ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/workspace_tools.py:311-402 (handler)

  The SentinelMetadataGetTool class provides the core handler logic for the 'sentinel_metadata_get' tool. It extracts the metadata_id parameter, handles full ARM IDs, retrieves the metadata using the Azure SecurityInsights client, serializes the response, and returns a structured result with validation and error handling.
  class SentinelMetadataGetTool(MCPToolBase): """ Tool for retrieving details for specific Sentinel metadata by ID. """ name = "sentinel_metadata_get" description = "Get details for specific Sentinel metadata by ID." async def run(self, ctx: Context, **kwargs): """ Get details for specific metadata by ID. Parameters: metadata_id (str, required): The ID of the metadata object to retrieve. Returns: dict: { 'metadata': dict, 'valid': bool, 'errors': list[str], 'error': str (optional, present only if an error occurs) } Output Fields: - metadata: Metadata object (id, name, kind, etc.) - valid: True if successful, False otherwise - errors: List of error messages (empty if none) - error: Error message if an error occurs (optional) Error cases will always include an 'error' key for testability. """ logger = self.logger # Accept both 'metadata_id' and 'id' as input keys using the base class method metadata_id = self._extract_param(kwargs, "metadata_id") or self._extract_param( kwargs, "id" ) logger.debug("SentinelMetadataGetTool metadata_id: %r", metadata_id) # If a full ARM resource ID is provided, extract the short name (last segment) if metadata_id and "/" in metadata_id: metadata_id = metadata_id.rstrip("/").split("/")[-1] result = { "metadata": {}, "valid": False, "errors": [], } if not metadata_id: error_msg = ( "Missing required parameter: metadata_id or id. Provide either " "the short name or the full ARM resource ID." ) logger.error("%s", error_msg) result["error"] = error_msg result["errors"].append(error_msg) return result workspace_name, resource_group, subscription_id = self.get_azure_context(ctx) try: client = self.get_securityinsight_client(subscription_id) meta = client.metadata.get(resource_group, workspace_name, metadata_id) def _serialize_model(obj): if hasattr(obj, "as_dict"): return obj.as_dict() elif hasattr(obj, "__dict__"): # fallback, filter out private attributes return { k: v for k, v in obj.__dict__.items() if not k.startswith("_") } elif obj is None: return None else: return str(obj) result["metadata"] = { "id": getattr(meta, "id", None), "name": getattr(meta, "name", None), "kind": getattr(meta, "kind", None), "content_id": getattr(meta, "content_id", None), "version": getattr(meta, "version", None), "parent_id": getattr(meta, "parent_id", None), "author": _serialize_model(getattr(meta, "author", None)), "source": _serialize_model(getattr(meta, "source", None)), "support": _serialize_model(getattr(meta, "support", None)), "categories": getattr(meta, "categories", None), "dependencies": getattr(meta, "dependencies", None), "created": str(getattr(meta, "created", "")), "last_modified": str(getattr(meta, "last_modified", "")), } result["valid"] = True except Exception as ex: error_msg = f"Error retrieving metadata: {ex}" logger.exception(error_msg) result["error"] = error_msg result["errors"].append(error_msg) return result
• tools/workspace_tools.py:576-576 (registration)

  Registration of the SentinelMetadataGetTool with the MCP server instance inside the register_tools function.
  SentinelMetadataGetTool.register(mcp)
• tools/workspace_tools.py:320-338 (schema)

  Docstring of the run method defines the input schema (metadata_id parameter) and output schema for the tool.
  """ Get details for specific metadata by ID. Parameters: metadata_id (str, required): The ID of the metadata object to retrieve. Returns: dict: { 'metadata': dict, 'valid': bool, 'errors': list[str], 'error': str (optional, present only if an error occurs) } Output Fields: - metadata: Metadata object (id, name, kind, etc.) - valid: True if successful, False otherwise - errors: List of error messages (empty if none) - error: Error message if an error occurs (optional) Error cases will always include an 'error' key for testability. """
• tools/workspace_tools.py:367-379 (helper)

  Helper function _serialize_model used within the run method to serialize complex Azure SDK model objects into dictionaries.
  def _serialize_model(obj): if hasattr(obj, "as_dict"): return obj.as_dict() elif hasattr(obj, "__dict__"): # fallback, filter out private attributes return { k: v for k, v in obj.__dict__.items() if not k.startswith("_") } elif obj is None: return None else: return str(obj)