cortex_list_analyzers

Instructions

Implementation Reference

• src/tools/analyzers.ts:35-73 (handler)

  The handler function for cortex_list_analyzers: fetches all enabled analyzers via client.listAnalyzers(), optionally filters by dataType, maps to a summary (id, name, version, description, dataTypes), and returns JSON.

    async ({ dataType }) => {
      try {
        let analyzers = await client.listAnalyzers();
  
        if (dataType) {
          analyzers = analyzers.filter((a) =>
            a.dataTypeList.includes(dataType),
          );
        }
  
        const summary = analyzers.map((a) => ({
          id: a.id,
          name: a.name,
          version: a.version,
          description: a.description,
          dataTypes: a.dataTypeList,
        }));
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(summary, null, 2),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: `Error listing analyzers: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
          isError: true,
        };
      }
    },
  );

• src/tools/analyzers.ts:27-34 (schema)

  Input schema for cortex_list_analyzers: accepts an optional dataType string parameter to filter analyzers by supported data type.

  {
    dataType: z
      .string()
      .optional()
      .describe(
        "Filter by supported data type (ip, domain, hash, url, file, mail, fqdn, etc.)",
      ),
  },

• src/tools/analyzers.ts:24-73 (registration)

  Registration of the cortex_list_analyzers tool on the MCP server via server.tool() within the registerAnalyzerTools function.

  server.tool(
    "cortex_list_analyzers",
    "List all enabled analyzers, optionally filtered by data type",
    {
      dataType: z
        .string()
        .optional()
        .describe(
          "Filter by supported data type (ip, domain, hash, url, file, mail, fqdn, etc.)",
        ),
    },
    async ({ dataType }) => {
      try {
        let analyzers = await client.listAnalyzers();
  
        if (dataType) {
          analyzers = analyzers.filter((a) =>
            a.dataTypeList.includes(dataType),
          );
        }
  
        const summary = analyzers.map((a) => ({
          id: a.id,
          name: a.name,
          version: a.version,
          description: a.description,
          dataTypes: a.dataTypeList,
        }));
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(summary, null, 2),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: `Error listing analyzers: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
          isError: true,
        };
      }
    },
  );

• src/index.ts:34-34 (registration)

  Top-level entry point where registerAnalyzerTools (which registers cortex_list_analyzers) is called in the application main().

  registerAnalyzerTools(server, client);

• src/client.ts:137-139 (helper)

  CortexClient helper method that makes an HTTP GET request to /api/analyzer to fetch the list of enabled analyzers from the Cortex API.

  async listAnalyzers(): Promise<Analyzer[]> {
    return this.request<Analyzer[]>("/analyzer");
  }