misp_check_warninglists

Instructions

Implementation Reference

• src/tools/warninglists.ts:12-64 (handler)

  The async handler function that executes the tool logic. It calls client.checkWarninglists(value), processes the response, and returns formatted output about whether the value appears on any warninglists.

    async ({ value }) => {
      try {
        const results = await client.checkWarninglists(value);
  
        // The API returns a map of value -> matching warninglists
        const matches = results[value] || [];
  
        if (matches.length === 0) {
          return {
            content: [
              {
                type: "text",
                text: `"${value}" does not appear on any warninglists. This does not confirm it is malicious, but it is not a known benign indicator.`,
              },
            ],
          };
        }
  
        const summary = matches.map((w) => ({
          name: w.name,
          category: w.category,
          description: w.description,
          type: w.type,
        }));
  
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify(
                {
                  value,
                  on_warninglists: true,
                  match_count: matches.length,
                  warninglists: summary,
                  note: "This value appears on known benign/false positive lists. Exercise caution before treating it as malicious.",
                },
                null,
                2
              ),
            },
          ],
        };
      } catch (err) {
        return {
          content: [
            { type: "text", text: `Error checking warninglists: ${err instanceof Error ? err.message : String(err)}` },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/warninglists.ts:9-10 (schema)

  Zod schema defining the input: a 'value' string (IP, domain, hash, etc.) to check against warninglists.

  {
    value: z.string().describe("Value to check against warninglists (IP, domain, hash, etc.)"),

• src/tools/warninglists.ts:5-64 (registration)

  The registration function registerWarninglistTools that registers the tool via server.tool() with name 'misp_check_warninglists'. Called from src/index.ts line 37.

  export function registerWarninglistTools(server: McpServer, client: MispClient): void {
    server.tool(
      "misp_check_warninglists",
      "Check if an observable value appears on any MISP warninglists (known benign/false positive lists)",
      {
        value: z.string().describe("Value to check against warninglists (IP, domain, hash, etc.)"),
      },
      async ({ value }) => {
        try {
          const results = await client.checkWarninglists(value);
  
          // The API returns a map of value -> matching warninglists
          const matches = results[value] || [];
  
          if (matches.length === 0) {
            return {
              content: [
                {
                  type: "text",
                  text: `"${value}" does not appear on any warninglists. This does not confirm it is malicious, but it is not a known benign indicator.`,
                },
              ],
            };
          }
  
          const summary = matches.map((w) => ({
            name: w.name,
            category: w.category,
            description: w.description,
            type: w.type,
          }));
  
          return {
            content: [
              {
                type: "text",
                text: JSON.stringify(
                  {
                    value,
                    on_warninglists: true,
                    match_count: matches.length,
                    warninglists: summary,
                    note: "This value appears on known benign/false positive lists. Exercise caution before treating it as malicious.",
                  },
                  null,
                  2
                ),
              },
            ],
          };
        } catch (err) {
          return {
            content: [
              { type: "text", text: `Error checking warninglists: ${err instanceof Error ? err.message : String(err)}` },
            ],
            isError: true,
          };
        }
      }
    );

• src/client.ts:390-396 (helper)

  The client helper method checkWarninglists() that sends a POST request to /warninglists/checkValue with the value to check.

  async checkWarninglists(value: string): Promise<WarninglistCheckResponse> {
    return this.request<WarninglistCheckResponse>(
      "POST",
      "/warninglists/checkValue",
      [value]
    );
  }

• src/types.ts:192-199 (schema)

  The MispWarninglistMatch interface defining the structure of a warninglist match, and the WarninglistCheckResponse type (line 235-237) mapping values to arrays of matches.

  export interface MispWarninglistMatch {
    id: string;
    name: string;
    type: string;
    description: string;
    category: string;
    warninglist_entry_count: string;
  }