ContrastAPI

Sigma Rule Lookup

sigma_rule_lookup

Read-onlyIdempotent

Look up a single Sigma detection rule by UUID from the SigmaHQ corpus (~3,200 rules, refreshed daily at 02:00 UTC). Returns the full rule with title, description, status (stable/test/experimental/deprecated/unsupported), level (informational/low/medium/high/critical), logsource (product/category/service), detection logic, tags (including attack.t#### ATT&CK technique refs and cve.YYYY-#### CVE refs), author, references, and modification date. Use to fetch a known rule for context (e.g., a SIEM detection that fired) or to inspect a rule discovered via REST sigma_rule_search. When a rule tags an ATT&CK technique or CVE, the response next_calls surfaces atlas_technique_lookup / cve_lookup as natural follow-ups. Free: 30/hr, Pro: 500/hr. Returns {rule, next_calls}.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`rule_id`	Yes	Sigma rule UUID (RFC 4122, 36 chars, hyphenated). Example: '195e1b9d-bfc2-4ffa-ab4e-35aef69815f8'. Obtained from the REST sigma_rule_search endpoint or external SIEM correlation.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedJun 2, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / verdict / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
Changed1 schema field changedMay 25, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"object"New value: +"array"
```

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "next_calls": {
+          "type": "object"
+        },
+        "rule": {
+          "type": "object"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [
+        "rule"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -{
-  "$defs": {
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "SigmaDetection": {
-      "properties": {
-        "condition": {
-          "type": "string"
-        },
-        "selections": {
-          "additionalProperties": true,
-          "type": "object"
-        }
-      },
-      "type": "object"
-    },
-    "SigmaRule": {
-      "properties": {
-        "author": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "detection": {
-          "$ref": "#/$defs/SigmaDetection"
-        },
-        "detection_summary": {
-          "type": "string"
-        },
-        "falsepositives": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "level": {
-          "enum": [
-            "informational",
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "license": {
-          "type": "string"
-        },
-        "logsource": {
-          "additionalProperties": true,
-          "type": "object"
-        },
-        "modified": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "references": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "rule_id": {
-          "type": "string"
-        },
-        "source_url": {
-          "type": "string"
-        },
-        "status": {
-          "enum": [
-            "test",
-            "stable",
-            "experimental",
-            "unsupported",
-            "deprecated"
-          ],
-          "type": "string"
-        },
-        "tags": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "title": {
-          "type": "string"
-        },
-        "updated_at": {
-          "type": "string"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "rule_id",
-        "title",
-        "detection"
-      ],
-      "type": "object"
-    },
-    "SigmaRuleLookupResponse": {
-      "additionalProperties": false,
-      "properties": {
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "rule": {
-          "$ref": "#/$defs/SigmaRule"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "rule"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/SigmaRuleLookupResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Changed110 schema fields changedMay 17, 2026
- removedOutput schema / $defs / ErrorDetail / description
```
Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / description
```
Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / title
```
Removed value: -"Code"
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / description
```
Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / title
```
Removed value: -"Docs Url"
```
- removedOutput schema / $defs / ErrorDetail / properties / message / description
```
Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."
```
- removedOutput schema / $defs / ErrorDetail / properties / message / title
```
Removed value: -"Message"
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / description
```
Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / title
```
Removed value: -"Retry After Seconds"
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / description
```
Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / title
```
Removed value: -"Upgrade Url"
```
- removedOutput schema / $defs / ErrorDetail / title
```
Removed value: -"ErrorDetail"
```
- removedOutput schema / $defs / ErrorResponse / description
```
Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."
```
- removedOutput schema / $defs / ErrorResponse / title
```
Removed value: -"ErrorResponse"
```
- removedOutput schema / $defs / PivotHint / description
```
Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."
```
- removedOutput schema / $defs / PivotHint / properties / input / description
```
Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."
```
- removedOutput schema / $defs / PivotHint / properties / input / title
```
