al4_search_files
Search the AssemblyLine file store with Lucene queries to find files by type, date, or other attributes. Use syntax like 'type:executable/windows' for targeted results.
Instructions
Search the AssemblyLine file store using Lucene query syntax (e.g. 'type:executable/windows AND seen.last:[now-7d TO now]').
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| fields | No | ||
| rows | No | ||
| offset | No | ||
| sort | No |
Implementation Reference
- src/index.ts:431-433 (handler)The MCP tool handler dispatches 'al4_search_files' to client.searchFiles() with parsed search options.
case "al4_search_files": result = await client.searchFiles(buildSearchOptions(a)); break; - src/index.ts:344-352 (helper)Helper function that extracts and maps the tool's input arguments (query, fields, rows, offset, sort) into SearchOptions.
function buildSearchOptions(args: Record<string, unknown>) { return { query: args.query as string, fl: args.fields as string | undefined, rows: args.rows as number | undefined, offset: args.offset as number | undefined, sort: args.sort as string | undefined, }; } - src/al4-client.ts:617-624 (handler)The actual implementation: sends a GET request to /api/v4/search/file/ with the Lucene query as URL parameters.
searchFiles(opts: SearchOptions): Promise<Record<string, unknown>> { return this.requestJson( "GET", `/api/v4/search/file/?${this.buildSearchParams(opts)}`, undefined, opts, ); } - src/al4-client.ts:586-597 (helper)Builds URL search params from SearchOptions, converting 'fields' to 'fl' for the API.
private buildSearchParams(opts: SearchOptions): string { if (!opts.query) throw new Error("SearchOptions.query is required"); const p = new URLSearchParams({ query: opts.query }); if (opts.fl) p.set("fl", opts.fl); if (opts.rows !== undefined) p.set("rows", String(Math.max(0, Math.floor(opts.rows)))); if (opts.offset !== undefined) p.set("offset", String(Math.max(0, Math.floor(opts.offset)))); if (opts.sort) p.set("sort", opts.sort); if (opts.filters) opts.filters.forEach((f) => p.append("filters", f)); return p.toString(); } - src/index.ts:241-256 (registration)The tool registration in the TOOLS array with its name, description, and JSON Schema input definition.
{ name: "al4_search_files", description: "Search the AssemblyLine file store using Lucene query syntax (e.g. 'type:executable/windows AND seen.last:[now-7d TO now]').", inputSchema: { type: "object", properties: { query: { type: "string" }, fields: { type: "string" }, rows: { type: "number" }, offset: { type: "number" }, sort: { type: "string" }, }, required: ["query"], }, },