Supply evidence from another MCP server
chokepoint_supply_evidenceRelay evidence from connected MCP telemetry servers into Chokepoint Finder's safety gates; stale or partial data blocks the gate, and human confirmation is required for coverage changes.
Instructions
Feed a pre-flight gate from an MCP server you already have connected.
Chokepoint Finder holds no EDR, SIEM or ITSM credentials and never will. This is how it sees that telemetry anyway: your agent queries whatever server provides it -- CrowdStrike, SentinelOne, Splunk, Sentinel, ServiceNow, a CTI platform -- and relays the answer here with its provenance. The same composition the execution path uses, applied to evidence intake.
The trust rules do not soften for relayed data. Stale, partial or truncated input still reads UNKNOWN and still holds the gate, and every verdict built on it prints the source, the collection time and the fact that it was relayed rather than pulled directly.
Calls that establish, refresh, replace, or extend coverage require
confirm=true after the agent presents the evidence to a human. The only
unconfirmed update accepted is an additive detection or freeze inside
already-covered scope; that path preserves the established coverage and
freshness, so it can only make a decision more cautious. Never self-attest.
Send an empty items list ONLY when the source genuinely returned nothing.
If the query failed, say so by omitting this call entirely: an unsupplied
channel reads UNKNOWN and holds, which is the safe answer. Reporting a
failed query as "nothing found" is the one input that could widen what the
agent is willing to do.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | EDR: [{asset_id, severity, rule, age_hours}]. change_freeze: [{asset_id, reason}]. An empty list means the source was queried and found nothing -- do not send [] if the query failed. | |
| scope | Yes | What was actually queried, e.g. 'all Windows servers, last 24h'. Under-scoped evidence is worse than none, so be specific. | |
| source | Yes | The MCP server or system the data came from, e.g. 'crowdstrike-mcp', 'splunk-mcp', 'servicenow-mcp'. Recorded verbatim. | |
| channel | Yes | Which gate to feed: edr | change_freeze | |
| confirm | No | Human confirmation that the relayed evidence may establish, refresh, replace, or extend gate coverage. Not needed for caution-only detections/freezes added inside existing coverage. | |
| complete | Yes | False if the query was partial, paged out or capped. A partial answer holds the gate. | |
| collected_at | Yes | When the SOURCE collected this, ISO 8601 UTC, e.g. 2026-08-05T09:00:00Z. Not the time you are calling this tool. | |
| confirmed_at | No | UTC time of the human confirmation, ISO 8601. | |
| confirmed_by | No | Operator identity recorded on the approval receipt. | |
| confirmation_id | No | Unique human approval receipt ID; one-time use. | |
| evidence_digest | No | Exact SHA-256 digest printed by the refused preview call. | |
| covered_asset_ids | Yes | Exact asset IDs the source query covered. Scope prose is audit context only and cannot widen this set. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |