taegis-magic-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_alertsA | Search Taegis alerts using OCSF query syntax. Args:
query: OCSF query string, e.g. Returns: JSON array of alert objects. |
| search_eventsA | Search Taegis security events. Args: query: Event query string. region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie". limit: Maximum number of results (default 100). Returns: JSON array of event objects. |
| search_investigationsA | List and search open security investigations in Taegis. Args: region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie". limit: Maximum number of investigations to return (default 25). Returns: JSON array of investigation objects. |
| list_tenantsA | List all Taegis tenants visible to the authenticated user. Returns: JSON array of tenant objects. |
| search_threat_intelA | Search Taegis threat intelligence (IOCs, hashes, IPs, domains …). Args: query: Search query — indicator value or free-text search. region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie". Returns: JSON array of threat intelligence objects. |
| run_taegis_commandA | Run an arbitrary taegis CLI command and return JSON output. Use this as an escape hatch for commands not yet wrapped as dedicated tools
(e.g. Args:
args: Space-separated CLI arguments after the Returns: Raw JSON output from the taegis CLI. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool targets a distinct resource type (alerts, events, investigations, tenants, threat intel) with clear search/list semantics. The escape hatch command is explicitly for arbitrary CLI calls, so there's no overlap with the dedicated tools.
All tool names follow a consistent verb_noun snake_case pattern (search_alerts, list_tenants, run_taegis_command). The pattern is uniform across the set with no mixed conventions.
Six tools is well within the ideal 3-15 range. The server covers the core Taegis search use cases without redundancy, and the escape hatch avoids the need for many narrow wrappers.
The dedicated tools cover the most common read/search operations for a security platform. Minor gaps exist (e.g., no dedicated get-by-id tools or investigation management), but the run_taegis_command escape hatch fills any missing functionality, making the surface effectively complete.