RAD Security MCP Server

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow to add a schedule to"
    },
    "schedule": {
      "type": "string",
      "description": "Cron-based schedule expression (e.g., '0 0 12 * * *' for daily at noon)"
    },
    "timezone": {
      "type": "string",
      "description": "Timezone for the schedule (e.g., 'UTC', 'America/New_York')"
    }
  },
  "required": [
    "workflow_id",
    "schedule",
    "timezone"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Add Automation Schedule",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the custom workflow"
    },
    "description": {
      "type": "string",
      "description": "Description of the workflow"
    },
    "summary": {
      "type": "string",
      "description": "Summary of what the workflow does"
    },
    "yaml": {
      "type": "string",
      "description": "The workflow YAML definition (required)"
    },
    "agent_id": {
      "type": "string",
      "description": "ID of the agent that created this workflow"
    },
    "thread_id": {
      "type": "string",
      "description": "ID of the conversation thread"
    }
  },
  "required": [
    "name",
    "description",
    "summary",
    "yaml"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Create Automation",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "title": {
      "type": "string",
      "description": "Dashboard title shown in the UI"
    },
    "rows": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": {}
      },
      "description": "Dashboard layout: an ordered list of rows, each holding widgets. Build widgets from list_widget_templates / get_widget_template so the visualization and query shapes are valid."
    },
    "description": {
      "type": "string",
      "description": "What the dashboard shows, and who it is for"
    },
    "visibility": {
      "type": "string",
      "description": "Dashboard visibility, e.g. 'private' or 'public'. Defaults to the account's default."
    }
  },
  "required": [
    "title",
    "rows"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Create Dashboard",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "cluster_id": {
      "type": "string",
      "description": "ID of the cluster to get details for"
    }
  },
  "required": [
    "cluster_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Cluster Details",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "container_id": {
      "type": "string",
      "description": "ID of the container to get details for"
    }
  },
  "required": [
    "container_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Container Details",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "container_id": {
      "type": "string",
      "description": "Container ID to get LLM analysis for"
    }
  },
  "required": [
    "container_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Container LLM Analysis",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "container_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of container IDs to get baselines for"
    }
  },
  "required": [
    "container_ids"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Container Baselines",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "container_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of container IDs to get process trees for"
    },
    "processes_limit": {
      "type": "number",
      "default": 1000,
      "description": "Limit the number of processes to get"
    }
  },
  "required": [
    "container_ids"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Container Process Trees",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "dashboard_id": {
      "type": "string",
      "description": "ID of the dashboard"
    }
  },
  "required": [
    "dashboard_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Dashboard",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "dashboard_template_id": {
      "type": "string",
      "description": "ID of the dashboard template"
    }
  },
  "required": [
    "dashboard_template_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Dashboard Template",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "digest": {
      "type": "string",
      "description": "Image digest (required for SBOM)"
    }
  },
  "required": [
    "digest"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Image SBOM",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "inbox_item_id": {
      "type": "string",
      "description": "ID of the inbox item to get details for"
    }
  },
  "required": [
    "inbox_item_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Inbox Item Details",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "cluster_id": {
      "type": "string",
      "description": "ID of the Kubernetes cluster"
    },
    "resource_uid": {
      "type": "string",
      "description": "Resource UID to get the details for"
    }
  },
  "required": [
    "cluster_id",
    "resource_uid"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Kubernetes Resource Details",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "document_id": {
      "type": "string",
      "description": "The ID of the document to fetch. Find document IDs via list_knowledge_base_documents or in search_knowledge_base results."
    }
  },
  "required": [
    "document_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Knowledge Base Document Content",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "document_id": {
      "type": "string",
      "description": "The ID of the document to get a download URL for. Find document IDs via list_knowledge_base_documents or in search_knowledge_base results."
