MCP Tools

MCP Tools

Three tools, served over stdio by server.py. Every schema and every response below was read from a running ghcr.io/wrg-11/wrg-sigma-rules-mcp container — not from the source, and not paraphrased.

---

draft_rule

Draft a Sigma YAML rule from a natural-language threat description.

Field	Required	Notes
description	yes	The threat, in plain language
title	no	Defaults to a title derived from the description
rule_type	no
references	no
target_platform	no
severity	no
mitre_ttps	no
author	no

Only description is required — the rest steer the draft.

Response shape — JSON with ok and a yaml string. A minimal call (description: "test") returned a complete rule: title, a deterministic UUID id, status: experimental, logsource (defaulting to process_creation / windows), and a detection block. The draft is a starting point, not a finished rule; run it through validate_rule before using it.

---

validate_rule

Validate a Sigma YAML rule for schema correctness and pySigma compatibility.

Field	Required	Notes
yaml_content	yes	The full rule text
target_backend	no	Defaults to default
strict	no	Defaults to false

Note the field is yaml_content, not rule.

Response shape

{
  "ok": true,
  "valid": true,
  "schema_errors": [],
  "pysigma_errors": [],
  "pysigma_available": true,
  "linter_warnings": [],
  "mitre_coverage": { "techniques": ["T1190"], "count": 1 },
  "target_backend": "default",
  "strict": false
}

Two fields are easy to skim past and worth reading:

• pysigma_available — whether pySigma was importable at all. A validation that ran without pySigma is not the same as one that ran with it and found nothing.
• mitre_coverage — techniques extracted from the rule's own tags, so a rule that forgot its attack.tXXXX tag reports an empty list rather than guessing.

---

convert_rule

Convert a Sigma YAML rule into a SIEM-native query.

Field	Required	Notes
yaml_content	yes	The full rule text
target	no	Backend name, e.g. splunk
config	no	Backend configuration

Response shape — ok, the generated query string, the target that produced it, a warnings array, and a metadata block carrying the rule's title, id, level and parsed logsource.

Converting a corpus rule targeting T1190 to splunk produced a working query over ParentImage / Image with the expected web-server-spawns-shell shape, and an empty warnings array.

---

Calling the tools

The server speaks MCP over stdio. A session is the usual three steps: initialize, the notifications/initialized notification, then tools/list or tools/call.

docker run --rm -i --network none ghcr.io/wrg-11/wrg-sigma-rules-mcp:latest

scripts/mcp_stdio_smoke.py in this repo does the same handshake if you would rather not drive it by hand.