cortex_list_responders

Instructions

Implementation Reference

• src/tools/responders.ts:9-56 (handler)

  The actual handler for the 'cortex_list_responders' tool. It calls client.listResponders(), optionally filters by dataType, maps responder fields to a summary, and returns JSON. On error, returns an isError response.

  server.tool(
    "cortex_list_responders",
    "List all enabled responders, optionally filtered by data type",
    {
      dataType: z
        .string()
        .optional()
        .describe("Filter by supported data type"),
    },
    async ({ dataType }) => {
      try {
        let responders = await client.listResponders();
  
        if (dataType) {
          responders = responders.filter((r) =>
            r.dataTypeList.includes(dataType),
          );
        }
  
        const summary = responders.map((r) => ({
          id: r.id,
          name: r.name,
          version: r.version,
          description: r.description,
          dataTypes: r.dataTypeList,
        }));
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(summary, null, 2),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: `Error listing responders: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
          isError: true,
        };
      }
    },
  );

• src/tools/responders.ts:12-17 (schema)

  Input schema for cortex_list_responders: an optional 'dataType' string to filter by supported data type.

  {
    dataType: z
      .string()
      .optional()
      .describe("Filter by supported data type"),
  },

• src/tools/responders.ts:5-113 (registration)

  The 'cortex_list_responders' tool is registered via server.tool() inside the registerResponderTools() function in src/tools/responders.ts.

  export function registerResponderTools(
    server: McpServer,
    client: CortexClient,
  ): void {
    server.tool(
      "cortex_list_responders",
      "List all enabled responders, optionally filtered by data type",
      {
        dataType: z
          .string()
          .optional()
          .describe("Filter by supported data type"),
      },
      async ({ dataType }) => {
        try {
          let responders = await client.listResponders();
  
          if (dataType) {
            responders = responders.filter((r) =>
              r.dataTypeList.includes(dataType),
            );
          }
  
          const summary = responders.map((r) => ({
            id: r.id,
            name: r.name,
            version: r.version,
            description: r.description,
            dataTypes: r.dataTypeList,
          }));
  
          return {
            content: [
              {
                type: "text" as const,
                text: JSON.stringify(summary, null, 2),
              },
            ],
          };
        } catch (error) {
          return {
            content: [
              {
                type: "text" as const,
                text: `Error listing responders: ${error instanceof Error ? error.message : String(error)}`,
              },
            ],
            isError: true,
          };
        }
      },
    );
  
    server.tool(
      "cortex_run_responder",
      "Execute a responder action against a TheHive entity (case, task, artifact, alert)",
      {
        responderId: z.string().describe("The responder ID to execute"),
        objectType: z
          .enum(["case", "case_task", "case_artifact", "alert"])
          .describe("The type of TheHive entity to act on"),
        objectId: z
          .string()
          .describe("The ID of the entity from TheHive"),
        parameters: z
          .record(z.string(), z.unknown())
          .optional()
          .describe("Optional responder-specific parameters"),
      },
      async ({ responderId, objectType, objectId, parameters }) => {
        try {
          const actionJob = await client.runResponder(responderId, {
            objectType,
            objectId,
            parameters,
          });
  
          return {
            content: [
              {
                type: "text" as const,
                text: JSON.stringify(
                  {
                    actionJobId: actionJob.id,
                    status: actionJob.status,
                    responderId: actionJob.responderId,
                    responderName: actionJob.responderName,
                    message: `Responder action submitted. Job ID: "${actionJob.id}"`,
                  },
                  null,
                  2,
                ),
              },
            ],
          };
        } catch (error) {
          return {
            content: [
              {
                type: "text" as const,
                text: `Error running responder: ${error instanceof Error ? error.message : String(error)}`,
              },
            ],
            isError: true,
          };
        }
      },
    );
  }

• src/index.ts:8-36 (registration)

  Import and call to registerResponderTools() in the main index.ts to wire up the tool on the MCP server.

  import { registerResponderTools } from "./tools/responders.js";
  import { registerResponderDefinitionTools } from "./tools/responder-definitions.js";
  import { registerBulkTools } from "./tools/bulk.js";
  import { registerStatusTools } from "./tools/status.js";
  import { registerOrganizationTools } from "./tools/organizations.js";
  import { registerUserTools } from "./tools/users.js";
  import { registerResources } from "./resources.js";
  import { registerPrompts } from "./prompts.js";
  
  async function main(): Promise<void> {
    const config = getConfig();
  
    if (!config.verifySsl) {
      process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
    }
  
    const server = new McpServer({
      name: "cortex-mcp",
      version: "1.2.0",
      description:
        "MCP server for Cortex - observable analysis and active response engine by StrangeBee/TheHive Project",
    });
  
    const client = new CortexClient(config);
  
    // Core analysis tools
    registerAnalyzerTools(server, client);
    registerJobTools(server, client);
    registerResponderTools(server, client);

• src/client.ts:324-326 (helper)

  The client helper method client.listResponders() that makes the HTTP GET request to /responder and returns a list of Responder objects.

  async listResponders(): Promise<Responder[]> {
    return this.request<Responder[]>("/responder");
  }