    }
  },
  "required": [
    "document_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Knowledge Base Document Download URL",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Top Vulnerable Images",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "widget_template_id": {
      "type": "string",
      "description": "ID of the widget template"
    }
  },
  "required": [
    "widget_template_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Widget Template",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow to get"
    }
  },
  "required": [
    "workflow_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Workflow",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow"
    },
    "run_id": {
      "type": "string",
      "description": "ID of the workflow run"
    }
  },
  "required": [
    "workflow_id",
    "run_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Get Workflow Run",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "cve_name": {
      "type": "string",
      "description": "CVE ID to ignore, e.g. CVE-2024-1234"
    },
    "disposition": {
      "type": "string",
      "enum": [
        "false_positive",
        "accepted_risk",
        "wont_fix"
      ],
      "description": "Why the CVE is being ignored: false_positive, accepted_risk, or wont_fix"
    },
    "reason": {
      "type": "string",
      "description": "Free-text justification, recorded for audit (recommended)"
    },
    "cluster_id": {
      "type": "string",
      "description": "Scope: ignore the CVE only in this cluster (cluster UUID)"
    },
    "image_digest": {
      "type": "string",
      "description": "Scope: ignore the CVE on this exact image build (image digest)"
    },
    "image_repo": {
      "type": "string",
      "description": "Scope: ignore across all builds of an image — repo, e.g. 'docker.io/library/' (set with image_name)"
    },
    "image_name": {
      "type": "string",
      "description": "Scope: image name, e.g. 'redis' (set with image_repo)"
    }
  },
  "required": [
    "cve_name",
    "disposition"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Ignore CVE",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "page_size": {
      "type": "number",
      "default": 50,
      "description": "Number of clusters per page for list_clusters (default: 50)"
    },
    "page": {
      "type": "number",
      "default": 1,
      "description": "Page number to retrieve for list_clusters (default: 1)"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Clusters",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "filters": {
      "type": "string",
      "description": "Filter string (e.g., 'image_name:nginx' or 'image_digest:sha256:...' or 'owner_namespace:namespace' or 'cluster_id:cluster_id'). Multiple filters can be combined with commas."
    },
    "offset": {
      "type": "number",
      "description": "Pagination offset. Default: 0"
    },
    "limit": {
      "type": "number",
      "description": "Maximum number of results to return. Default: 20"
    },
    "q": {
      "type": "string",
      "description": "Free text search query"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Containers",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List CVE Dispositions",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 10,
      "description": "Maximum number of results to return (default: 10, min: 1)"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Pagination offset (default: 0, min: 0)"
    },
    "category": {
      "type": "string",
      "description": "Filter by category"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Dashboard Templates",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 10,
      "description": "Maximum number of results to return (default: 10, min: 1)"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Pagination offset (default: 0, min: 0)"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Dashboards",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "offset": {
      "type": "number",
      "description": "Pagination offset for the results (default: 0)"
    },
    "limit": {
      "type": "number",
      "description": "Maximum number of integrations to return (default: 20)"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List External Integrations",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "digest": {
      "type": "string",
      "description": "Image digest (required for vulnerabilities)"
    },
    "severities": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of severity levels to filter"
    },
    "page": {
      "type": "number",
      "default": 1,
      "description": "Page number for pagination"
    },
    "page_size": {
      "type": "number",
      "default": 100,
      "description": "Number of items per page"
    }
  },
  "required": [
    "digest"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Image Vulnerabilities",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 20,
      "description": "Number of items per page"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Offset to start the list from"
    },
    "sort": {
      "type": "string",
      "default": "name:asc",
      "description": "Sort order"
    },
    "filters": {
      "type": "string",
      "description": "Filter string (e.g., 'eol:ok', 'eol:reached', 'name:nginx', 'tag:1.26.0'), where eol is end of life status of the base image"
    },
    "q": {
      "type": "string",
      "description": "Free text search query"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Images",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 10,
      "description": "Number of inbox items per page (default: 10)"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Offset to retrieve (default: 0)"
    },
    "filters_query": {
      "type": "string",
      "description": "Filter query string (e.g. full text search: 'search:<query>', severity: 'severity:low', type 'type:workflow_output' any other field). Multiple filters can be combined eg. 'search:cve-2024-12345 and severity:high'"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Inbox Items",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "namespace": {
      "type": "string",
      "description": "Namespace to filter resources"
    },
    "kinds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of kinds to filter. Example: ['Deployment', 'ServiceAccount', 'Pod']"
    },
    "cluster_id": {
      "type": "string",
      "description": "Cluster ID to filter resources"
    },
    "page": {
      "type": "number",
      "default": 1,
      "description": "Page number for pagination"
    },
    "page_size": {
      "type": "number",
      "default": 20,
      "description": "Number of items per page"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Kubernetes Resources",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "description": "Maximum number of collections to return. Default: 100"
    },
    "offset": {
      "type": "number",
      "description": "Number of collections to skip for pagination. Default: 0"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Knowledge Base Collections",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "description": "Maximum number of documents to return. Default: 100"
    },
    "offset": {
      "type": "number",
      "description": "Number of documents to skip for pagination. Default: 0"
    },
    "filters": {
      "type": "string",
      "description": "Filter documents by collections, file_type (pdf, markdown, plaintext, csv), or status (ready, processing, error) (e.g., 'collections:vuln;security,file_type:pdf,status:ready'). Multiple filters can be combined with commas."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Knowledge Base Documents",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 20,
      "description": "Number of findings to return"
    },
    "types": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "k8s_misconfiguration",
          "runtime_alert",
          "k8s_audit_logs_anomaly"
        ]
      },
      "description": "List of finding types to filter by"
    },
    "severities": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "negligible",
          "low",
          "medium",
          "high",
          "critical"
        ]
      },
      "description": "List of severity levels to filter by"
    },
    "source_kinds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of source kinds to filter by. i.e. Deployment,Pod,Container,Node,etc."
