Merge pull request #225 from MISP/add-mcp-server

add: mcp server

Author: righel

.env.dev.dist

@@ -33,6 +33,8 @@ PGADMIN_DEFAULT_PASSWORD=Admin123
 MODULES_HOST=modules
 MODULES_PORT=6666
 
+MCP_AUTH_ENABLED=false
+
 STORAGE_ENGINE=local
 
 S3_ENDPOINT=garage:3900
@@ -46,3 +48,6 @@ GARAGE_ADMIN_TOKEN=garage-dev-admin-token
 GARAGE_METRICS_TOKEN=garage-dev-metrics-token
 
 FLOWER_BASIC_AUTH=flower:flower
+
+# Logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
+LOG_LEVEL=INFO

.env.dist

@@ -29,6 +29,8 @@ MAIL_SERVER=smtp
 MODULES_HOST=modules
 MODULES_PORT=6666
 
+MCP_AUTH_ENABLED=true
+
 STORAGE_ENGINE=s3
 
 S3_ENDPOINT=garage:3900
@@ -41,4 +43,6 @@ GARAGE_ADMIN_URL=http://garage:3903
 GARAGE_ADMIN_TOKEN=
 GARAGE_METRICS_TOKEN=
 
-FLOWER_BASIC_AUTH=flower:flower
+FLOWER_BASIC_AUTH=flower:flower
+
+LOG_LEVEL=WARNING

.env.test

@@ -30,6 +30,8 @@ MAIL_SERVER=mailhog
 MODULES_HOST=modules
 MODULES_PORT=6666
 
+MCP_AUTH_ENABLED=true
+
 STORAGE_ENGINE=local
 
 S3_ENDPOINT=garage:3900
@@ -43,3 +45,5 @@ GARAGE_ADMIN_TOKEN=garage-test-admin-token
 GARAGE_METRICS_TOKEN=garage-test-metrics-token
 
 FLOWER_BASIC_AUTH=flower:flower
+
+LOG_LEVEL=DEBUG

.github/workflows/api_test.yml

@@ -91,6 +91,43 @@ jobs:
           PYTHONDONTWRITEBYTECODE: 1
         run: poetry install --no-interaction --no-root
 
+      - name: Create OpenSearch indices
+        run: |
+          OPENSEARCH_URL="http://localhost:9200"
+
+          echo "Waiting for OpenSearch..."
+          for i in $(seq 1 30); do
+            curl -s "${OPENSEARCH_URL}" >/dev/null 2>&1 && break
+            echo "Not ready yet ($i/30), retrying in 3s..."
+            sleep 3
+          done
+
+          echo "Creating ingest pipelines..."
+          for file in opensearch/pipelines/*.json; do
+            NAME=$(basename "$file" .json)
+            echo "  pipeline: $NAME"
+            curl -s -X PUT "${OPENSEARCH_URL}/_ingest/pipeline/${NAME}" \
+              -H "Content-Type: application/json" -d "@${file}"
+          done
+
+          echo "Creating index templates..."
+          for file in opensearch/index-templates/*.json; do
+            NAME=$(basename "$file" .json)
+            echo "  template: $NAME"
+            curl -s -X PUT "${OPENSEARCH_URL}/_index_template/${NAME}" \
+              -H "Content-Type: application/json" -d "@${file}"
+          done
+
+          echo "Creating indices..."
+          for file in opensearch/mappings/*.json; do
+            NAME=$(basename "$file" .json)
+            echo "  index: $NAME"
+            curl -s -X PUT "${OPENSEARCH_URL}/${NAME}" \
+              -H "Content-Type: application/json" -d "@${file}"
+          done
+
+          echo "OpenSearch setup complete."
+
       - name: Run DB migrations
         working-directory: api
         run: |
@@ -137,6 +174,7 @@ jobs:
           MODULES_PORT: 6666
           STORAGE_ENGINE: local
           FLOWER_BASIC_AUTH: flower:flower
+          MCP_AUTH_ENABLED: true
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4
         with:

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "misp-workbench": {
+      "type": "http",
+      "url": "http://localhost:8080/mcp"
+    }
+  }
+}

api/app/auth/auth.py

@@ -15,9 +15,6 @@
 from sqlalchemy.orm import Session
 from app.services.redis import get_redis_client
 
