+        # Common helpers
+        - pattern: setRlsContext($$$)
+        - pattern: setOrgContext($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: $_.execute("SET LOCAL $$$")
+        - pattern: set_rls_context($$$)
+        - pattern: set_org_context($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/source_attribution_present.yaml

@@ -0,0 +1,58 @@
+# Control: source_attribution_present
+# Referenced by:
+#   - retrieval.context-injection-no-validator (META: none_of_controls)
+#
+# A pattern where retrieved documents carry source-identifier metadata
+# the model is required to surface (citations) and / or the calling code
+# uses to apply access control after retrieval. Either flavor counts —
+# the point is that the corpus is not treated as an undifferentiated
+# trusted blob.
+
+id: source_attribution_present
+description: >
+  Retrieved documents carry source-identifier metadata that flows into
+  the prompt as required citations, OR into a post-retrieval access /
+  trust filter. Presence of either flavor is treated as evidence that
+  the corpus is not being treated as an undifferentiated trusted blob.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Citation-style: doc IDs / sources embedded in prompt template
+        - pattern: $_.sourceId
+        - pattern: $_.source_id
+        - pattern: $_.citation
+        - pattern: $_.sourceUrl
+        - pattern: $_.documentId
+        # Post-retrieval access filter
+        - pattern: filterByAccess($$$)
+        - pattern: filterBySourceAccess($$$)
+        - pattern: filterRetrievedByPermission($$$)
+        - pattern: checkDocumentAccess($$$)
+        - pattern: assertSourceAllowed($$$)
+        # LangChain-style citation chains
+        - pattern: createCitationsChain($$$)
+        - pattern: new SourceAttributedRetrievalChain($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: $_.source_id
+        - pattern: $_.citation
+        - pattern: $_.source_url
+        - pattern: $_.document_id
+        - pattern: filter_by_access($$$)
+        - pattern: filter_by_source_access($$$)
+        - pattern: filter_retrieved_by_permission($$$)
+        - pattern: check_document_access($$$)
+        - pattern: assert_source_allowed($$$)
+        # LangChain
+        - pattern: create_citations_chain($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -0,0 +1,167 @@
+{
+  "schema_version": "1.0.0",
+  "pack_id": "zivis-public",
+  "pack_name": "ZIVIS Public Pattern Pack",
+  "version": "0.2.0",
+  "built_at": "2026-08-31T22:32:10.810Z",
+  "tier": "customer_safe",
+  "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
+  "capsules": [
+    {
+      "id": "agents.privilege-separation",
+      "version": "0.1.0",
+      "path": "capsules/agents/privilege-separation.yaml",
+      "sha256": "716f9c766add6f51eac2568eefc328a030901520cf0d3098ed577651c98773ea",
+      "category": "agents",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prompting.self-consistency-no-isolation",
+      "version": "0.1.0",
+      "path": "capsules/prompting/self-consistency-no-isolation.yaml",
+      "sha256": "e1b11e02f7d13cfaeb8ed7f8ae7cae05062bcf8e6fbb226eed75e8bf7fa6e8d1",
+      "category": "prompting",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "retrieval.context-injection-no-validator",
+      "version": "0.1.0",
+      "path": "capsules/retrieval/context-injection-no-validator.yaml",
+      "sha256": "cb7ea3851894a946e34ab62ca42d1cce0a6f43c893f38cfd593b8daf32462fd8",
+      "category": "retrieval",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "security.late-org-filter",
+      "version": "0.1.0",
+      "path": "capsules/security/late-org-filter.yaml",
+      "sha256": "aeb9b327be936770ea6d208f6e687ae095a79976770e47b27ce5c97df3e43a3b",
+      "category": "security",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python",
+        "go"
+      ]
+    }
+  ],
+  "prompts": [
+    {
+      "path": "prompts/agents/privilege-separation/identify.md",
+      "sha256": "eda7d288f9d1c6f7dfc18d2856300df76e8c4fdb5f18f3490f39ddf7117853e4",
+      "capsule_id": "agents.privilege-separation"
+    },
+    {
+      "path": "prompts/prompting/self-consistency-no-isolation/identify.md",
+      "sha256": "e05ffb777550a2a79b3c5b8e75d3e3c7fb2da2cd43ab0fcf202a9eda0f29c10f",
+      "capsule_id": "prompting.self-consistency-no-isolation"
+    },
+    {
+      "path": "prompts/retrieval/context-injection-no-validator/identify.md",
+      "sha256": "31c0d67ffddc75e2d024eead7977c0b47342b4804663598f170aaabf24a5ed39",
+      "capsule_id": "retrieval.context-injection-no-validator"
+    },
+    {
+      "path": "prompts/security/late-org-filter/identify.md",
+      "sha256": "8e602179572ace5d457f8582b67e9d6ab29c675e82964481848c95e5ccb83e1e",
+      "capsule_id": "security.late-org-filter"
+    }
+  ],
+  "controls": [
+    {
+      "id": "external_validator_on_facts",
+      "path": "controls/external_validator_on_facts.yaml",
+      "sha256": "17ec428bf4cfc55b9f464d5c34e7a1ccc854a6c5822e1a4f6848db53ab3bccce",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "fact_validator_present",
+      "path": "controls/fact_validator_present.yaml",
+      "sha256": "4f7be51328f9a73be7846601a2aa2991364ed88bc2ae43a29ee0f0b4bc69da5f",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "human_approval_gate",
+      "path": "controls/human_approval_gate.yaml",
+      "sha256": "ccafcb0bbf0fc68bb02fd018f87a870471fa4653363459293a24f0a65dc53b99",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "langgraph_state_machine_with_per_node_tools",
+      "path": "controls/langgraph_state_machine_with_per_node_tools.yaml",
+      "sha256": "29b46ad213173c52b5d96f744d74179193e61a6dc9c43e6b0b94b013ec94a32c",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "per_sample_retrieval_diversification",
+      "path": "controls/per_sample_retrieval_diversification.yaml",
+      "sha256": "9b4db7c6d620f46e93887f793a3e77bdabe280521b5ce0320d84d0c6b31ae653",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prisma_extension_or_middleware_attaching_org_filter",
+      "path": "controls/prisma_extension_or_middleware_attaching_org_filter.yaml",
+      "sha256": "196676bebd107c4345a5f9227380982e5e2da0f2a8ad87e48517b5bd924abc31",
+      "applicable_languages": [
+        "typescript",
+        "javascript"
+      ]
+    },
+    {
+      "id": "row_level_security_policy",
+      "path": "controls/row_level_security_policy.yaml",
+      "sha256": "42d2a6f561a89b6dae80f04e25c65081fb22b660a59920e1f5c0ed438f394c68",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "source_attribution_present",
+      "path": "controls/source_attribution_present.yaml",
+      "sha256": "302c74045965b5452f5088b18cb86bf77a89f2de3a78015bf57d2845180b9465",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    }
+  ]
+}

package/dist/pattern-packs/zivis-public-0.2.0/prompts/agents/privilege-separation/identify.md

@@ -0,0 +1,54 @@
+# Inference prompt: agents.privilege-separation — identify
+
+You are assisting with secure agentic-AI architecture review. The user is
+working on a codebase that has been flagged by deterministic detectors as
+*possibly* lacking privilege separation between agents. Your job is to
+look at the attached code context and produce a structured verdict.
+
+## Pattern definition
+
+**Privilege separation** means each agent in a multi-agent system is bound
+only to the minimum tools required for its role. The anti-pattern is a
+single shared tool registry that every agent inherits.
+
+## What you are evaluating
+
+1. Does the code construct two or more agents (or two or more entry points
+   that invoke the same agent factory) with a **shared** tool array?
+2. Is there a per-agent capability filter, authorization layer, or
+   capability-token check between an agent and its tool dispatch? If so,
+   the pattern does *not* fire even when tools appear shared.
+3. If LangGraph is used: are tools bound per node (good), or is one tool
+   list passed to a top-level `create_react_agent` covering every node
+   (anti-pattern)?
+
+## What does NOT count as privilege separation
+
+- Comments mentioning least privilege without code enforcing it.
+- A shared tool list with one agent renamed at runtime.
+- Defensive prompt instructions ("don't use the database tool unless…")
+  — prompts are not authorization.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "absent | present | unclear",
+  "confidence": 0.0,
+  "rationale": "one paragraph",
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `verdict: absent` — the anti-pattern fires (shared registry, no scoping).
+- `verdict: present` — privilege separation is correctly implemented.
+- `verdict: unclear` — the available context is ambiguous; do not guess.
+
+Cite line numbers from the snippet only. Do not invent files. Do not
+fabricate evidence. If a concept (e.g. "authorization layer") is mentioned
+but you cannot identify the line that implements it, mark `unclear` and
+explain.

package/dist/pattern-packs/zivis-public-0.2.0/prompts/prompting/self-consistency-no-isolation/identify.md

@@ -0,0 +1,60 @@
+# Inference prompt: prompting.self-consistency-no-isolation — identify
+
+You are reviewing code that has been flagged as *possibly* aggregating multiple
+LLM samples without context isolation. Your job is to determine whether each
+sample actually sees independent context, or whether they all share the same
+input — making the aggregation a confidence-amplifier rather than a
+confidence-filter.
+
+## What you are evaluating
+
+1. How many LLM completion calls happen for one user request? Identify the
+   loop, `Promise.all`, list comprehension, or fan-out construct.
+2. Does each sample receive the **same** `messages` / prompt argument verbatim,
+   or is there per-sample variation (different retrieval query, different
+   temperature, different seed, different context window)?
+3. How is the result aggregated? Voting, ranking, similarity-based merging,
+   first-passing-validator, or simple averaging?
+4. Is there an external check on the aggregated output — e.g. a fact validator,
+   tool-output validation, human approval gate?
+5. Does the user-facing surface advertise the vote count as a "confidence"
+   number? That's the strongest tell that independence is being assumed.
+
+## What does NOT count as context isolation
+
+- Different agent *names* with the same prompt and same retrieval.
+- Comments saying "ensemble" without per-sample variation in the call.
+- Setting `n=N` on a single OpenAI completion call (the model produces N
+  samples but they share the entire prompt and context — same problem).
+- Different temperatures on every sample WITH the same retrieval — partial
+  mitigation but not full isolation; mark `unclear` and explain.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "independence_assessment": "shared_context | isolated_context | unclear",
+  "confidence_claim_risk": "high | medium | low",
+  "rationale": "one paragraph",
+  "recommended_controls": [
+    "per_sample_retrieval_diversification",
+    "external_validator",
+    "human_approval"
+  ],
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `shared_context` — every sample sees identical input. The vote is
+  amplifying rather than filtering. `confidence_claim_risk` should be `high`
+  if any user-facing label calls the vote count a confidence.
+- `isolated_context` — per-sample retrieval, temperature, or seed variation
+  IS present. The aggregation is doing real work.
+- `unclear` — context plumbing is too complex to determine from the snippet,
+  or the code uses a custom aggregator. Don't guess; ask in the rationale.
+
+Cite line numbers from the snippet only. Do not fabricate evidence.