Repository navigation
fix(gti-mcp): scope GTI response trimming for #327 - #337
Open
VISHNU0906 wants to merge 2 commits into
Open
VISHNU0906 wants to merge 2 commits into
VISHNU0906 wants to merge 2 commits into
Conversation
Fix the broken rule_types filter in get_collection_rules, widen the get_entities_related_to_a_file return annotation so invalid relationships return a clean error dict through FastMCP outputSchema validation, and guard missing/non-dict data in get_collections_commonalities. Signed-off-by: KVR Vishnu <46535652+VISHNU0906@users.noreply.github.com>
Drop bulky / low-signal fields from vulnerability search, file behaviours, behavior summary, and collection commonalities while keeping core hunting and behavioral pivots. Adds utils.remove_fields for nested client-side stripping where the API exclude_attributes param is not enough. Signed-off-by: KVR Vishnu <46535652+VISHNU0906@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi @dandye — follow-up to #335 with the scoped response trimming from #327, split out so we can discuss drop-vs-truncate tradeoffs here without blocking the bug fixes.
Depends on #335 (this branch is stacked on it). Until #335 merges, the diff also includes those three bug fixes; after merge + rebase this PR shrinks to trimming only.
Scope
search_vulnerabilities: extra vuln metadata exclusions viaextra_excluded_attrs(VULNERABILITY_EXCLUDED_ATTRS).get_entities_related_to_a_file: sendexclude_attributesonly forbehaviourswhendescriptors_onlyis false (FILE_BEHAVIOUR_EXCLUDED_ATTRS). Drops bulky dumps (memory_dumps, registry/file open-write-delete noise); keepsprocesses_tree,command_executions,ip_traffic,attack_techniques, etc.get_file_behavior_summary/get_collections_commonalities: client-side strip of low-signal bulk viautils.remove_fields(FILE_BEHAVIOR_SUMMARY_EXCLUDED_ATTRS,COLLECTION_COMMONALITIES_FILES_EXCLUDED_ATTRS). Keeps hunting pivots (imphash,vhash,tlshhash,crowdsourced_*,itw_urls,embedded_domains/embedded_ips, …).Happy to adjust which fields are dropped vs truncated based on design discussion.
Tests
exclude_attributesscoping, summary/commonalities keep/drop coverage,remove_fieldsunit test.server/gtiunit suite: 65 passed.Part of #327