get_agent_ports

Instructions

Implementation Reference

• src/tools/syscollector.ts:184-244 (handler)

  The tool registration and handler logic for 'get_agent_ports'. Defines the tool with name, description, schema (agent_id, limit, offset), and handler function that calls client.getAgentPorts() and maps the response to a formatted result.

  server.tool(
    "get_agent_ports",
    "List open network ports on a Wazuh agent",
    {
      agent_id: z
        .string()
        .describe("Agent identifier (e.g., '001')"),
      limit: z
        .number()
        .int()
        .min(1)
        .max(500)
        .default(25)
        .describe("Maximum number of ports to return (1-500)"),
      offset: z
        .number()
        .int()
        .min(0)
        .default(0)
        .describe("Pagination offset"),
    },
    async ({ agent_id, limit, offset }) => {
      try {
        const response = await client.getAgentPorts(agent_id, { limit, offset });
        const data = response.data;
  
        const result = {
          agent_id,
          ports: data.affected_items.map((port) => ({
            protocol: port.protocol,
            local_ip: port.local_ip,
            local_port: port.local_port,
            remote_ip: port.remote_ip,
            remote_port: port.remote_port,
            state: port.state,
            pid: port.pid,
            process: port.process,
          })),
          total: data.total_affected_items,
          limit,
          offset,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/syscollector.ts:187-204 (schema)

  Input schema for 'get_agent_ports' using Zod validation: agent_id (string), limit (int 1-500, default 25), offset (int 0+, default 0).

  {
    agent_id: z
      .string()
      .describe("Agent identifier (e.g., '001')"),
    limit: z
      .number()
      .int()
      .min(1)
      .max(500)
      .default(25)
      .describe("Maximum number of ports to return (1-500)"),
    offset: z
      .number()
      .int()
      .min(0)
      .default(0)
      .describe("Pagination offset"),
  },

• src/client.ts:324-329 (helper)

  Client method getAgentPorts() that makes the HTTP GET request to /syscollector/{agentId}/ports.

  async getAgentPorts(
    agentId: string,
    params: Record<string, string | number> = {}
  ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhPort>>> {
    return this.get(`/syscollector/${agentId}/ports`, params);
  }

• src/types.ts:245-257 (helper)

  The WazuhPort interface describing the structure of port data returned from the API.

  export interface WazuhPort {
    protocol?: string;
    local_ip?: string;
    local_port?: number;
    remote_ip?: string;
    remote_port?: number;
    tx_queue?: number;
    rx_queue?: number;
    state?: string;
    pid?: number;
    process?: string;
    inode?: number;
  }

• src/index.ts:12-16 (registration)

  Import statement for registerSyscollectorTools in the main entry point.

  import { registerSyscollectorTools } from "./tools/syscollector.js";
  import { registerRootcheckTools } from "./tools/rootcheck.js";
  import { registerSyscheckTools } from "./tools/syscheck.js";
  import { registerManagerTools } from "./tools/manager.js";
  import { registerGroupTools } from "./tools/groups.js";