list_decoders
Retrieve a list of Wazuh decoders with optional filtering by name, pagination, and sorting to manage detection rules efficiently.
Instructions
List all available Wazuh decoders with optional name filtering
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Filter by decoder name | |
| limit | No | Maximum number of decoders to return (1-100) | |
| offset | No | Pagination offset | |
| sort | No | Sort field with direction prefix (e.g., '-name') |
Implementation Reference
- src/tools/decoders.ts:35-74 (handler)The async handler function that calls client.getDecoders, maps the response, and returns formatted JSON result.
async ({ name, limit, offset, sort }) => { try { const params: Record<string, string | number> = { limit, offset }; if (name) params.name = name; if (sort) params.sort = sort; const response = await client.getDecoders(params); const data = response.data; const result = { decoders: data.affected_items.map((decoder) => ({ name: decoder.name, filename: decoder.filename, relative_dirname: decoder.relative_dirname, status: decoder.status, position: decoder.position, details: decoder.details, })), total: data.total_affected_items, limit, offset, }; return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }], }; } catch (error) { return { content: [ { type: "text" as const, text: JSON.stringify({ error: error instanceof Error ? error.message : String(error), }), }, ], isError: true, }; } } - src/tools/decoders.ts:9-75 (registration)Registers the 'list_decoders' tool with MCP server, defining input schema (name, limit, offset, sort) and the handler.
server.tool( "list_decoders", "List all available Wazuh decoders with optional name filtering", { name: z .string() .optional() .describe("Filter by decoder name"), limit: z .number() .int() .min(1) .max(100) .default(10) .describe("Maximum number of decoders to return (1-100)"), offset: z .number() .int() .min(0) .default(0) .describe("Pagination offset"), sort: z .string() .optional() .describe("Sort field with direction prefix (e.g., '-name')"), }, async ({ name, limit, offset, sort }) => { try { const params: Record<string, string | number> = { limit, offset }; if (name) params.name = name; if (sort) params.sort = sort; const response = await client.getDecoders(params); const data = response.data; const result = { decoders: data.affected_items.map((decoder) => ({ name: decoder.name, filename: decoder.filename, relative_dirname: decoder.relative_dirname, status: decoder.status, position: decoder.position, details: decoder.details, })), total: data.total_affected_items, limit, offset, }; return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }], }; } catch (error) { return { content: [ { type: "text" as const, text: JSON.stringify({ error: error instanceof Error ? error.message : String(error), }), }, ], isError: true, }; } } ); - src/tools/decoders.ts:12-34 (schema)Zod schema for 'list_decoders' input: optional name filter, limit (1-100, default 10), offset (default 0), optional sort.
{ name: z .string() .optional() .describe("Filter by decoder name"), limit: z .number() .int() .min(1) .max(100) .default(10) .describe("Maximum number of decoders to return (1-100)"), offset: z .number() .int() .min(0) .default(0) .describe("Pagination offset"), sort: z .string() .optional() .describe("Sort field with direction prefix (e.g., '-name')"), }, - src/client.ts:274-278 (helper)Client method getDecoders that makes the GET /decoders API call with params.
async getDecoders( params: Record<string, string | number> = {} ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhDecoder>>> { return this.get("/decoders", params); } - src/types.ts:136-143 (helper)Type definition for WazuhDecoder interface used to type the response.
export interface WazuhDecoder { name: string; details?: Record<string, unknown>; filename?: string; relative_dirname?: string; status?: string; position?: number; }