UltraProbe
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MISP_URL | Yes | Base URL of your MISP instance (e.g. https://misp.example.com) | |
| MISP_API_KEY | Yes | MISP automation API key (Profile → Auth Keys) | |
| MISP_INSECURE_TLS | No | Set to true only for self-signed dev instances | false |
| PROMPT_DEFENSE_DISABLED | No | Set true to skip output scanning (NOT recommended) | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| misp_versionA | Health check — return the MISP server version and capability flags. Use this to verify connectivity before issuing other queries. |
| misp_list_eventsA | List MISP events (most recent first). Returns event headers (id, info, date, threat level, tags). For detailed attributes, call misp_get_event with an id. Default page size is 20; max 100. |
| misp_get_eventA | Fetch a single MISP event by id, including its attributes (IOCs). The response is scanned for prompt-injection payloads before being returned. |
| misp_search_eventsA | Search MISP events by tag, type, value, category, or date range. Useful for threat hunting (e.g. all events tagged with a CVE, or matching an IOC value). |
| misp_search_attributesA | Search MISP attributes (IOCs) directly. Faster than searching events when you have a specific IOC type/value pair to look up. |
| misp_list_tagsA | List all tags configured on the MISP instance. Useful for discovering taxonomy values (TLP levels, malware families, campaign names) before running a tag-scoped search. |
| misp_list_feedsA | List configured MISP threat-intel feeds (enabled and disabled). Use this to understand which external sources are feeding the instance. |
| misp_list_galaxiesA | List MISP galaxies (threat actor profiles, campaign clusters, technique catalogs). Galaxies are MISP's structured representation of MITRE ATT&CK, threat actors, etc. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct operation: event retrieval, listing, feed listing, galaxy listing, tag listing, attribute search, event search, and health check. No overlap in purpose.
All tools follow a consistent 'misp_verb_noun' pattern using snake_case, with clear verbs (get, list, search) and nouns describing the resource.
8 tools is appropriate for a read-focused MISP client, covering key browsing and search operations without being excessive or insufficient.
Covers essential reading operations (events, attributes, feeds, galaxies, tags) but lacks any creation, update, or deletion tools, limiting its usefulness for full MISP workflows.