-# see: https://fastapi.tiangolo.com/tutorial/security/oauth2-jwt/
-# see: https://fastapi.tiangolo.com/advanced/security/
-
 
 class Token(BaseModel):
     access_token: str
@@ -124,6 +121,29 @@ class TokenData(BaseModel):
         "hunts:run": "Run hunts.",
         "notifications:read": "Read notifications.",
         "notifications:update": "Update notifications.",
+        "mcp:list_tools": "List MCP tools.",
+        "mcp:list_resources": "List MCP resources.",
+        "mcp:list_prompts": "List MCP prompts.",
+        "mcp:search_events": "Search events via MCP.",
+        "mcp:search_attributes": "Search attributes via MCP.",
+        "mcp:get_event": "Get event details via MCP.",
+        "mcp:get_correlations": "Get correlations via MCP.",
+        "mcp:detect_indicator_type": "Detect indicator types via MCP.",
+        "mcp:get_statistics": "Get statistics via MCP.",
+        "mcp:get_tags": "List tags via MCP.",
+        "mcp:get_index_mapping": "Get index mappings via MCP.",
+        "mcp:search_galaxy": "Search galaxy clusters via MCP.",
+        "mcp:search_taxonomy": "Search taxonomies via MCP.",
+        "mcp:get_sightings": "Get sightings via MCP.",
+        "mcp:list_hunts": "List hunts via MCP.",
+        "mcp:get_hunt_results": "Get hunt results via MCP.",
+        "mcp:run_hunt": "Run hunts via MCP.",
+        "mcp:config": "Generate an MCP client configuration token.",
+        "mcp:get_event_reports": "Get event reports via MCP.",
+        "mcp:search_event_reports": "Search event reports via MCP.",
+        "mcp:create_event_report": "Create event reports via MCP.",
+        "mcp:get_notifications": "Get user notifications via MCP.",
+        "mcp:list_modules": "List enrichment modules via MCP.",
     },
 )
 
@@ -226,6 +246,7 @@ def get_scopes_for_user(user: user_schemas.User):
         scopes.add("settings:*")
         scopes.add("hunts:*")
         scopes.add("notifications:*")
+        scopes.add("mcp:*")
 
     if user.role.perm_auth:
         scopes.add("auth:login")

api/app/cli/__main__.py

@@ -1,3 +1,5 @@
+from typing import Optional
+
 import typer
 from app.database import SessionLocal
 from app.repositories import organisations as organisations_repository
@@ -46,12 +48,12 @@ def create_user(email: str, password: str, organisation_id: int, role_id: int):
 
 
 @app.command()
-def load_galaxies(user_id: int = None):
+def load_galaxies(user_id: Optional[int] = None):
     tasks.load_galaxies.delay(user_id)
 
 
 @app.command()
-def load_taxonomies(user_id: int = None):
+def load_taxonomies(user_id: Optional[int] = None):
     tasks.load_taxonomies.delay()
 
 

api/app/main.py

@@ -9,6 +9,7 @@
     feeds,
     galaxies,
     hunts,
+    mcp,
     modules,
     object_templates,
     objects,
@@ -32,17 +33,27 @@
 from fastapi_pagination import add_pagination
 
 # setup loggers
-logging.config.fileConfig("logging.conf", disable_existing_loggers=False)
+# Import and use our custom logging setup
+import sys
+import os
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+from setup_logging import setup_logging
+
+setup_logging()
+
+# MCP server (mounted as ASGI sub-app)
+mcp_app = mcp.mcp.http_app(path="/")
 
 # Bootstrap application
-app = FastAPI(title="misp-workbench API", version="0.1.0")
+app = FastAPI(title="misp-workbench API", version="0.1.0", lifespan=mcp_app.lifespan)
 
 # Add CORS
 origins = [
     "http://localhost",
     "http://localhost:8080",
     "http://localhost:3000",
     "http://localhost:3001",
+    "http://localhost:6274",
 ]
 app.add_middleware(
     CORSMiddleware,
@@ -127,4 +138,10 @@
 # Notifications resource
 app.include_router(notifications.router, tags=["Notifications"])
 
+# MCP config endpoint (must be registered before the /mcp mount)
+app.include_router(mcp.router, tags=["MCP"])
+
+# MCP server (Streamable HTTP at /mcp)
+app.mount("/mcp", mcp_app)
+
 add_pagination(app)