Lattice: CVE, MITRE ATT&CK and detection graph for security agents

Answer a multi-hop question

graph_path

Read-onlyIdempotent

Answer a multi-hop question from an external id in one call instead of several lookups: for a CVE, the attack techniques it enables and the detections and response procedures for them. Needs a key; without one the error says how to get one. Templates: cve-context (start: CVE), cve-to-defense (start: CVE), technique-coverage (start: Technique), weakness-chain (start: Weakness), actor-ttps (start: ThreatActor/Malware/Campaign). Use cve-to-defense when asked what to detect or do about a CVE: it gives the techniques the CVE enables and the detections and procedures for them.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "template": "<template>",
      "id": "<id>"
    },
    "name": "graph_path"
  }
}

Input Schema

Name	Required	Description
`id`	Yes	External id to start from; it must be of a kind the template starts from (see the template list in the tool description).
`label`	No	Optional node label (type) to restrict the answer to, for example CVE, Technique or Detection. The valid labels are listed by graph_meta; an unknown label is refused with the valid ones.
`template`	Yes	Name of the path template, one of: cve-context, cve-to-defense, technique-coverage, weakness-chain, actor-ttps.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 6, 2026
- addedInput schema / additionalProperties
```
Added value: +false
```

Changed3 schema fields changedOct 4, 2026

addedInput schema / properties / id / description

Added value: +"External id to start from; it must be of a kind the template starts from (see the template list in the tool description)."

addedInput schema / properties / label / description

Added value: +"Optional node label (type) to restrict the answer to, for example CVE, Technique or Detection. The valid labels are listed by graph_meta; an unknown label is refused with the valid ones."

addedInput schema / properties / template / description

Added value: +"Name of the path template, one of: cve-context, cve-to-defense, technique-coverage, weakness-chain, actor-ttps."

First observedOct 4, 2026

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive, closed-world behavior, so the description correctly focuses on what annotations can't say: an API key is required and the failure error explains how to obtain one. It also discloses the multi-hop execution model (one call replaces several) and the per-template traversal semantics, which is meaningful context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and template list before the decision rule. The final sentence restates 'detections and procedures' already mentioned in the opening sentence, a minor redundancy, but otherwise dense and waste-free.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of return-value disclosure; it only sketches the output for one template (cve-to-defense) and leaves the other four templates' result shapes implicit. Auth requirement, template selection and start-id constraints are otherwise fully covered for a 3-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does add value by mapping each template name to its required start id kind, but the schema already carries the same start-kind hint on 'id' and enumerates the template names, so the description largely restates rather than extends it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Answer a multi-hop question from an external id in one call') and clarifies the efficiency motivation vs. doing 'several lookups'. It effectively differentiates the tool from lookup/neighbor-style siblings by framing it as a one-call traversal, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete when-to-use guidance via the template catalog with required start kinds ('cve-context (start: CVE)', 'technique-coverage (start: Technique)') and an explicit decision rule: 'Use cve-to-defense when asked what to detect or do about a CVE'. Missing an explicit when-not or a named sibling alternative (e.g., graph_lookup) for single-hop cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Lattice: CVE, MITRE ATT&CK and detection graph for security agents tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?