PerspectiveGraph

Overview Schema Source Related Servers Discussions Admin

explain_attack_path

Read-onlyIdempotent

Explain the full kill chain for one attack route ID, showing each hop, relationship, probability source, and MITRE ATT&CK technique so you know evidence vs assumption before acting.

Instructions

Give the full kill chain for one route: every hop, the relationship type, that hop's probability, where the probability came from (kev/epss/runtime are observed evidence; cvss/severity/heuristic are estimates), and the MITRE ATT&CK technique. Use this before explaining or acting on a route - the hop provenance is what tells you which parts of the story are evidence and which are assumption.

Input Schema

Name	Required	Description	Default
`path_id`	Yes	The `id` of a route from list_attack_paths. An id lasts as long as its route: one that has since been closed is reported as no longer open, and list_attack_paths gives the current ones.

Output Schema

Name	Required	Description
`id`	Yes	The route's id, as asked for.
`nodes`	No	The assets on the route, entry point first, target last.
`score`	No	End-to-end probability that an attacker completes the route, 0-1. A modelled estimate, not a measured rate: see get_score_trust.
`steps`	No	The hops, in order. Each is one relationship an attacker crosses.
`priority`	No	Triage priority, 0-100: the score blended with corroboration, target sensitivity and how many routes share the entry point. This is the order of the list.
`confidence`	No	How far the score can be trusted, 0-1: the mean confidence of its hops.
`scoreCiLow`	No	Low end of the 90% credible interval around posteriorMean. A wide interval means the score rests on soft inputs.
`suppressed`	No	True when an analyst has triaged the route off the board (accepted risk, false positive). It still exists, but do not present it as open work.
`scoreCiHigh`	No	High end of the same interval.
`mixtureScore`	No	The score averaged over attacker profiles, weighted by how likely each is.
`remediations`	No	Ways to close the route.
`posteriorMean`	No	The score with the uncertainty of each hop and the mix of attacker capabilities taken into account, 0-1.
`priorityLabel`	No	Priority band: P1, P2 or P3. P1 is what to fix first.
`profileScores`	No	The score against each attacker profile.
`correlatedHops`	No	True when two or more hops rest on the same kind of evidence.
`priorityReason`	No	One sentence saying why the route is in its band, when a fact put it there; null when the blended number did.
`confidenceLabel`	No	The same as a band: high, medium or low.
`priorityFactors`	No	The reasons behind the priority, human-readable.
`scoreUpperBound`	No	The score if the hops fail or succeed together rather than independently: the weakest hop's probability.
`runtimeConfirmed`	No	True when a runtime alert sits on the route.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.38.1Oct 14, 2026

