misp_search_attributes

Instructions

Implementation Reference

• src/tools/attributes.ts:5-70 (handler)

  The registerAttributeTools function registers the 'misp_search_attributes' tool on the MCP server. The handler (lines 20-69) receives search parameters, calls client.searchAttributes(), and returns a formatted JSON summary of matching attributes including event info, tags, and correlations.

  export function registerAttributeTools(server: McpServer, client: MispClient): void {
    // Search attributes
    server.tool(
      "misp_search_attributes",
      "Search for specific attributes (IOCs) across all MISP events",
      {
        value: z.string().optional().describe("IOC value to search"),
        type: z.string().optional().describe("Attribute type (ip-src, ip-dst, domain, md5, sha256, url, email-src, hostname, etc.)"),
        category: z.string().optional().describe("Category filter"),
        tags: z.array(z.string()).optional().describe("Tag filters"),
        toIds: z.boolean().optional().describe("Only IDS-flagged attributes"),
        includeCorrelations: z.boolean().optional().describe("Include correlation data"),
        last: z.string().optional().describe("Relative time filter (e.g., 1d, 7d, 30d)"),
        limit: z.number().optional().describe("Max results (default 50)"),
      },
      async (params) => {
        try {
          const attributes = await client.searchAttributes({
            value: params.value,
            type: params.type,
            category: params.category,
            tags: params.tags,
            to_ids: params.toIds,
            includeCorrelations: params.includeCorrelations,
            last: params.last,
            limit: params.limit,
          });
  
          if (attributes.length === 0) {
            return {
              content: [{ type: "text", text: "No attributes found matching the search criteria." }],
            };
          }
  
          const summary = attributes.map((a) => ({
            id: a.id,
            event_id: a.event_id,
            type: a.type,
            category: a.category,
            value: a.value,
            to_ids: a.to_ids,
            comment: a.comment || undefined,
            tags: (a.Tag || []).map((t) => t.name),
            event_info: a.Event?.info,
            correlations: a.RelatedAttribute
              ? a.RelatedAttribute.map((r) => ({
                  value: r.value,
                  type: r.type,
                  event_id: r.event_id,
                }))
              : undefined,
          }));
  
          return {
            content: [{ type: "text", text: JSON.stringify(summary, null, 2) }],
          };
        } catch (err) {
          return {
            content: [
              { type: "text", text: `Error searching attributes: ${err instanceof Error ? err.message : String(err)}` },
            ],
            isError: true,
          };
        }
      }
    );

• src/tools/attributes.ts:10-19 (schema)

  Input schema/validation for misp_search_attributes using Zod. Defines optional parameters: value, type, category, tags (string array), toIds, includeCorrelations, last, and limit.

  {
    value: z.string().optional().describe("IOC value to search"),
    type: z.string().optional().describe("Attribute type (ip-src, ip-dst, domain, md5, sha256, url, email-src, hostname, etc.)"),
    category: z.string().optional().describe("Category filter"),
    tags: z.array(z.string()).optional().describe("Tag filters"),
    toIds: z.boolean().optional().describe("Only IDS-flagged attributes"),
    includeCorrelations: z.boolean().optional().describe("Include correlation data"),
    last: z.string().optional().describe("Relative time filter (e.g., 1d, 7d, 30d)"),
    limit: z.number().optional().describe("Max results (default 50)"),
  },

• src/client.ts:257-287 (helper)

  The searchAttributes method on MispClient executes the actual API call to /attributes/restSearch, building the request body from params and returning parsed MispAttribute[] from the response.

  async searchAttributes(params: {
    value?: string;
    type?: string;
    category?: string;
    tags?: string[];
    to_ids?: boolean;
    includeCorrelations?: boolean;
    last?: string;
    limit?: number;
  }): Promise<MispAttribute[]> {
    const body: Record<string, unknown> = {
      returnFormat: "json",
      limit: params.limit ?? 50,
    };
  
    if (params.value) body.value = params.value;
    if (params.type) body.type = params.type;
    if (params.category) body.category = params.category;
    if (params.tags) body.tags = params.tags;
    if (params.to_ids !== undefined) body.to_ids = params.to_ids ? 1 : 0;
    if (params.includeCorrelations)
      body.includeCorrelations = 1;
    if (params.last) body.last = params.last;
  
    const data = await this.request<AttributeSearchResponse>(
      "POST",
      "/attributes/restSearch",
      body
    );
    return data.response?.Attribute || [];
  }

• src/index.ts:31-32 (registration)

  The tool registration is invoked in the main index.ts file via registerAttributeTools(server, client) on line 32.

  registerEventTools(server, client);
  registerAttributeTools(server, client);

• src/types.ts:206-210 (helper)

  The AttributeSearchResponse type used by the helper/searchAttributes client method to parse the API response.

  export interface AttributeSearchResponse {
    response: {
      Attribute: MispAttribute[];
    };
  }