list_rules

Instructions

Implementation Reference

• src/tools/rules.ts:41-87 (handler)

  The async handler function that executes the 'list_rules' tool logic — builds query params (level, group, limit, offset, sort), calls client.getRules(), maps results to a clean JSON response, and handles errors.

  async ({ level, group, limit, offset, sort }) => {
    try {
      const params: Record<string, string | number> = { limit, offset };
      if (level !== undefined) params.level = level;
      if (group) params.group = group;
      if (sort) params.sort = sort;
  
      const response = await client.getRules(params);
      const data = response.data;
  
      const result = {
        rules: data.affected_items.map((rule) => ({
          id: rule.id,
          description: rule.description,
          level: rule.level,
          groups: rule.groups,
          pci_dss: rule.pci_dss,
          gdpr: rule.gdpr,
          gpg13: rule.gpg13,
          hipaa: rule.hipaa,
          nist_800_53: rule.nist_800_53,
          tsc: rule.tsc,
          mitre: rule.mitre,
          details: rule.details,
        })),
        total: data.total_affected_items,
        limit,
        offset,
      };
  
      return {
        content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify({
              error: error instanceof Error ? error.message : String(error),
            }),
          },
        ],
        isError: true,
      };
    }
  }

• src/tools/rules.ts:9-88 (registration)

  Registration of the 'list_rules' tool on the McpServer via server.tool() with name 'list_rules', description, Zod schema for inputs, and the handler callback.

  server.tool(
    "list_rules",
    "List all Wazuh rules with optional level and group filtering",
    {
      level: z
        .number()
        .int()
        .min(0)
        .optional()
        .describe("Filter by rule severity level"),
      group: z
        .string()
        .optional()
        .describe("Filter by rule group name"),
      limit: z
        .number()
        .int()
        .min(1)
        .max(100)
        .default(10)
        .describe("Maximum number of rules to return (1-100)"),
      offset: z
        .number()
        .int()
        .min(0)
        .default(0)
        .describe("Pagination offset"),
      sort: z
        .string()
        .optional()
        .describe("Sort field with direction prefix (e.g., '-level')"),
    },
    async ({ level, group, limit, offset, sort }) => {
      try {
        const params: Record<string, string | number> = { limit, offset };
        if (level !== undefined) params.level = level;
        if (group) params.group = group;
        if (sort) params.sort = sort;
  
        const response = await client.getRules(params);
        const data = response.data;
  
        const result = {
          rules: data.affected_items.map((rule) => ({
            id: rule.id,
            description: rule.description,
            level: rule.level,
            groups: rule.groups,
            pci_dss: rule.pci_dss,
            gdpr: rule.gdpr,
            gpg13: rule.gpg13,
            hipaa: rule.hipaa,
            nist_800_53: rule.nist_800_53,
            tsc: rule.tsc,
            mitre: rule.mitre,
            details: rule.details,
          })),
          total: data.total_affected_items,
          limit,
          offset,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/rules.ts:12-40 (schema)

  Zod input schema for the 'list_rules' tool: optional level (int >=0), optional group (string), limit (1-100, default 10), offset (int >=0, default 0), optional sort (string).

  {
    level: z
      .number()
      .int()
      .min(0)
      .optional()
      .describe("Filter by rule severity level"),
    group: z
      .string()
      .optional()
      .describe("Filter by rule group name"),
    limit: z
      .number()
      .int()
      .min(1)
      .max(100)
      .default(10)
      .describe("Maximum number of rules to return (1-100)"),
    offset: z
      .number()
      .int()
      .min(0)
      .default(0)
      .describe("Pagination offset"),
    sort: z
      .string()
      .optional()
      .describe("Sort field with direction prefix (e.g., '-level')"),
  },

• src/index.ts:41-41 (registration)

  Top-level registration call: registerRuleTools(server, client) invoked in main() to wire up the 'list_rules' tool.

  registerRuleTools(server, client);

• src/client.ts:260-264 (helper)

  Client helper method getRules() that performs the actual GET /rules API call to Wazuh with query params.

  async getRules(
    params: Record<string, string | number> = {}
  ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhRule>>> {
    return this.get("/rules", params);
  }