    },
    "source_types": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "kubeobject",
          "k8s_audit_log",
          "container"
        ]
      },
      "description": "List of source types to filter by"
    },
    "source_names": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of source names to filter by"
    },
    "source_namespaces": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of source namespaces to filter by"
    },
    "status": {
      "type": "string",
      "enum": [
        "open",
        "closed",
        "ignored"
      ],
      "default": "open",
      "description": "Status of the findings to filter by"
    },
    "from_time": {
      "type": "string",
      "default": "now-7d",
      "description": "From time in RFC3339 or relative format, i.e. now-7d"
    },
    "to_time": {
      "type": "string",
      "description": "To time in RFC3339 or relative format, i.e. now-7d"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Security Findings",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "default": 10,
      "description": "Maximum number of results to return (default: 10, min: 1)"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Pagination offset (default: 0, min: 0)"
    },
    "visualization_type": {
      "type": "string",
      "description": "Filter by visualization type"
    },
    "category": {
      "type": "string",
      "description": "Filter by category"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Widget Templates",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow to list runs for"
    }
  },
  "required": [
    "workflow_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Workflow Runs",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow to list schedules for"
    }
  },
  "required": [
    "workflow_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Workflow Schedules",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "List Workflows",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "inbox_item_id": {
      "type": "string",
      "description": "ID of the inbox item to mark as false positive"
    },
    "value": {
      "type": "boolean",
      "default": true,
      "description": "Whether to mark the item as false positive (true) or not (false)"
    },
    "reason": {
      "type": "string",
      "description": "Reason for marking the item as false positive"
    }
  },
  "required": [
    "inbox_item_id",
    "reason"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Mark Inbox Item as False Positive",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "document_id": {
      "type": "string",
      "description": "The ID of the CSV document to query. Use list_knowledge_base_documents with filters='file_type:csv' to find CSV document IDs. Document IDs are also available in search_knowledge_base results. This will fail if the document is not a CSV file."
    },
    "query": {
      "type": "string",
      "description": "Natural language question to execute against the CSV document. The system will analyze the CSV structure and generate the appropriate query (e.g., 'Show me all rows where severity is critical', 'Count the number of vulnerabilities by type', 'Show me the owner of asset IKM99832')."
    }
  },
  "required": [
    "document_id",
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Query Knowledge Base Document",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "queries": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "data_type": {
            "type": "string",
            "description": "The data type to query (e.g., 'containers', 'kubernetes_resources', 'inbox_items'). Use radql_list_data_types to discover available types."
          },
          "operation": {
            "type": "string",
            "enum": [
              "list",
              "get_by_id",
              "stats"
            ],
            "description": "The operation to perform: 'list' for filtering/searching, 'get_by_id' for single item, 'stats' for aggregations"
          },
          "filters_query": {
            "type": "string",
            "description": "RadQL filter query (e.g., 'severity:High AND type:misconfiguration'). Used for filtering results."
          },
          "stats_query": {
            "type": "string",
            "description": "RadQL analytics query (e.g., 'count() by severity'). Used for aggregations and grouping."
