@zivis/mcp 0.2.5 → 0.2.7

package/dist/pattern-packs/zivis-public-0.2.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.2.0",
-  "built_at": "2026-09-11T19:55:22.156Z",
+  "built_at": "2026-09-13T20:31:19.033Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/server.js

@@ -51,7 +51,6 @@ import { MEMORY_NAME, MEMORY_DESCRIPTION, MEMORY_SCHEMA, createMemoryHandler, }
 import { RUN_START_NAME, RUN_START_DESCRIPTION, RUN_START_SCHEMA, createRunStartHandler, RUN_NAME, RUN_DESCRIPTION, RUN_SCHEMA, createRunHandler, } from "./tools/devx-run.js";
 import { CHECK_PROJECT_NAME, CHECK_PROJECT_DESCRIPTION, CHECK_PROJECT_SCHEMA, createCheckProjectHandler, } from "./tools/check-project.js";
 import { GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler } from "./tools/enterprise/get-org-zat.js";
-import { OPEN_IN_IDE_NAME, OPEN_IN_IDE_DESCRIPTION, OPEN_IN_IDE_SCHEMA, createOpenInIdeHandler, } from "./tools/open-in-ide.js";
 export async function startServer(incoming = DEFAULT_CONFIG) {
     const workspacePath = incoming.workspacePath ?? process.cwd();
     const detected = detectProjectBinding(workspacePath);
@@ -114,7 +113,6 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
     server.registerTool(MEMORY_NAME, { description: MEMORY_DESCRIPTION, inputSchema: MEMORY_SCHEMA }, createMemoryHandler(apiClient));
     server.registerTool(RUN_START_NAME, { description: RUN_START_DESCRIPTION, inputSchema: RUN_START_SCHEMA }, createRunStartHandler(apiClient));
     server.registerTool(RUN_NAME, { description: RUN_DESCRIPTION, inputSchema: RUN_SCHEMA }, createRunHandler(apiClient));
-    server.registerTool(OPEN_IN_IDE_NAME, { description: OPEN_IN_IDE_DESCRIPTION, inputSchema: OPEN_IN_IDE_SCHEMA }, createOpenInIdeHandler());
     server.registerTool(CHECK_PROJECT_NAME, {
         description: CHECK_PROJECT_DESCRIPTION,
         inputSchema: CHECK_PROJECT_SCHEMA,

package/dist/tools/devx-run.js

@@ -97,9 +97,12 @@ const ItemArraySchema = z
 export const RUN_SCHEMA = {
     action: z.enum(["report", "complete", "cancel"]).describe("Which run-lifecycle operation to perform"),
     run_id: z.string().min(1).describe("The runId returned by zivis_run_start. Must still be pending for report/complete."),
-    findings: ItemArraySchema.describe("Finding items — same shape as result.findings[] (title, severity, description, category, cweId, owaspId, disposition: 'open'|'fixed', ...). report only."),
+    findings: ItemArraySchema.describe("Finding items — same shape as result.findings[] (title, severity, description, category, cweId, owaspId, scopeId, local_key, disposition: 'open'|'fixed', ...). report only. ZIV-695: give a finding a `local_key` so an observation in the same batch can cite it via finding_refs."),
     evidence: ItemArraySchema.describe("Evidence items — same shape as result.evidence[] (name, kind, content, description). report only."),
-    observations: ItemArraySchema.describe("Observation items — same shape as result.observations[] (test_id, scope_id, title, pack, target, executed, result, method, ...). report only."),
+    observations: ItemArraySchema.describe("Observation items — same shape as result.observations[] (test_id, scope_id, title, pack, target, executed, result, method, finding_refs, evidence_refs, coverage_note). report only. " +
+        "ZIV-695: result='failed' MUST cite its proof via finding_refs: [{kind:'local',key:'<a findings[].local_key in this same batch>'}] or [{kind:'unified',id:'<a findingId a previous report returned>'}] — " +
+        "an uncited failure is recorded as 'inconclusive', which asserts nothing and moves no coverage. A co-submitted finding with a matching scopeId is linked for you. " +
+        "Check adjusted_observations in the response: anything reported 'downgraded' did NOT land as submitted."),
     result: z
         .record(z.string(), z.unknown())
         .optional()

package/dist/tools/diagram.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const DIAGRAM_NAME = "zivis_diagram";
-export declare const DIAGRAM_DESCRIPTION = "CRUD + link management for Mermaid diagrams (architecture, data flow, attack chain, sequence, trust boundary, network, deployment).\n\naction:\n- create: requires name, diagram_type, content (Mermaid source). Optional description, linked_threat_model_id.\n- get: requires diagram_id. Full Mermaid source + metadata \u2014 call before update_source.\n- list: optional diagram_type, search, linked_threat_model_id filters; limit (default 20, max 100).\n- update_metadata: requires diagram_id. Optional name/description/diagram_type.\n- update_source: requires diagram_id, mermaid_source (COMPLETE replacement source \u2014 get first, preserve unrelated nodes/edges/styles). Optional description of the change.\n- delete: requires diagram_id.\n- link_threat_model / unlink_threat_model: requires diagram_id, threat_model_id.";
+export declare const DIAGRAM_DESCRIPTION = "CRUD + link management for Mermaid diagrams (architecture, data flow, attack chain, sequence, trust boundary, network, deployment).\n\naction:\n- create: requires application_id, name, diagram_type, content (Mermaid source). The diagram is linked to that application so it shows on the app's Diagrams tab. Optional description, linked_threat_model_id.\n- get: requires diagram_id. Full Mermaid source + metadata \u2014 call before update_source.\n- list: optional application_id, diagram_type, search, linked_threat_model_id filters; limit (default 20, max 100). List by application_id before create so you update an existing diagram instead of duplicating it.\n- update_metadata: requires diagram_id. Optional name/description/diagram_type.\n- update_source: requires diagram_id, mermaid_source (COMPLETE replacement source \u2014 get first, preserve unrelated nodes/edges/styles). Optional description of the change.\n- delete: requires diagram_id.\n- link_threat_model / unlink_threat_model: requires diagram_id, threat_model_id.";
 export declare const DIAGRAM_SCHEMA: {
     action: z.ZodEnum<{
         list: "list";
@@ -14,6 +14,7 @@ export declare const DIAGRAM_SCHEMA: {
         unlink_threat_model: "unlink_threat_model";
     }>;
     diagram_id: z.ZodOptional<z.ZodString>;
+    application_id: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
     diagram_type: z.ZodOptional<z.ZodEnum<{
@@ -36,6 +37,7 @@ export declare const DIAGRAM_SCHEMA: {
 type DiagramParams = {
     action: "create" | "get" | "list" | "update_metadata" | "update_source" | "delete" | "link_threat_model" | "unlink_threat_model";
     diagram_id?: string;
+    application_id?: string;
     name?: string;
     description?: string;
     diagram_type?: string;

package/dist/tools/diagram.js

@@ -14,9 +14,9 @@ const DIAGRAM_TYPE_ENUM = [
 export const DIAGRAM_DESCRIPTION = `CRUD + link management for Mermaid diagrams (architecture, data flow, attack chain, sequence, trust boundary, network, deployment).
 
 action:
-- create: requires name, diagram_type, content (Mermaid source). Optional description, linked_threat_model_id.
+- create: requires application_id, name, diagram_type, content (Mermaid source). The diagram is linked to that application so it shows on the app's Diagrams tab. Optional description, linked_threat_model_id.
 - get: requires diagram_id. Full Mermaid source + metadata — call before update_source.
-- list: optional diagram_type, search, linked_threat_model_id filters; limit (default 20, max 100).
+- list: optional application_id, diagram_type, search, linked_threat_model_id filters; limit (default 20, max 100). List by application_id before create so you update an existing diagram instead of duplicating it.
 - update_metadata: requires diagram_id. Optional name/description/diagram_type.
 - update_source: requires diagram_id, mermaid_source (COMPLETE replacement source — get first, preserve unrelated nodes/edges/styles). Optional description of the change.
 - delete: requires diagram_id.
@@ -35,6 +35,10 @@ export const DIAGRAM_SCHEMA = {
     ])
         .describe("Which diagram operation to perform"),
     diagram_id: z.string().optional().describe("Diagram UUID. Required for every action except create/list."),
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID. Required for create — the diagram is linked to it and only then appears on that app's Diagrams tab. Optional filter for list."),
     name: z.string().optional().describe("Diagram name. Required for create."),
     description: z
         .string()
@@ -70,6 +74,10 @@ export function createDiagramHandler(apiClient) {
                         return errorResult("diagram_type is required for create");
                     if (!params.content)
                         return errorResult("content is required for create");
+                    const applicationId = params.application_id?.trim();
+                    if (!applicationId) {
+                        return errorResult("application_id is required for create. Diagrams are application artifacts: without the link the diagram lands at org level and no application view can show it. Use the applicationId from zivis_check_project or zivis_application(action=list).");
+                    }
                     const data = await apiClient.post("/api/diagrams", {
                         name: params.name,
                         description: params.description,
@@ -77,6 +85,8 @@ export function createDiagramHandler(apiClient) {
                         contentType: "mermaid",
                         content: params.content,
                         sourceType: "manual",
+                        entityType: "application",
+                        entityId: applicationId,
                     });
                     const sanitized = sanitizeResponse(data);
                     const diagramId = sanitized.id;
@@ -95,8 +105,9 @@ export function createDiagramHandler(apiClient) {
                         diagram_id: diagramId,
                         name: sanitized.name,
                         diagram_type: sanitized.diagramType,
+                        application_id: applicationId,
                         linked_threat_model_id: linkedThreatModelId,
-                        _instruction: "Diagram created. Use zivis_diagram(action=get) to see full content, action=update_metadata to change metadata/links, or action=update_source to change the Mermaid source.",
+                        _instruction: "Diagram created and linked to the application. Use zivis_diagram(action=get) to see full content, action=update_metadata to change metadata/links, or action=update_source to change the Mermaid source.",
                     });
                 }
                 case "get": {
@@ -122,6 +133,8 @@ export function createDiagramHandler(apiClient) {
                 }
                 case "list": {
                     const query = new URLSearchParams();
+                    if (params.application_id?.trim())
+                        query.set("applicationId", params.application_id.trim());
                     if (params.diagram_type)
                         query.set("diagramType", params.diagram_type);
                     if (params.search)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",

package/dist/tools/open-in-ide.d.ts

@@ -1,27 +0,0 @@
-import { z } from "zod";
-export declare const OPEN_IN_IDE_NAME = "zivis_open_in_ide";
-export declare const OPEN_IN_IDE_DESCRIPTION = "Build a vscode:// or cursor:// deep link that opens a ZIVIS artifact inside the ZIVIS Code IDE extension.\n\nReturns a URI like `vscode://zivisai.zivis-security/diagram?id=<uuid>` (or `cursor://...` when ide_client is cursor). When opened with the system's URL handler, it launches the matching desktop editor and opens the diagram, document, or threat model.\n\nSupported kinds:\n  - diagram        \u2014 opens the diagram in a webview panel\n  - document       \u2014 opens the document in a webview panel\n  - threat-model   \u2014 reveals the threat model in the ZIVIS sidebar tree\n\nRequires the ZIVIS Code extension (publisher: zivisai, name: zivis-security) to be installed in the user's IDE. If it isn't, the URI will prompt the user to install it.\n\nThis tool does not make any API calls and does not validate that the ID exists \u2014 it's a pure URI builder.";
-export declare const OPEN_IN_IDE_SCHEMA: {
-    kind: z.ZodEnum<{
-        document: "document";
-        diagram: "diagram";
-        "threat-model": "threat-model";
-    }>;
-    id: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    ide_client: z.ZodOptional<z.ZodEnum<{
-        cursor: "cursor";
-        vscode: "vscode";
-    }>>;
-};
-export declare function createOpenInIdeHandler(): (params: {
-    kind: "diagram" | "document" | "threat-model";
-    id: string;
-    label?: string;
-    ide_client?: "vscode" | "cursor";
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-}>;

package/dist/tools/open-in-ide.js

@@ -1,48 +0,0 @@
-import { z } from "zod";
-export const OPEN_IN_IDE_NAME = "zivis_open_in_ide";
-export const OPEN_IN_IDE_DESCRIPTION = `Build a vscode:// or cursor:// deep link that opens a ZIVIS artifact inside the ZIVIS Code IDE extension.
-
-Returns a URI like \`vscode://zivisai.zivis-security/diagram?id=<uuid>\` (or \`cursor://...\` when ide_client is cursor). When opened with the system's URL handler, it launches the matching desktop editor and opens the diagram, document, or threat model.
-
-Supported kinds:
-  - diagram        — opens the diagram in a webview panel
-  - document       — opens the document in a webview panel
-  - threat-model   — reveals the threat model in the ZIVIS sidebar tree
-
-Requires the ZIVIS Code extension (publisher: zivisai, name: zivis-security) to be installed in the user's IDE. If it isn't, the URI will prompt the user to install it.
-
-This tool does not make any API calls and does not validate that the ID exists — it's a pure URI builder.`;
-export const OPEN_IN_IDE_SCHEMA = {
-    kind: z
-        .enum(["diagram", "document", "threat-model"])
-        .describe("Type of artifact the link should open."),
-    id: z.string().min(1).describe("UUID of the artifact (diagram_id, document_id, or threat_model_id)."),
-    label: z
-        .string()
-        .optional()
-        .describe("Optional human-readable label passed as ?name= for nicer panel titles."),
-    ide_client: z
-        .enum(["vscode", "cursor"])
-        .optional()
-        .describe("URI scheme: vscode (default) or cursor — match the user's desktop editor."),
-};
-export function createOpenInIdeHandler() {
-    return async (params) => {
-        const qs = new URLSearchParams();
-        qs.set("id", params.id);
-        if (params.label) {
-            qs.set(params.kind === "document" ? "title" : "name", params.label);
-        }
-        const scheme = params.ide_client === "cursor" ? "cursor" : "vscode";
-        const uri = `${scheme}://zivisai.zivis-security/${params.kind}?${qs.toString()}`;
-        const result = {
-            uri,
-            kind: params.kind,
-            id: params.id,
-            hint: "Open this URI to launch the ZIVIS Code IDE extension. Requires the zivisai.zivis-security extension to be installed.",
-        };
-        return {
-            content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-        };
-    };
-}