List Available Lookups
detection_list_lookupsDiscover available detection lookup files with row counts and column metadata to find datasets for SIEM enrichment and threat queries.
Instructions
List all available lookup files and their metadata (row counts, columns).
Use this tool to discover what datasets are available before querying.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- mcp_server/server.py:451-467 (handler)Main handler function for the 'detection_list_lookups' tool. It reads all CSV files from LOOKUPS_DIR, returning a list with each file's name, row count, and column headers.
def detection_list_lookups() -> dict[str, Any]: """List all available lookup files and their metadata (row counts, columns). Use this tool to discover what datasets are available before querying. """ lookups = [] for csv_file in sorted(LOOKUPS_DIR.glob("*.csv")): with open(csv_file, "r", encoding="utf-8") as f: reader = csv.DictReader(f) rows = list(reader) lookups.append({ "filename": csv_file.name, "rows": len(rows), "columns": reader.fieldnames or [], }) return {"count": len(lookups), "lookups": lookups} - mcp_server/server.py:442-450 (registration)Registration of the 'detection_list_lookups' function as an MCP tool via the @mcp.tool() decorator with annotations including title 'List Available Lookups', readOnlyHint=True, destructiveHint=False, idempotentHint=True, openWorldHint=False.
@mcp.tool( annotations={ "title": "List Available Lookups", "readOnlyHint": True, "destructiveHint": False, "idempotentHint": True, "openWorldHint": False, }, ) - mcp_server/server.py:451-467 (schema)The return type is dict[str, Any] with the schema: {'count': int, 'lookups': list[{'filename': str, 'rows': int, 'columns': list[str]}]}. No input parameters. No explicit pydantic model, inferred from the function return logic.
def detection_list_lookups() -> dict[str, Any]: """List all available lookup files and their metadata (row counts, columns). Use this tool to discover what datasets are available before querying. """ lookups = [] for csv_file in sorted(LOOKUPS_DIR.glob("*.csv")): with open(csv_file, "r", encoding="utf-8") as f: reader = csv.DictReader(f) rows = list(reader) lookups.append({ "filename": csv_file.name, "rows": len(rows), "columns": reader.fieldnames or [], }) return {"count": len(lookups), "lookups": lookups} - mcp_server/server.py:34-40 (helper)Helper function _load_csv used by the tool handler to load CSV files from the LOOKUPS_DIR directory.
def _load_csv(filename: str) -> list[dict[str, str]]: """Load a CSV lookup file and return rows as list of dicts.""" filepath = LOOKUPS_DIR / filename if not filepath.exists(): return [] with open(filepath, "r", encoding="utf-8") as f: return list(csv.DictReader(f)) - mcp_server/server.py:18-18 (helper)LOOKUPS_DIR path definition used by the tool to find CSV files.
LOOKUPS_DIR = Path(__file__).parent.parent / "lookups"