          },
          "id": {
            "type": "string",
            "description": "The ID of a specific item to retrieve (for get_by_id operation)"
          },
          "limit": {
            "type": "number",
            "default": 20,
            "description": "Maximum number of results to return"
          },
          "offset": {
            "type": "number",
            "default": 0,
            "description": "Pagination offset"
          },
          "include_relations": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Relations to include (e.g., ['owner'] for containers to include Kubernetes owner resource)"
          }
        },
        "required": [
          "data_type",
          "operation"
        ],
        "additionalProperties": false
      },
      "maxItems": 10,
      "description": "Array of queries to execute in parallel (max 10)"
    }
  },
  "required": [
    "queries"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: Batch Query",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "data_type": {
      "type": "string",
      "description": "The data type to get metadata for (e.g., 'containers', 'kubernetes_resources', 'inbox_items'). Call radql_list_data_types first to see available types."
    }
  },
  "required": [
    "data_type"
  ],
  "additionalProperties": false,
  "description": "Get schema/metadata for a specific RadQL data type. Returns available fields, types, and query examples. Call this AFTER radql_list_data_types to understand how to query a data type.",
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: Get Type Metadata",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "List all available RadQL data types. Returns data types with descriptions. ALWAYS call this FIRST to discover what data is available.",
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: List Data Types",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "data_type": {
      "type": "string",
      "description": "The data type (e.g., 'containers', 'kubernetes_resources')"
    },
    "filter_name": {
      "type": "string",
      "description": "The filter field name to get possible values for (e.g., 'namespace', 'cluster_id', 'severity')"
    }
  },
  "required": [
    "data_type",
    "filter_name"
  ],
  "additionalProperties": false,
  "description": "List possible values for a filter field. Useful for discovering available namespaces, clusters, severities, etc. Call this when building dynamic filters.",
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: List Filter Values",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "data_type": {
      "type": "string",
      "description": "The data type to query (e.g., 'containers', 'kubernetes_resources', 'inbox_items'). Use radql_list_data_types to discover available types."
    },
    "operation": {
      "type": "string",
      "enum": [
        "list",
        "get_by_id",
        "stats"
      ],
      "description": "The operation to perform: 'list' for filtering/searching, 'get_by_id' for single item, 'stats' for aggregations"
    },
    "filters_query": {
      "type": "string",
      "description": "RadQL filter query (e.g., 'severity:High AND type:misconfiguration'). Used for filtering results."
    },
    "stats_query": {
      "type": "string",
      "description": "RadQL analytics query (e.g., 'count() by severity'). Used for aggregations and grouping."
    },
    "id": {
      "type": "string",
      "description": "The ID of a specific item to retrieve (for get_by_id operation)"
    },
    "limit": {
      "type": "number",
      "default": 20,
      "description": "Maximum number of results to return"
    },
    "offset": {
      "type": "number",
      "default": 0,
      "description": "Pagination offset"
    },
    "include_relations": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Relations to include (e.g., ['owner'] for containers to include Kubernetes owner resource)"
    }
  },
  "required": [
    "data_type",
    "operation"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: Query",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "data_type": {
      "type": "string",
      "description": "The data type to build a query for"
    },
    "conditions": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "field": {
            "type": "string"
          },
          "operator": {
            "type": "string",
            "enum": [
              ":",
              "=",
              "!=",
              "!:",
              "<>",
              ">",
              ">=",
              "<",
              "<=",
              "contains",
              "starts_with",
              "ends_with"
            ]
          },
          "value": {
            "type": [
              "string",
              "number",
              "boolean"
            ]
          },
          "negate": {
            "type": "boolean"
          }
        },
        "required": [
          "field",
          "operator",
          "value"
        ],
        "additionalProperties": false
      },
      "description": "Filter conditions to combine into a RadQL query"
    },
    "logic": {
      "type": "string",
      "enum": [
        "AND",
        "OR"
      ],
      "default": "AND",
      "description": "Logical operator to combine conditions"
    },
    "aggregation": {
      "type": "string",
      "enum": [
        "count",
        "sum",
        "avg",
        "min",
        "max",
        "median"
      ],
      "description": "Aggregation function to apply"
    },
    "aggregate_field": {
      "type": "string",
      "description": "Field to aggregate (omit for count(*))"
    },
    "group_by": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Fields to group by"
    },
    "time_group": {
      "type": "string",
      "enum": [
        "second",
        "minute",
        "hour",
        "day",
        "month",
        "year"
      ],
      "description": "Time-based grouping interval for datetime fields"
    }
  },
  "required": [
    "data_type"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "RadQL: Query Builder",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the workflow to run"
    },
    "async": {
      "type": "boolean",
      "default": true,
      "description": "If true, run asynchronously and return immediately. If false, wait for the workflow to finish."
