RAD Security

Instructions

Implementation Reference

• src/operations/radql.ts:324-329 (handler)

  Handler function that executes the radql_list_filter_values tool by calling the core listFilterValues function with parsed arguments.

  export async function executeListFilterValues(
    client: RadSecurityClient,
    args: z.infer<typeof RadQLListFilterValuesSchema>
  ): Promise<any> {
    return await listFilterValues(client, args.data_type, args.filter_name);
  }

• src/operations/radql.ts:28-36 (schema)

  Zod schema defining the input parameters for the radql_list_filter_values tool: data_type and filter_name.

  export const RadQLListFilterValuesSchema = z.object({
    data_type: z.string()
      .describe("The data type (e.g., 'containers', 'kubernetes_resources')"),
  
    filter_name: z.string()
      .describe("The filter field name to get possible values for (e.g., 'namespace', 'cluster_id', 'severity')")
  }).describe(
    "List possible values for a filter field. Useful for discovering available namespaces, clusters, severities, etc. Call this when building dynamic filters."
  );

• src/index.ts:594-597 (registration)

  Tool registration in the listTools response, defining the tool name, description, and input schema.

  name: "radql_list_filter_values",
  description:
    "List possible values for a filter field (e.g., namespace list, cluster list, severity values). Useful for building dynamic filters when you need to know available enum-like values. Call this when constructing filters that need specific values.",
  inputSchema: zodToJsonSchema(radql.RadQLListFilterValuesSchema),

• src/index.ts:1554-1564 (registration)

  Tool execution handler in the CallToolRequest switch case, parsing args and calling executeListFilterValues.

  case "radql_list_filter_values": {
    const args = radql.RadQLListFilterValuesSchema.parse(
      request.params.arguments
    );
    const response = await radql.executeListFilterValues(client, args);
    return {
      content: [
        { type: "text", text: JSON.stringify(response, null, 2) },
      ],
    };
  }

• src/operations/radql.ts:241-266 (helper)

  Core helper function that makes the API request to fetch filter values and processes the response into a clean format.

  async function listFilterValues(
    client: RadSecurityClient,
    dataType: string,
    filterName: string
  ): Promise<any> {
    const response = await client.makeRequest(
      `/accounts/${client.getAccountId()}/data/${dataType}/filters/${filterName}/values`
    );
  
    // Extract values from nested API response structure
    // API returns: { values: { items: [{data: {value, count}}] } }
    const items = response.values?.items || [];
    const values = items.map((item: any) => ({
      value: item.data?.value,
      count: item.data?.count
    }));
  
    return {
      data_type: dataType,
      filter_name: filterName,
      values: values,
      total_count: response.values?.total_count || 0,
      has_more: response.values?.has_more || false,
      hint: `Use these values in your filters_query like: ${filterName}:value`
    };
  }