Removed value: -"Input"
```
- removedOutput schema / $defs / PivotHint / properties / params / default
```
Removed value: -null
```
- removedOutput schema / $defs / PivotHint / properties / params / description
```
Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."
```
- removedOutput schema / $defs / PivotHint / properties / params / title
```
Removed value: -"Params"
```
- removedOutput schema / $defs / PivotHint / properties / reason / description
```
Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."
```
- removedOutput schema / $defs / PivotHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / PivotHint / properties / tool / description
```
Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."
```
- removedOutput schema / $defs / PivotHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / PivotHint / title
```
Removed value: -"PivotHint"
```
- removedOutput schema / $defs / SigmaDetection / description
```
Removed value: -"Nested detection block — preserve raw YAML structure."
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / default
```
Removed value: -"unknown"
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / description
```
Removed value: -"Boolean condition syntax (e.g., 'all of selection_*', 'selection_a and selection_b')"
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / title
```
Removed value: -"Condition"
```
- removedOutput schema / $defs / SigmaDetection / properties / selections / description
```
Removed value: -"Selection blocks keyed by name (e.g., {'selection_img': {...}, 'selection_cmd': {...}})"
```
- removedOutput schema / $defs / SigmaDetection / properties / selections / title
```
Removed value: -"Selections"
```
- removedOutput schema / $defs / SigmaDetection / title
```
Removed value: -"SigmaDetection"
```
- removedOutput schema / $defs / SigmaRule / description
```
Removed value: -"Full Sigma detection rule parsed from YAML."
```
- removedOutput schema / $defs / SigmaRule / properties / author / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / author / description
```
Removed value: -"Rule author(s); defaults to 'Unknown' if missing"
```
- removedOutput schema / $defs / SigmaRule / properties / author / title
```
Removed value: -"Author"
```
- removedOutput schema / $defs / SigmaRule / properties / date / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / date / description
```
Removed value: -"ISO-8601 creation date"
```
- removedOutput schema / $defs / SigmaRule / properties / date / title
```
Removed value: -"Date"
```
- removedOutput schema / $defs / SigmaRule / properties / description / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / description / description
```
Removed value: -"Multi-line rule description; may be None if omitted in YAML"
```
- removedOutput schema / $defs / SigmaRule / properties / description / title
```
Removed value: -"Description"
```
- removedOutput schema / $defs / SigmaRule / properties / detection / description
```
Removed value: -"Nested detection block with selections and condition"
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / description
```
Removed value: -"Human-readable summary (e.g., '2 selections, condition: all of selection_*')"
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / title
```
Removed value: -"Detection Summary"
```
- removedOutput schema / $defs / SigmaRule / properties / falsepositives / description
```
Removed value: -"Known false-positive scenarios"
```
- removedOutput schema / $defs / SigmaRule / properties / falsepositives / title
```
Removed value: -"Falsepositives"
```
- removedOutput schema / $defs / SigmaRule / properties / level / default
```
Removed value: -"medium"
```
- removedOutput schema / $defs / SigmaRule / properties / level / description
```
Removed value: -"Detection alert severity"
```
- removedOutput schema / $defs / SigmaRule / properties / level / title
```
Removed value: -"Level"
```
- removedOutput schema / $defs / SigmaRule / properties / license / default
```
Removed value: -"DRL 1.1"
```
- removedOutput schema / $defs / SigmaRule / properties / license / description
```
Removed value: -"Detection Rule License version"
```
- removedOutput schema / $defs / SigmaRule / properties / license / title
```
Removed value: -"License"
```
- removedOutput schema / $defs / SigmaRule / properties / logsource / description
```
Removed value: -"Logsource metadata: {product, service, category, definition}"
```
- removedOutput schema / $defs / SigmaRule / properties / logsource / title
```
Removed value: -"Logsource"
```
- removedOutput schema / $defs / SigmaRule / properties / modified / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / modified / description
```
Removed value: -"ISO-8601 last modification date"
```
- removedOutput schema / $defs / SigmaRule / properties / modified / title
```
Removed value: -"Modified"
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / description
```
Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / SigmaRule / properties / references / description
```
Removed value: -"List of reference URLs from the rule"
```
- removedOutput schema / $defs / SigmaRule / properties / references / title
```
Removed value: -"References"
```
- removedOutput schema / $defs / SigmaRule / properties / rule_id / description
```
Removed value: -"UUID of the rule (unique identifier)"
```
- removedOutput schema / $defs / SigmaRule / properties / rule_id / title
```
Removed value: -"Rule Id"
