get_ocsf_versions
Retrieve all available versions of the Open Cybersecurity Schema Framework (OCSF) to ensure compatibility and structure in cybersecurity data pipelines.
Instructions
Get all available OCSF schema versions.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- Handler for the 'ocsf_get_versions' tool (note: tool name is 'ocsf_get_versions', test refers to it as get_ocsf_versions). Lists bundled OCSF schema versions using list_ocsf_versions helper.@mcp.tool( name="ocsf_get_versions", tags={"ocsf"}, annotations={ "title": "List OCSF versions", "readOnlyHint": True, "idempotentHint": True, "openWorldHint": False, }, ) async def ocsf_get_versions() -> ToolResult: """List all bundled OCSF schema versions. Use this tool to: - See which OCSF schema versions are available - Choose a specific version for your mapping work - Understand schema evolution across versions Typically you'll want to use `ocsf_get_latest_version` instead to get the most recent stable version automatically.""" versions = list_ocsf_versions() return ToolResult( content="\n".join([f"- {v}" for v in versions]), # Markdown list structured_content={"versions": versions}, # JSON array )
- Helper function that scans the OCSF data directory for JSON schema files and extracts/sorts version numbers.def list_ocsf_versions() -> list[str]: """ Get all available OCSF schema versions. """ # Get the OCSF data directory ocsf_files = files("tenzir_mcp.data.ocsf") # Extract version numbers from JSON filenames versions = [] for file_path in ocsf_files.iterdir(): if file_path.name.endswith(".json"): # Remove .json extension to get version version = file_path.name[:-5] versions.append(version) # Sort versions (simple string sort works for semantic versions) versions.sort() return versions
- src/tenzir_mcp/tools/ocsf/ocsf_get_versions.py:33-57 (registration)The @mcp.tool decorator registers the tool with name 'ocsf_get_versions'.@mcp.tool( name="ocsf_get_versions", tags={"ocsf"}, annotations={ "title": "List OCSF versions", "readOnlyHint": True, "idempotentHint": True, "openWorldHint": False, }, ) async def ocsf_get_versions() -> ToolResult: """List all bundled OCSF schema versions. Use this tool to: - See which OCSF schema versions are available - Choose a specific version for your mapping work - Understand schema evolution across versions Typically you'll want to use `ocsf_get_latest_version` instead to get the most recent stable version automatically.""" versions = list_ocsf_versions() return ToolResult( content="\n".join([f"- {v}" for v in versions]), # Markdown list structured_content={"versions": versions}, # JSON array )