agentic-detection-lookups
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| detection_lookup_binaryA | Check if a binary is a known LOLBAS (Windows) or GTFOBins (Linux) living-off-the-land binary. Provide the filename (e.g., 'certutil.exe', 'curl', 'python'). Returns risk level, abuse categories, MITRE ATT&CK technique IDs, description, and source. Searches both LOLBAS (Windows) and GTFOBins (Linux) datasets. If not found in either, returns {found: false} with a suggestion. |
| detection_check_parent_childA | Check if a process parent-child relationship is expected or suspicious. Provide parent and child process filenames (e.g., parent='winword.exe', child='cmd.exe'). Returns whether the relationship is expected, the risk if unexpected, MITRE technique, and triage notes. |
| detection_list_by_categoryA | List all binaries in a specific abuse category. LOLBAS categories: Execute, Download, Upload, AWL Bypass, UAC Bypass, Compile, Credentials, Dump, Encode, Reconnaissance. GTFOBins categories: shell, reverse-shell, bind-shell, file-read, file-write, download, upload, library-load, command, inherit, privilege-escalation. Supports pagination via limit (default 50) and offset (default 0). |
| detection_list_by_mitreA | List all binaries (LOLBAS + GTFOBins) mapped to a specific MITRE ATT&CK technique. Provide a technique ID like 'T1218', 'T1059.001', 'T1105', etc. Searching a parent technique (e.g., T1218) also returns sub-techniques (T1218.011). Supports pagination via limit (default 50) and offset (default 0). |
| detection_searchA | Search across all lookup files for a text match. Searches filename, description, categories, MITRE IDs, and notes fields
across LOLBAS, GTFOBins, and parent-child baselines.
Returns up to |
| detection_list_lookupsA | List all available lookup files and their metadata (row counts, columns). Use this tool to discover what datasets are available before querying. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool targets a distinct query mode: exact binary lookup, parent-child relationship checking, category listing, MITRE listing, free-text search, and dataset metadata. The only minor overlap is between detection_lookup_binary and detection_search, but their descriptions make the intended use clear.
Tool names consistently use snake_case with a detection_ prefix and mostly follow a verb_noun or verb_prepositional pattern. Minor deviations like detection_search lacking an object and detection_list_lookups using a generic object do not create real confusion.
Six tools is well-scoped for a detection lookup server. Each tool provides a distinct access path to the underlying datasets without redundancy or bloat.
The surface covers exact binary lookups, relationship checks, filtered enumeration by category and MITRE technique, free-text search, and dataset discovery. This forms a complete read-only lookup capability with no obvious dead ends.