    },
    "args": {
      "type": "object",
      "additionalProperties": {},
      "description": "Optional arguments to override when running the workflow"
    }
  },
  "required": [
    "workflow_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Run Workflow",
  "readOnlyHint": false,
  "destructiveHint": true
}

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Natural language question or keywords to search for across your uploaded knowledge base content. Can be a full question, technical terms, or key phrases."
    },
    "top_k": {
      "type": "number",
      "description": "Maximum number of most relevant document excerpts to return. Use higher values (10-20) for comprehensive research, lower values (3-5) for focused answers. Default: 5"
    },
    "min_score": {
      "type": "number",
      "description": "Minimum semantic similarity score threshold (0.0 to 1.0). Higher values (0.8-1.0) return only highly relevant matches, lower values (0.5-0.7) include broader context. Default: 0.5"
    },
    "thread_id": {
      "type": "string",
      "description": "Thread identifier for the current conversation or session. IMPORTANT: If a thread_id is available in your context, you MUST provide it to include thread-specific documents alongside general knowledge base content. Only omit if no thread context exists."
    },
    "collections": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional list of collection names to filter search results. Only documents tagged with these collections will be searched. Cannot be used with document_ids."
    },
    "document_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional list of specific document IDs to search within. Use this to restrict search to known documents. Cannot be used with collections."
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Search Knowledge Base",
  "readOnlyHint": true
}

{
  "type": "object",
  "properties": {
    "cve_name": {
      "type": "string",
      "description": "CVE ID to un-ignore (restore to reporting), e.g. CVE-2024-1234"
    }
  },
  "required": [
    "cve_name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Unignore CVE",
  "readOnlyHint": false,
  "destructiveHint": true
}

{
  "type": "object",
  "properties": {
    "workflow_id": {
      "type": "string",
      "description": "ID of the custom workflow to update"
    },
    "name": {
      "type": "string",
      "description": "New name for the workflow"
    },
    "description": {
      "type": "string",
      "description": "New description"
    },
    "summary": {
      "type": "string",
      "description": "New summary"
    },
    "yaml": {
      "type": "string",
      "description": "The updated workflow YAML definition (required)"
    },
    "agent_id": {
      "type": "string",
      "description": "ID of the agent making the update"
    },
    "thread_id": {
      "type": "string",
      "description": "ID of the conversation thread"
    }
  },
  "required": [
    "workflow_id",
    "yaml"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Update Automation",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "dashboard_id": {
      "type": "string",
      "description": "ID of the dashboard to update"
    },
    "title": {
      "type": "string",
      "description": "New title"
    },
    "rows": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": {}
      },
      "description": "Replacement layout. `rows` is replaced wholesale, so when you change it send the full intended layout, not just the changed row. Omit it entirely to leave the layout untouched."
    },
    "description": {
      "type": "string",
      "description": "New description"
    },
    "visibility": {
      "type": "string",
      "description": "New visibility"
    }
  },
  "required": [
    "dashboard_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Update Dashboard",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Finding ID to update"
    },
    "status": {
      "type": "string",
      "enum": [
        "open",
        "closed",
        "ignored"
      ],
      "description": "New status for the finding"
    }
  },
  "required": [
    "id",
    "status"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Update Security Finding Status",
  "readOnlyHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Optional Pod name"
    },
    "namespace": {
      "type": "string",
      "description": "Optional Pod namespace"
    },
    "cluster_id": {
      "type": "string",
      "description": "Optional Cluster ID"
    },
    "from_time": {
      "type": "string",
      "description": "Start time of the time range to search for audit events. Example: 2024-01-01T00:00:00Z. Default: 7 days ago"
    },
    "to_time": {
      "type": "string",
      "description": "End time of the time range to search for audit events. Example: 2024-01-03T00:00:00Z"
    },
    "limit": {
      "type": "number",
      "default": 20,
      "description": "Maximum number of results to return"
    },
    "page": {
      "type": "number",
      "default": 1,
      "description": "Page number to return"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "title": "Who Shelled Into Pod",
  "readOnlyHint": true
}