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / description
```
Removed value: -"GitHub URL to the rule in SigmaHQ repository (set by indexer)"
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / title
```
Removed value: -"Source Url"
```
- removedOutput schema / $defs / SigmaRule / properties / status / default
```
Removed value: -"test"
```
- removedOutput schema / $defs / SigmaRule / properties / status / description
```
Removed value: -"Rule maturity level"
```
- removedOutput schema / $defs / SigmaRule / properties / status / title
```
Removed value: -"Status"
```
- removedOutput schema / $defs / SigmaRule / properties / tags / description
```
Removed value: -"Flattened tags list (attack.t1059, cve.2024-1234, detection.threat_hunting, etc.)"
```
- removedOutput schema / $defs / SigmaRule / properties / tags / title
```
Removed value: -"Tags"
```
- removedOutput schema / $defs / SigmaRule / properties / title / description
```
Removed value: -"Human-readable rule title"
```
- removedOutput schema / $defs / SigmaRule / properties / title / title
```
Removed value: -"Title"
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / description
```
Removed value: -"ISO-8601 timestamp when ContrastAPI last synced this rule"
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / title
```
Removed value: -"Updated At"
```
- removedOutput schema / $defs / SigmaRule / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / SigmaRule / title
```
Removed value: -"SigmaRule"
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / description
```
Removed value: -"Single rule lookup response."
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / next_calls / description
```
Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / rule / description
```
Removed value: -"Full Sigma rule record"
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / SigmaRuleLookupResponse / title
```
Removed value: -"SigmaRuleLookupResponse"
```
- removedOutput schema / $defs / Verdict / properties / completeness / default
```
Removed value: -"complete"
```
- removedOutput schema / $defs / Verdict / properties / completeness / description
```
Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."
```
- removedOutput schema / $defs / Verdict / properties / completeness / title
```
Removed value: -"Completeness"
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / description
```
Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / title
```
Removed value: -"Data Age Seconds"
```
- removedOutput schema / $defs / Verdict / properties / deterministic / description
```
Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."
```
- removedOutput schema / $defs / Verdict / properties / deterministic / title
```
Removed value: -"Deterministic"
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / description
```
Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / title
```
Removed value: -"Falsifiable Fields"
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / description
```
Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / title
```
Removed value: -"Sources Queried"
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / description
```
Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / title
```
Removed value: -"Sources Unavailable"
```
- removedOutput schema / $defs / Verdict / title
```
Removed value: -"Verdict"
```
- removedOutput schema / properties / result / title
```
Removed value: -"Result"
```
- removedOutput schema / title
```
Removed value: -"sigma_rule_lookupOutput"
```

Changed1 schema field changedMay 15, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

AddedMay 12, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already declaring read-only, idempotent, and non-destructive, the description adds substantial behavioral context: data refresh schedule (daily at 02:00 UTC), rate limits (Free/Pro), and the shape of the response including next_calls suggestions. This goes beyond the annotations and fully informs the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place: purpose, return contents, use cases, follow-ups, rate limits, and response shape. It is well-structured and front-loaded, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a lookup tool with a rich output schema, the description covers the lookup target, return payload, usage context, rate limits, and related follow-up tools. It is complete enough for an agent to decide when and how to invoke this tool, and what to expect in response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents rule_id with type, format, example, and source (REST sigma_rule_search), so coverage is 100%. The description reinforces that the rule is a UUID and mentions the source, but adds no new parameter-level semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a lookup of a single Sigma detection rule by UUID, explicitly naming the resource (SigmaHQ corpus) and differentiating from bulk operations via the word 'single'. It also enumerates returned fields, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: fetching a known rule for context or inspecting a rule found via REST sigma_rule_search. It also mentions natural follow-up lookups. However, it does not explicitly mention when NOT to use it (e.g., when needing multiple rules, use bulk_sigma_rule_lookup), so clear exclusions are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ContrastAPI tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.