search_rules

Instructions

Implementation Reference

• src/tools/rules.ts:181-231 (handler)

  Async handler function for search_rules tool. Takes description, limit, offset, and optional level parameters, calls client.getRules() with a search query, maps the response to a simplified rule format, and returns JSON content or error.

    async ({ description, limit, offset, level }) => {
      try {
        const params: Record<string, string | number> = {
          search: description,
          limit,
          offset,
        };
        if (level !== undefined) params.level = level;
  
        const response = await client.getRules(params);
        const data = response.data;
  
        const result = {
          rules: data.affected_items.map((rule) => ({
            id: rule.id,
            description: rule.description,
            level: rule.level,
            groups: rule.groups,
            pci_dss: rule.pci_dss,
            gdpr: rule.gdpr,
            gpg13: rule.gpg13,
            hipaa: rule.hipaa,
            nist_800_53: rule.nist_800_53,
            tsc: rule.tsc,
            mitre: rule.mitre,
            details: rule.details,
          })),
          total: data.total_affected_items,
          description,
          limit,
          offset,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/rules.ts:157-180 (schema)

  Zod schema defining the input parameters for search_rules: description (string), limit (number 1-100, default 10), offset (number 0+, default 0), level (optional number 0+).

  {
    description: z
      .string()
      .describe("Search term to match against rule descriptions"),
    limit: z
      .number()
      .int()
      .min(1)
      .max(100)
      .default(10)
      .describe("Maximum number of rules to return (1-100)"),
    offset: z
      .number()
      .int()
      .min(0)
      .default(0)
      .describe("Pagination offset"),
    level: z
      .number()
      .int()
      .min(0)
      .optional()
      .describe("Minimum severity level filter"),
  },

• src/tools/rules.ts:154-155 (registration)

  Registration of the 'search_rules' tool with the MCP server via server.tool(), with description 'Search Wazuh rules by description text'.

  server.tool(
    "search_rules",

• src/index.ts:41-41 (registration)

  Top-level registration call: registerRuleTools(server, client) invoked from the main entry point.

  registerRuleTools(server, client);

• src/client.ts:260-264 (helper)

  The WazuhClient.getRules() helper method invoked by the handler. Calls this.get('/rules', params) with a search parameter.

  async getRules(
    params: Record<string, string | number> = {}
  ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhRule>>> {
    return this.get("/rules", params);
  }