misp_add_attributes_bulk

Instructions

Implementation Reference

• src/tools/attributes.ts:144-199 (handler)

  The handler function for misp_add_attributes_bulk that iterates over the attributes array, calls client.addAttribute() for each, collects results (success/failure), and returns a JSON summary.

  async ({ eventId, attributes }) => {
    try {
      const results: Array<{ value: string; type: string; id?: string; error?: string }> = [];
  
      for (const attr of attributes) {
        try {
          const created = await client.addAttribute(eventId, {
            type: attr.type,
            value: attr.value,
            category: attr.category,
            to_ids: attr.toIds,
            comment: attr.comment,
          });
          results.push({
            value: attr.value,
            type: attr.type,
            id: created.id,
          });
        } catch (err) {
          results.push({
            value: attr.value,
            type: attr.type,
            error: err instanceof Error ? err.message : String(err),
          });
        }
      }
  
      const succeeded = results.filter((r) => r.id);
      const failed = results.filter((r) => r.error);
  
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify(
              {
                total: attributes.length,
                succeeded: succeeded.length,
                failed: failed.length,
                results,
              },
              null,
              2
            ),
          },
        ],
      };
    } catch (err) {
      return {
        content: [
          { type: "text", text: `Error adding attributes: ${err instanceof Error ? err.message : String(err)}` },
        ],
        isError: true,
      };
    }
  }

• src/tools/attributes.ts:128-143 (schema)

  The tool registration and schema definition for misp_add_attributes_bulk, including the input schema (eventId: string, attributes: array of objects with type, value, category, toIds, comment) using Zod validation.

  // Bulk add attributes
  server.tool(
    "misp_add_attributes_bulk",
    "Add multiple attributes (IOCs) to a MISP event at once",
    {
      eventId: z.string().describe("Event ID to add attributes to"),
      attributes: z.array(
        z.object({
          type: z.string().describe("Attribute type"),
          value: z.string().describe("IOC value"),
          category: z.string().optional().describe("Category"),
          toIds: z.boolean().optional().describe("IDS flag"),
          comment: z.string().optional().describe("Comment"),
        })
      ).describe("Array of attributes to add"),
    },

• src/tools/attributes.ts:128-200 (registration)

  The full registration block via server.tool() that binds the tool name 'misp_add_attributes_bulk' to its schema and handler within the registerAttributeTools function.

  // Bulk add attributes
  server.tool(
    "misp_add_attributes_bulk",
    "Add multiple attributes (IOCs) to a MISP event at once",
    {
      eventId: z.string().describe("Event ID to add attributes to"),
      attributes: z.array(
        z.object({
          type: z.string().describe("Attribute type"),
          value: z.string().describe("IOC value"),
          category: z.string().optional().describe("Category"),
          toIds: z.boolean().optional().describe("IDS flag"),
          comment: z.string().optional().describe("Comment"),
        })
      ).describe("Array of attributes to add"),
    },
    async ({ eventId, attributes }) => {
      try {
        const results: Array<{ value: string; type: string; id?: string; error?: string }> = [];
  
        for (const attr of attributes) {
          try {
            const created = await client.addAttribute(eventId, {
              type: attr.type,
              value: attr.value,
              category: attr.category,
              to_ids: attr.toIds,
              comment: attr.comment,
            });
            results.push({
              value: attr.value,
              type: attr.type,
              id: created.id,
            });
          } catch (err) {
            results.push({
              value: attr.value,
              type: attr.type,
              error: err instanceof Error ? err.message : String(err),
            });
          }
        }
  
        const succeeded = results.filter((r) => r.id);
        const failed = results.filter((r) => r.error);
  
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify(
                {
                  total: attributes.length,
                  succeeded: succeeded.length,
                  failed: failed.length,
                  results,
                },
                null,
                2
              ),
            },
          ],
        };
      } catch (err) {
        return {
          content: [
            { type: "text", text: `Error adding attributes: ${err instanceof Error ? err.message : String(err)}` },
          ],
          isError: true,
        };
      }
    }
  );

• src/index.ts:6-32 (registration)

  Import and invocation of registerAttributeTools() (which registers misp_add_attributes_bulk) in the main server entry point.

  import { registerAttributeTools } from "./tools/attributes.js";
  import { registerCorrelationTools } from "./tools/correlation.js";
  import { registerTagTools } from "./tools/tags.js";
  import { registerExportTools } from "./tools/exports.js";
  import { registerSightingTools } from "./tools/sightings.js";
  import { registerWarninglistTools } from "./tools/warninglists.js";
  import { registerObjectTools } from "./tools/objects.js";
  import { registerGalaxyTools } from "./tools/galaxies.js";
  import { registerFeedTools } from "./tools/feeds.js";
  import { registerOrganisationTools } from "./tools/organisations.js";
  import { registerServerTools } from "./tools/servers.js";
  import { registerResources } from "./resources.js";
  import { registerPrompts } from "./prompts.js";
  
  const config = getConfig();
  const client = new MispClient(config);
  
  const server = new McpServer({
    name: "misp-mcp",
    version: "1.2.0",
    description:
      "MCP server for MISP threat intelligence platform - IOC lookups, event management, correlation discovery, and intelligence enrichment",
  });
  
  // Register all tools
  registerEventTools(server, client);
  registerAttributeTools(server, client);