update_iocs_in_collection
Add or remove indicators of compromise (IOCs) to or from a threat intelligence collection by specifying the collection ID, IOC type, and operation.
Instructions
Updates (add or remove) Indicators of Compromise (IOCs) to a collection. Args: id (required): The ID of the collection to update. relationship (required): The type of relationship to add. Can be "domains", "files", "ip_addresses", or "urls". iocs (required): List of IOCs to add to the collection. For "urls", these are the full URLs. For other types, they are the identifiers (hashes for files, domain names for domains, etc.). operation (required): The operation to perform. Can be "add" or "remove".
Returns: A string indicating the success or failure of the operation.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| relationship | Yes | ||
| iocs | Yes | ||
| operation | Yes | ||
| api_key | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- gti_mcp/tools/collections.py:493-493 (registration)The `@server.tool()` decorator registers `update_iocs_in_collection` as an MCP tool on the FastMCP server instance.
@server.tool() - gti_mcp/tools/collections.py:494-543 (handler)The `update_iocs_in_collection` async function implements the tool logic: validates the relationship type, constructs IOC payload items (using 'url' key for URLs, 'id' key for others), and performs add/remove operations via POST/DELETE API calls to /collections/{id}/{relationship}.
async def update_iocs_in_collection( id: str, ctx: Context, relationship: str, iocs: typing.List[str], operation: str, api_key: str = None, ) -> str: """Updates (add or remove) Indicators of Compromise (IOCs) to a collection. Args: id (required): The ID of the collection to update. relationship (required): The type of relationship to add. Can be "domains", "files", "ip_addresses", or "urls". iocs (required): List of IOCs to add to the collection. For "urls", these are the full URLs. For other types, they are the identifiers (hashes for files, domain names for domains, etc.). operation (required): The operation to perform. Can be "add" or "remove". Returns: A string indicating the success or failure of the operation. """ async with vt_client(ctx, api_key=api_key) as client: singular_type_map = { "domains": "domain", "files": "file", "ip_addresses": "ip_address", "urls": "url", } if relationship not in singular_type_map: return f"Error: Invalid IOC type '{relationship}'. Must be one of {list(singular_type_map.keys())}" singular_type = singular_type_map[relationship] if relationship == "urls": items = [{"type": singular_type, "url": ioc} for ioc in iocs] else: items = [{"type": singular_type, "id": ioc} for ioc in iocs] payload = {"data": items} if operation == "add": res = await client.post_async(f"/collections/{id}/{relationship}", json_data=payload) elif operation == "remove": res = await client.delete_async(f"/collections/{id}/{relationship}", json_data=payload) else: return f"Error: Invalid operation '{operation}'. Must be one of 'add' or 'remove'" status = res._aiohttp_resp.status return 'Sucesssfully updated collection' if status == 200 else 'Error updating collection' - gti_mcp/tools/collections.py:495-501 (schema)Function signature defines the input schema: id (str), ctx (Context), relationship (str), iocs (List[str]), operation (str), and optional api_key (str).
id: str, ctx: Context, relationship: str, iocs: typing.List[str], operation: str, api_key: str = None, ) -> str: - gti_mcp/tools/collections.py:21-22 (helper)The `server` (FastMCP instance) and `vt_client` (async context manager for VT API client) are imported from the server module, which provides the tool registration decorator.
from ..server import server, vt_client