cortex_run_analyzer_by_name

Instructions

Implementation Reference

• src/tools/analyzers.ts:196-252 (handler)

  Handler function for the cortex_run_analyzer_by_name tool. It looks up an analyzer by name (case-insensitive) and data type, then submits a job via client.runAnalyzer(). Returns the job ID and status.

  async ({ analyzerName, dataType, data, tlp, pap }) => {
    try {
      const analyzers = await client.listAnalyzers();
      const match = analyzers.find(
        (a) =>
          a.name.toLowerCase().includes(analyzerName.toLowerCase()) &&
          a.dataTypeList.includes(dataType),
      );
  
      if (!match) {
        return {
          content: [
            {
              type: "text" as const,
              text: `No analyzer found matching "${analyzerName}" that supports data type "${dataType}". Use cortex_list_analyzers to see available analyzers.`,
            },
          ],
          isError: true,
        };
      }
  
      const job = await client.runAnalyzer(match.id, {
        data,
        dataType,
        tlp,
        pap,
      });
  
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify(
              {
                jobId: job.id,
                status: job.status,
                analyzerUsed: { id: match.id, name: match.name },
                message: `Analysis job submitted to "${match.name}". Use cortex_wait_and_get_report with jobId "${job.id}" to get results.`,
              },
              null,
              2,
            ),
          },
        ],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text" as const,
            text: `Error running analyzer by name: ${error instanceof Error ? error.message : String(error)}`,
          },
        ],
        isError: true,
      };
    }
  },

• src/tools/analyzers.ts:177-195 (schema)

  Input schema for the tool: analyzerName, dataType, data, tlp (default 2/AMBER), and pap (default 2).

  {
    analyzerName: z.string().describe("The analyzer name to search for"),
    dataType: z.enum(DATA_TYPES).describe("The observable data type"),
    data: z.string().describe("The observable value"),
    tlp: z
      .number()
      .int()
      .min(0)
      .max(3)
      .default(2)
      .describe("Traffic Light Protocol level (default: 2/AMBER)"),
    pap: z
      .number()
      .int()
      .min(0)
      .max(3)
      .default(2)
      .describe("Permissible Actions Protocol level (default: 2)"),
  },

• src/tools/analyzers.ts:174-253 (registration)

  Registration of the tool via server.tool() with the name 'cortex_run_analyzer_by_name' and a description.

  server.tool(
    "cortex_run_analyzer_by_name",
    "Run an analyzer by name instead of ID (convenience wrapper)",
    {
      analyzerName: z.string().describe("The analyzer name to search for"),
      dataType: z.enum(DATA_TYPES).describe("The observable data type"),
      data: z.string().describe("The observable value"),
      tlp: z
        .number()
        .int()
        .min(0)
        .max(3)
        .default(2)
        .describe("Traffic Light Protocol level (default: 2/AMBER)"),
      pap: z
        .number()
        .int()
        .min(0)
        .max(3)
        .default(2)
        .describe("Permissible Actions Protocol level (default: 2)"),
    },
    async ({ analyzerName, dataType, data, tlp, pap }) => {
      try {
        const analyzers = await client.listAnalyzers();
        const match = analyzers.find(
          (a) =>
            a.name.toLowerCase().includes(analyzerName.toLowerCase()) &&
            a.dataTypeList.includes(dataType),
        );
  
        if (!match) {
          return {
            content: [
              {
                type: "text" as const,
                text: `No analyzer found matching "${analyzerName}" that supports data type "${dataType}". Use cortex_list_analyzers to see available analyzers.`,
              },
            ],
            isError: true,
          };
        }
  
        const job = await client.runAnalyzer(match.id, {
          data,
          dataType,
          tlp,
          pap,
        });
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(
                {
                  jobId: job.id,
                  status: job.status,
                  analyzerUsed: { id: match.id, name: match.name },
                  message: `Analysis job submitted to "${match.name}". Use cortex_wait_and_get_report with jobId "${job.id}" to get results.`,
                },
                null,
                2,
              ),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: `Error running analyzer by name: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
          isError: true,
        };
      }
    },
  );

• src/tools/analyzers.ts:20-23 (registration)

  Exported function called from src/index.ts to register all analyzer tools on the MCP server.

  export function registerAnalyzerTools(
    server: McpServer,
    client: CortexClient,
  ): void {

• src/index.ts:5-34 (registration)

  Import and invocation of registerAnalyzerTools from the main entry point.

  import { registerAnalyzerTools } from "./tools/analyzers.js";
  import { registerAnalyzerDefinitionTools } from "./tools/analyzer-definitions.js";
  import { registerJobTools } from "./tools/jobs.js";
  import { registerResponderTools } from "./tools/responders.js";
  import { registerResponderDefinitionTools } from "./tools/responder-definitions.js";
  import { registerBulkTools } from "./tools/bulk.js";
  import { registerStatusTools } from "./tools/status.js";
  import { registerOrganizationTools } from "./tools/organizations.js";
  import { registerUserTools } from "./tools/users.js";
  import { registerResources } from "./resources.js";
  import { registerPrompts } from "./prompts.js";
  
  async function main(): Promise<void> {
    const config = getConfig();
  
    if (!config.verifySsl) {
      process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
    }
  
    const server = new McpServer({
      name: "cortex-mcp",
      version: "1.2.0",
      description:
        "MCP server for Cortex - observable analysis and active response engine by StrangeBee/TheHive Project",
    });
  
    const client = new CortexClient(config);
  
    // Core analysis tools
    registerAnalyzerTools(server, client);