changedInput schema / properties / path_id / description

Previous value: -"The id from list_attack_paths."New value: +"The `id` of a route from list_attack_paths. An id lasts as long as its route: one that has since been closed is reported as no longer open, and list_attack_paths gives the current ones."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "confidence": {
+      "description": "How far the score can be trusted, 0-1: the mean confidence of its hops.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "confidenceLabel": {
+      "description": "The same as a band: high, medium or low.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "correlatedHops": {
+      "description": "True when two or more hops rest on the same kind of evidence.",
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "id": {
+      "description": "The route's id, as asked for.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "mixtureScore": {
+      "description": "The score averaged over attacker profiles, weighted by how likely each is.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "nodes": {
+      "description": "The assets on the route, entry point first, target last.",
+      "items": {
+        "properties": {
+          "crownJewel": {
+            "description": "True for a sensitive asset.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "cvss": {
+            "description": "For a vulnerability: its CVSS base score.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "id": {
+            "description": "Node id: what steps and cuts refer to.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "internetExposed": {
+            "description": "True for an entry point reachable from the internet.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "kev": {
+            "description": "For a vulnerability: true when it is known to be exploited in the wild (CISA KEV).",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "label": {
+            "description": "Asset type, e.g. LoadBalancer, Container, IAM_Role, Bucket, CVE.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "name": {
+            "description": "Asset name.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "severity": {
+            "description": "For a vulnerability: its severity.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "posteriorMean": {
+      "description": "The score with the uncertainty of each hop and the mix of attacker capabilities taken into account, 0-1.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "priority": {
+      "description": "Triage priority, 0-100: the score blended with corroboration, target sensitivity and how many routes share the entry point. This is the order of the list.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "priorityFactors": {
+      "description": "The reasons behind the priority, human-readable.",
+      "items": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "priorityLabel": {
+      "description": "Priority band: P1, P2 or P3. P1 is what to fix first.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "priorityReason": {
+      "description": "One sentence saying why the route is in its band, when a fact put it there; null when the blended number did.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "profileScores": {
+      "description": "The score against each attacker profile.",
+      "items": {
+        "properties": {
+          "prior": {
+            "description": "How likely this profile is assumed to be, 0-1.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "profile": {
+            "description": "Attacker profile: commodity, criminal or apt.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "score": {
+            "description": "Probability this profile completes the route, 0-1.",
+            "type": [
+              "number",
+              "null"
+            ]
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "remediations": {
+      "description": "Ways to close the route.",
+      "items": {
+        "properties": {
+          "content": {
+            "description": "The fix itself: the code or the policy to apply.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "cut": {
+            "description": "The relationship this fix removes; null when it removes none. Pass it to simulate_fix as one of `cuts` to see what the fix would do.",
+            "properties": {
+              "from": {
+                "description": "Node id the relationship starts at.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "to": {
+                "description": "Node id it ends at.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "type": {
+                "description": "The relationship type.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "type": [
+              "object",
+              "null"
+            ]
+          },
+          "kind": {
+            "description": "The form the fix takes, e.g. terraform.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "rationale": {
+            "description": "Why this closes the route.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "title": {
+            "description": "What to change, in a line.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "runtimeConfirmed": {
+      "description": "True when a runtime alert sits on the route.",
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "score": {
+      "description": "End-to-end probability that an attacker completes the route, 0-1. A modelled estimate, not a measured rate: see get_score_trust.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "scoreCiHigh": {
+      "description": "High end of the same interval.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "scoreCiLow": {
+      "description": "Low end of the 90% credible interval around posteriorMean. A wide interval means the score rests on soft inputs.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "scoreUpperBound": {
+      "description": "The score if the hops fail or succeed together rather than independently: the weakest hop's probability.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "steps": {
+      "description": "The hops, in order. Each is one relationship an attacker crosses.",
+      "items": {
+        "properties": {
+          "attack": {
+            "description": "The MITRE ATT&CK technique the hop maps to; null when none applies.",
+            "properties": {
+              "id": {
+                "description": "Technique id, e.g. T1190.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "name": {
+                "description": "Technique name.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "tactic": {
+                "description": "The tactic it serves, e.g. Initial Access.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "type": [
+              "object",
+              "null"
+            ]
+          },
+          "edgeType": {
+            "description": "The relationship, e.g. EXPOSES, ASSUMES, HAS_PERMISSION, CAN_ESCALATE_TO.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "from": {
+            "description": "Node id the hop starts at. Usable as `from` in a simulate_fix cut.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "probability": {
+            "description": "Probability an attacker crosses this hop, 0-1.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "to": {
+            "description": "Node id the hop ends at. Usable as `to` in a simulate_fix cut.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "weightBasis": {
+            "description": "Where that probability came from: kev, epss or runtime are observed evidence; cvss, severity or heuristic are estimates.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "weightConfidence": {
+            "description": "How far to trust that probability, 0-1, given its basis.",
+            "type": [
+              "number",
+              "null"
+            ]
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "suppressed": {
+      "description": "True when an analyst has triaged the route off the board (accepted risk, false positive). It still exists, but do not present it as open work.",
+      "type": [
+        "boolean",
+        "null"
+      ]
+    }
+  },
+  "required": [
+    "id"
+  ],
+  "type": "object"
+}

First observedSep 15, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the bar is lower, and the description adds real behavioral context: the distinction between observed evidence sources (kev/epss/runtime) and estimates (cvss/severity/heuristic). It does not mention rate limits, error behavior, or latency, but the provenance semantics are the key non-obvious trait.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first front-loads the returned content, the second front-loads the usage trigger. The dense parenthetical earns its place by disambiguating evidence versus estimate, and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and 100% parameter coverage, the definition only needs to add decision-relevant framing, which it does via the provenance interpretation guidance. Nothing an agent needs to invoke this correctly or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter path_id is fully documented in the schema, including the lifetime/closed-route caveat. The description adds nothing about the parameter itself, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('explain_attack_path' / 'give the full kill chain for one route') and enumerates exactly what is returned: every hop, relationship type, hop probability, probability provenance, and MITRE ATT&CK technique. This is clearly distinguishable from sibling list_attack_paths (which only enumerates routes) and routes_to_target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it: 'Use this before explaining or acting on a route', establishing it as a prerequisite step over acting directly on a path. It does not name an alternative tool or state when-not to use it, so it falls short of the 5-level routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server