cortex_list_analyzer_definitions

Instructions

Implementation Reference

• src/tools/analyzer-definitions.ts:33-104 (handler)

  The handler function for the cortex_list_analyzer_definitions tool. It calls client.listAnalyzerDefinitions(), then filters by dataType, freeOnly, and search, applies a limit, maps results to a summary format, and returns JSON.

    async ({ dataType, freeOnly, search, limit }) => {
      try {
        let defs = await client.listAnalyzerDefinitions();
  
        if (dataType) {
          defs = defs.filter((d) => d.dataTypeList.includes(dataType));
        }
  
        if (freeOnly) {
          defs = defs.filter(
            (d) => !d.configurationItems.some((c) => c.required),
          );
        }
  
        if (search) {
          const q = search.toLowerCase();
          defs = defs.filter(
            (d) =>
              d.name.toLowerCase().includes(q) ||
              d.description.toLowerCase().includes(q),
          );
        }
  
        const total = defs.length;
        defs = defs.slice(0, limit);
  
        const summary = defs.map((d) => ({
          id: d.id,
          name: d.name,
          version: d.version,
          description: d.description,
          dataTypes: d.dataTypeList,
          author: d.author,
          requiresConfig: d.configurationItems.some((c) => c.required),
          configFields: d.configurationItems.map((c) => ({
            name: c.name,
            required: c.required,
            type: c.type,
            description: c.description,
          })),
          dockerImage: d.dockerImage,
        }));
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(
                {
                  total,
                  returned: summary.length,
                  definitions: summary,
                },
                null,
                2,
              ),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: `Error listing analyzer definitions: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
          isError: true,
        };
      }
    },
  );

• src/tools/analyzer-definitions.ts:12-32 (schema)

  Zod schema for the cortex_list_analyzer_definitions tool inputs: dataType (optional string), freeOnly (optional boolean), search (optional string), limit (optional int, default 50, max 500).

  {
    dataType: z
      .string()
      .optional()
      .describe("Filter by supported data type (ip, domain, hash, url, file, mail, fqdn, etc.)"),
    freeOnly: z
      .boolean()
      .optional()
      .describe("If true, only return analyzers that require no configuration/API keys"),
    search: z
      .string()
      .optional()
      .describe("Search analyzer names and descriptions (case-insensitive)"),
    limit: z
      .number()
      .int()
      .min(1)
      .max(500)
      .default(50)
      .describe("Maximum results to return (default: 50)"),
  },

• src/tools/analyzer-definitions.ts:5-10 (registration)

  The registerAnalyzerDefinitionTools function is where the tool 'cortex_list_analyzer_definitions' is registered on the MCP server via server.tool(). Called from src/index.ts:40.

  export function registerAnalyzerDefinitionTools(
    server: McpServer,
    client: CortexClient,
  ): void {
    server.tool(
      "cortex_list_analyzer_definitions",

• src/client.ts:225-227 (helper)

  The client.listAnalyzerDefinitions() method that makes the GET request to /api/analyzerdefinition (with superadmin auth). This is the helper that fetches the raw data from the Cortex API.

  async listAnalyzerDefinitions(): Promise<AnalyzerDefinition[]> {
    return this.request<AnalyzerDefinition[]>("/analyzerdefinition", {}, true);
  }

• src/types.ts:24-37 (helper)

  The AnalyzerDefinition and ConfigurationItem TypeScript interfaces defining the shape of data returned from the API and used by the handler.

  export interface AnalyzerDefinition {
    id: string;
    name: string;
    version: string;
    description: string;
    dataTypeList: string[];
    author: string;
    url: string;
    license: string;
    baseConfig: string;
    configurationItems: ConfigurationItem[];
    dockerImage: string | null;
    command: string | null;
  }