misp-mcp

misp_lookup_iocs

Read-onlyIdempotent

Triage several indicators at once against MISP, returning per-IOC summaries with hit counts and top event IDs. Invalid indicators are reported inline.

Instructions

Triage several indicators at once, returning a compact per-IOC summary (not full hit detail — call misp_lookup_ioc for that).

Returns JSON: {"results": [{"ioc", "ioc_type", "total_hits", "has_restricted_hits", "top_event_ids": [str]}]}. Invalid indicators are reported inline as {"ioc", "error"} rather than failing the whole batch. "total_hits": 0 means not present in MISP, not that it is safe.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "params": "<params>"
    },
    "name": "misp_lookup_iocs"
  }
}

Input Schema

Name	Required	Description	Default
`params`	Yes

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Jul 15, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant detail beyond annotations: it explains the batch behavior, return format, error handling for invalid indicators, and clarifies that total_hits=0 does not imply safety. This fully discloses behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, front-loading the purpose and using bullet points for the response format. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's batch nature and presence of output schema, the description covers all essential aspects: response format, error handling, and interpretation of results. It is complete for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already contains detailed descriptions for both parameters (iocs and limit_per_ioc). The tool description adds no additional parameter-specific information, maintaining baseline adequacy.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool triages multiple indicators at once and returns a compact per-IOC summary, distinguishing it from the sibling misp_lookup_ioc which provides full hit detail.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends using this tool instead of many single lookups when triaging an IOC list. It also contrasts with misp_lookup_ioc for full detail, providing clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server