Describe LimaCharlie MCP tools, inputs, bounds, side effects, and use cases.

Explain LimaCharlie permissions and missing-permission failures in plain English.

Return the authenticated LimaCharlie API identity.

Pass both oid and check_perm to test a specific permission in an explicit organization context.

Show LimaCharlie credential mode and cached JWT status without exposing secrets.

Force a LimaCharlie JWT refresh using configured API-key credentials.

List organizations available to the authenticated LimaCharlie API key.

List supported sensor installer target URLs without downloading binaries.

List supported adapter binary target URLs without downloading binaries.

Review org posture across fleet, outputs, access, content, cases, and optional detection noise.

Summarize bounded sensor and online-sensor evidence for fleet health review.

Summarize bounded detection volume and concentration for a time window.

Summarize D&R, FP, logging, integrity, YARA, and MITRE coverage evidence.

Summarize bounded case backlog and dashboard evidence.

Summarize outputs, extension subscriptions, and feedback channel health.

Summarize users, permissions, groups, and API-key hygiene evidence.

List sensors for an explicit org, optionally filtered by selector.

Fetch one sensor by sensor ID for an explicit org.

Check whether one sensor is currently network-isolated.

Check whether one sensor is currently sealed.

Poll one sensor until it is online or a bounded timeout expires.

Preview tasking one sensor. No task is queued until confirmation.

Preview isolating one sensor from the network.

Preview removing network isolation from one sensor.

Preview sealing one sensor against uninstall.

Preview unsealing one sensor.

Preview deleting one sensor record.

List currently online sensors or online sensor counts for an explicit org.

List one bounded page of detections for an explicit org and unix-second time window.

Fetch a single detection by detection ID for an explicit org.

List LimaCharlie cases for an explicit org, with optional filters.

Fetch a LimaCharlie case by case number for an explicit org.

Preview creating a LimaCharlie case through ext-cases.

Preview updating a case. No write is sent until confirmation.

Preview adding a note to a case.

Preview changing a case note's public visibility.

Preview bulk-updating up to 200 cases.

Preview merging source cases into a target case.

List detections linked to a case.

Preview linking a detection to a case.

Preview removing a detection link from a case.

List entities attached to a case.

Search case entities across an org.

Preview adding an entity/IOC to a case.

Preview updating a case entity note or verdict.

Preview removing an entity from a case.

List telemetry references linked to a case.

Preview linking telemetry to a case.

Preview updating case telemetry note or verdict.

Preview removing telemetry from a case.

List forensic artifacts linked to a case.

Preview adding a forensic artifact reference to a case.

Preview removing a forensic artifact reference from a case.

Export a case with detections, entities, telemetry, and artifacts.

Get Cases report summary metrics.

Get Cases dashboard counts.

Get Cases configuration for an org.

Preview replacing Cases configuration for an org.

List unique case assignee emails for an org.

List ext-cases organizations accessible to the caller.

Preview replacing all tags on a case.

Preview adding tags to a case by replacing the exact merged tag list.

Preview removing tags from a case by replacing the exact remaining tag list.

List one bounded page of historical events for one sensor.

Fetch event timeline overview for one sensor and time window.

Fetch one sensor event by atom.

Fetch child events for a parent event atom.

Fetch retained event count/statistics for one sensor and time window.

Search Insight prevalence or locations for one IOC/object.

Batch Insight prevalence or location lookup for bounded IOC groups.

Lookup one object through Insight with enrichment-oriented naming.

Check whether Insight retention appears enabled for an org.

Validate LCQL through the org search service before estimation or execution.

Estimate an LCQL query against an explicit unix-second time window.

Start a paginated LCQL search and return a query_id for bounded polling.

Poll one bounded LCQL search page, returning checkpoint state for resume.

Cancel a running LCQL search job.

List saved LCQL queries stored in the query hive.

Fetch one saved LCQL query by name.

Preview creating or updating one saved LCQL query.

Preview deleting one saved LCQL query.

Load a saved query and start a paginated LCQL search job.

Validate a D&R rule through Replay using a dry-run minimal event.

Dry-run a D&R rule against explicit events through Replay.

Dry-run a D&R rule against historical data without creating detections.

List one bounded page of artifacts for an org, sensor, time window, or cursor.

Request original artifact payload or signed export URL.

List payload metadata for an org without downloading payload bytes.

Request payload API metadata, including a signed download URL when returned.

Preview requesting a signed payload upload URL without uploading bytes.

Preview deleting a payload.

Resolve a LimaCharlie authenticated resource locator.

List service jobs for an explicit org and time window.

Fetch one service job.

Poll one service job until terminal state or bounded timeout.

Preview deleting one service job record.

List pending reliable-tasking extension tasks for an org.

Preview queueing one reliable task through ext-reliable-tasking.

Preview cancelling one pending reliable task through ext-reliable-tasking.

List one bounded page of org audit logs for a time window.

List tags observed across sensors in an org.