[VISHNU0906]

Hi @dandye — narrowing this PR to the three bug fixes from #327 (response trimming moved to a follow-up PR).

Fixes

1. get_collection_rules: correct the rule_types filter to if rule_type not in rule_types or not rules: so unrequested types with non-empty aggregations are skipped.
2. get_entities_related_to_a_file: widen the return annotation to Union[List[Dict], Dict[str, str]] so an invalid relationship returns a clean error dict instead of failing FastMCP structured-output validation. Regression test now goes through server.call_tool so outputSchema is exercised; docstring notes "or an error dictionary".
3. get_collections_commonalities: guard with if not isinstance(data, dict) or not isinstance(data.get("data"), dict): (covers missing data and {"data": None}) and return a clean error string.

Tests

• Strengthened rule_types filter regression (mutation-checked).
• Invalid-relationship path via server.call_tool.
• Missing/None data commonalities paths.
• Full server/gti unit suite: 61 passed.

Part of #327

[dandye]

Thanks for picking up #327, @VISHNU0906!

Could you please split this work into two separate PRs so we can land the bug fixes right away?

1. This PR (#335): Bug fixes 1 to 3 only (get_collection_rules rule_types filter, get_entities_related_to_a_file return annotation, and get_collections_commonalities missing-data guard, plus their unit tests).
2. A separate PR: Scoped response trimming (VULNERABILITY_EXCLUDED_ATTRS, FILE_BEHAVIOUR_EXCLUDED_ATTRS, FILE_BEHAVIOR_SUMMARY_EXCLUDED_ATTRS, COLLECTION_COMMONALITIES_FILES_EXCLUDED_ATTRS, utils.remove_fields, and the trimming tests). The field-trimming tradeoffs need a bit more design discussion on what gets dropped vs. truncated, and we can have that conversation directly on the new PR without blocking the bug fixes here.

Also, once split, please change Fixes #327 in this PR's description to Part of #327 so merging the bug fixes does not auto-close the issue before the response-trimming PR is resolved.

Requested changes on the bug fixes in this PR

1. get_entities_related_to_a_file test and docstring (server/gti/tests/test_files_errors.py, server/gti/gti_mcp/tools/files.py):

   • Calling await files.get_entities_related_to_a_file(...) directly in test_get_entities_related_to_a_file_invalid_relationship_returns_error_dict bypasses FastMCP's outputSchema / structured-output validation, meaning the test would still pass even if the Union[...] return annotation were reverted. Please invoke the tool via await server.call_tool("get_entities_related_to_a_file", {"hash": "abc", "relationship_name": "not_a_real_relationship", "descriptors_only": True}) so the regression test exercises FastMCP's structured-output validation path end-to-end.
   • Minor: please update the Returns: docstring on get_entities_related_to_a_file to note "or an error dictionary" (matching get_collection_rules).

2. get_collections_commonalities guard (server/gti/gti_mcp/tools/collections.py, server/gti/tests/test_collections_errors.py):

   • if "data" not in data: still lets {"data": None} (or a non-dict top-level payload) fall through: utils.sanitize_response(None) returns None, which raises AttributeError inside utils.parse_collection_commonalities.
   • Please tighten this check to if not isinstance(data, dict) or not isinstance(data.get("data"), dict): and add an assertion covering {"data": None} in test_collections_errors.py.

The get_collection_rules fix and strengthened sigma_lookups / yara_lookups assertions in test_get_collection_rules_filter_types look good as-is. Once this PR is narrowed to the three bug fixes with the two updates above, we can get it merged quickly!

[VISHNU0906]

Thanks @dandye — addressed as requested:

1. Narrowed this PR to the three bug fixes only (trimming moved to a follow-up).
2. get_entities_related_to_a_file regression now goes through server.call_tool(...) so FastMCP outputSchema validation is exercised; Returns docstring notes "or an error dictionary".
3. Tightened the commonalities guard to if not isinstance(data, dict) or not isinstance(data.get("data"), dict): and added a {"data": None} case.
4. PR description now says Part of [gti-mcp] Fix collection/file tool bugs and trim verbose response fields without dropping core threat indicators #327.

Scoped response trimming is in #337 (stacked on this branch; happy to discuss drop vs truncate there).

[dandye]

Thanks for the quick turnaround and for splitting this out cleanly, @VISHNU0906!

The three bug fixes look good, and the server.call_tool and {"data": None} tests cover the exact failure paths from #327. Merging this now, and I will follow up on the response-trimming discussion over in #337.