misp_get_galaxy

Instructions

Implementation Reference

• src/tools/galaxies.ts:77-121 (handler)

  The 'misp_get_galaxy' tool handler function registered on the MCP server. It accepts a 'galaxyId' string parameter, calls client.getGalaxy(galaxyId), and returns the galaxy with its clusters (id, uuid, name, type, description, clusters array, cluster_count).

  // Get galaxy clusters
  server.tool(
    "misp_get_galaxy",
    "Get a specific galaxy with its clusters (e.g., MITRE ATT&CK techniques, threat actor profiles)",
    {
      galaxyId: z.string().describe("Galaxy ID to retrieve"),
    },
    async ({ galaxyId }) => {
      try {
        const galaxy = await client.getGalaxy(galaxyId);
  
        const result = {
          id: galaxy.id,
          uuid: galaxy.uuid,
          name: galaxy.name,
          type: galaxy.type,
          description: galaxy.description,
          clusters: (galaxy.GalaxyCluster || []).map((c) => ({
            id: c.id,
            value: c.value,
            description:
              c.description && c.description.length > 200
                ? c.description.slice(0, 200) + "..."
                : c.description,
            tag_name: c.tag_name,
          })),
          cluster_count: (galaxy.GalaxyCluster || []).length,
        };
  
        return {
          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error getting galaxy: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/galaxies.ts:81-83 (schema)

  The input schema for 'misp_get_galaxy' - a single required parameter 'galaxyId' of type string validated with Zod.

  {
    galaxyId: z.string().describe("Galaxy ID to retrieve"),
  },

• src/tools/galaxies.ts:78-121 (registration)

  The tool is registered via server.tool() call in the registerGalaxyTools function, with name 'misp_get_galaxy' and description.

  server.tool(
    "misp_get_galaxy",
    "Get a specific galaxy with its clusters (e.g., MITRE ATT&CK techniques, threat actor profiles)",
    {
      galaxyId: z.string().describe("Galaxy ID to retrieve"),
    },
    async ({ galaxyId }) => {
      try {
        const galaxy = await client.getGalaxy(galaxyId);
  
        const result = {
          id: galaxy.id,
          uuid: galaxy.uuid,
          name: galaxy.name,
          type: galaxy.type,
          description: galaxy.description,
          clusters: (galaxy.GalaxyCluster || []).map((c) => ({
            id: c.id,
            value: c.value,
            description:
              c.description && c.description.length > 200
                ? c.description.slice(0, 200) + "..."
                : c.description,
            tag_name: c.tag_name,
          })),
          cluster_count: (galaxy.GalaxyCluster || []).length,
        };
  
        return {
          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error getting galaxy: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/client.ts:548-565 (helper)

  The 'getGalaxy' method on MispClient that the handler calls. Makes a GET request to '/galaxies/view/{galaxyId}' and returns the galaxy object with optional GalaxyCluster array.

  async getGalaxy(galaxyId: string): Promise<{
    id: string;
    uuid: string;
    name: string;
    type: string;
    description: string;
    GalaxyCluster?: MispGalaxyCluster[];
  }> {
    const data = await this.request<{
      Galaxy: { id: string; uuid: string; name: string; type: string; description: string };
      GalaxyCluster?: MispGalaxyCluster[];
    }>("GET", `/galaxies/view/${encodeId(galaxyId, "galaxyId")}`);
  
    return {
      ...data.Galaxy,
      GalaxyCluster: data.GalaxyCluster,
    };
  }

• src/types.ts:108-117 (helper)

  The MispGalaxyCluster type definition used in the return type of getGalaxy and in the handler's cluster mapping.

  // MISP Galaxy Cluster
  export interface MispGalaxyCluster {
    id: string;
    uuid: string;
    type: string;
    value: string;
    tag_name: string;
    description: string;
    galaxy_id: string;
  }