list_global_helpers
Retrieve and paginate global helper functions from a Panther instance, including metadata and code, to streamline rule and policy creation across detections. Requires 'View Rules' permission.
Instructions
List all global helpers from your Panther instance. Global helpers are shared Python functions that can be used across multiple rules, policies, and other detections.
Returns paginated list of global helpers with metadata including descriptions and code.
Permissions:{'all_of': ['View Rules']}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| created_by | No | Filter by creator user ID or actor ID | |
| cursor | No | Optional cursor for pagination from a previous query | |
| last_modified_by | No | Filter by last modifier user ID or actor ID | |
| limit | No | Maximum number of results to return (1-1000) | |
| name_contains | No | Case-insensitive substring to search for in the global's name |
Implementation Reference
- Full implementation of the 'list_global_helpers' MCP tool handler, including input schema validation via Pydantic Annotated Fields, @mcp_tool decorator for registration, and logic to query Panther's /globals API endpoint with pagination, filtering, and metadata extraction.@mcp_tool( annotations={ "permissions": all_perms(Permission.RULE_READ), "readOnlyHint": True, } ) async def list_global_helpers( cursor: Annotated[ str | None, Field(description="Optional cursor for pagination from a previous query"), ] = None, limit: Annotated[ int, Field( description="Maximum number of results to return (1-1000)", examples=[100, 25, 50], ge=1, le=1000, ), ] = 100, name_contains: Annotated[ str | None, Field( description="Case-insensitive substring to search for in the global's name", examples=["aws", "crowdstrike", "utility"], ), ] = None, created_by: Annotated[ str | None, Field( description="Filter by creator user ID or actor ID", examples=["user-123", "john.doe@company.com"], ), ] = None, last_modified_by: Annotated[ str | None, Field( description="Filter by last modifier user ID or actor ID", examples=["user-456", "jane.smith@company.com"], ), ] = None, ) -> dict[str, Any]: """List all global helpers from your Panther instance. Global helpers are shared Python functions that can be used across multiple rules, policies, and other detections. Returns paginated list of global helpers with metadata including descriptions and code. """ logger.info(f"Fetching {limit} global helpers from Panther") try: # Prepare query parameters based on API spec params = {"limit": limit} if cursor and cursor.lower() != "null": # Only add cursor if it's not null params["cursor"] = cursor logger.info(f"Using cursor for pagination: {cursor}") if name_contains: params["name-contains"] = name_contains if created_by: params["created-by"] = created_by if last_modified_by: params["last-modified-by"] = last_modified_by async with get_rest_client() as client: result, _ = await client.get("/globals", params=params) # Extract globals and pagination info globals_list = result.get("results", []) next_cursor = result.get("next") # Keep only specific fields for each global helper to limit the amount of data returned filtered_globals_metadata = [ { "id": global_helper["id"], "description": global_helper.get("description"), "tags": global_helper.get("tags"), "createdAt": global_helper.get("createdAt"), "lastModified": global_helper.get("lastModified"), } for global_helper in globals_list ] logger.info( f"Successfully retrieved {len(filtered_globals_metadata)} global helpers" ) return { "success": True, "global_helpers": filtered_globals_metadata, "total_global_helpers": len(filtered_globals_metadata), "has_next_page": bool(next_cursor), "next_cursor": next_cursor, } except Exception as e: logger.error(f"Failed to list global helpers: {str(e)}") return {"success": False, "message": f"Failed to list global helpers: {str(e)}"}
- src/mcp_panther/server.py:75-75 (registration)The call to register_all_tools(mcp) which registers all @mcp_tool decorated functions, including list_global_helpers, with the FastMCP server instance.register_all_tools(mcp)
- The @mcp_tool decorator specific to list_global_helpers, adding it to the tool registry with required permissions.@mcp_tool( annotations={ "permissions": all_perms(Permission.RULE_READ), "readOnlyHint": True, } )