misp_list_galaxies

Instructions

Implementation Reference

• src/tools/galaxies.ts:22-74 (handler)

  The handler function for the 'misp_list_galaxies' tool. It calls client.listGalaxies(), optionally filters by search (name/type/description) and namespace (type), then returns a formatted JSON summary of matching galaxies (id, name, type, description truncated to 150 chars). Errors are caught and returned as isError.

  async ({ search, namespace }) => {
    try {
      const galaxies = await client.listGalaxies();
      let filtered = galaxies;
  
      if (search) {
        const q = search.toLowerCase();
        filtered = filtered.filter(
          (g) =>
            g.name.toLowerCase().includes(q) ||
            g.type.toLowerCase().includes(q) ||
            g.description.toLowerCase().includes(q)
        );
      }
  
      if (namespace) {
        const ns = namespace.toLowerCase();
        filtered = filtered.filter((g) =>
          g.type.toLowerCase().includes(ns)
        );
      }
  
      if (filtered.length === 0) {
        return {
          content: [{ type: "text", text: "No galaxies found matching the criteria." }],
        };
      }
  
      const summary = filtered.map((g) => ({
        id: g.id,
        name: g.name,
        type: g.type,
        description:
          g.description.length > 150
            ? g.description.slice(0, 150) + "..."
            : g.description,
      }));
  
      return {
        content: [{ type: "text", text: JSON.stringify(summary, null, 2) }],
      };
    } catch (err) {
      return {
        content: [
          {
            type: "text",
            text: `Error listing galaxies: ${err instanceof Error ? err.message : String(err)}`,
          },
        ],
        isError: true,
      };
    }
  }

• src/tools/galaxies.ts:10-21 (schema)

  Input schema for 'misp_list_galaxies' using Zod: optional 'search' (filter by name/type/description) and optional 'namespace' (filter by galaxy type, e.g. mitre-attack-pattern).

  {
    search: z
      .string()
      .optional()
      .describe("Filter galaxies by name or type"),
    namespace: z
      .string()
      .optional()
      .describe(
        "Filter by namespace (e.g., mitre-attack-pattern, mitre-intrusion-set, mitre-malware)"
      ),
  },

• src/tools/galaxies.ts:5-75 (registration)

  The tool is registered via server.tool('misp_list_galaxies', ...) inside registerGalaxyTools(). This function is exported and called from src/index.ts line 39.

  export function registerGalaxyTools(server: McpServer, client: MispClient): void {
    // List galaxies
    server.tool(
      "misp_list_galaxies",
      "List available MISP galaxies (MITRE ATT&CK, threat actors, malware families, tools, etc.)",
      {
        search: z
          .string()
          .optional()
          .describe("Filter galaxies by name or type"),
        namespace: z
          .string()
          .optional()
          .describe(
            "Filter by namespace (e.g., mitre-attack-pattern, mitre-intrusion-set, mitre-malware)"
          ),
      },
      async ({ search, namespace }) => {
        try {
          const galaxies = await client.listGalaxies();
          let filtered = galaxies;
  
          if (search) {
            const q = search.toLowerCase();
            filtered = filtered.filter(
              (g) =>
                g.name.toLowerCase().includes(q) ||
                g.type.toLowerCase().includes(q) ||
                g.description.toLowerCase().includes(q)
            );
          }
  
          if (namespace) {
            const ns = namespace.toLowerCase();
            filtered = filtered.filter((g) =>
              g.type.toLowerCase().includes(ns)
            );
          }
  
          if (filtered.length === 0) {
            return {
              content: [{ type: "text", text: "No galaxies found matching the criteria." }],
            };
          }
  
          const summary = filtered.map((g) => ({
            id: g.id,
            name: g.name,
            type: g.type,
            description:
              g.description.length > 150
                ? g.description.slice(0, 150) + "..."
                : g.description,
          }));
  
          return {
            content: [{ type: "text", text: JSON.stringify(summary, null, 2) }],
          };
        } catch (err) {
          return {
            content: [
              {
                type: "text",
                text: `Error listing galaxies: ${err instanceof Error ? err.message : String(err)}`,
              },
            ],
            isError: true,
          };
        }
      }
    );

• src/client.ts:539-546 (helper)

  The client.listGalaxies() helper method that makes a GET request to /galaxies endpoint and maps the response to extract Galaxy objects (id, name, type, description, uuid).

  async listGalaxies(): Promise<
    Array<{ id: string; name: string; type: string; description: string; uuid: string }>
  > {
    const data = await this.request<
      Array<{ Galaxy: { id: string; name: string; type: string; description: string; uuid: string } }>
    >("GET", "/galaxies");
    return (data || []).map((g) => g.Galaxy);
  }

• src/index.ts:39-39 (registration)

  Main entry point registration: registerGalaxyTools(server, client) called in src/index.ts to wire up the tool.

  registerGalaxyTools(server, client);