{"ok":true,"data":{"service":"platphorm-investigate","protocol":"JSON-RPC 2.0","endpoint":"/api/mcp","methods":["initialize","ping","tools/list","tools/call","resources/list","resources/read","prompts/list","prompts/get"],"tools":[{"name":"correlate","owner":"correlate","description":"Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output.","risk":"read-only","timeoutMs":15000,"retryPolicy":"none","authPolicy":"platform-key","tracePolicy":"propagate","inputSchema":{"type":"object","properties":{"datasetId":{"type":"string","minLength":1,"maxLength":128}},"additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"map_attack","owner":"investigate","description":"Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate","inputSchema":{"type":"object","additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"lookup_technique","owner":"investigate","description":"Look up one technique in the pinned official Enterprise ATT&CK 19.1 STIX subset.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate","inputSchema":{"type":"object","required":["id"],"properties":{"id":{"type":"string","pattern":"^T[0-9]{4}(?:\\.[0-9]{3})?$"}},"additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"search_techniques","owner":"investigate","description":"Search the pinned official Enterprise ATT&CK 19.1 STIX subset by ID, name, or tactic.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate","inputSchema":{"type":"object","required":["query"],"properties":{"query":{"type":"string","minLength":2,"maxLength":100}},"additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"build_timeline","owner":"investigate","description":"Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate","inputSchema":{"type":"object","properties":{"entityId":{"type":"string"}},"additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"verify_claim","owner":"evidence","description":"Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion.","risk":"read-only","timeoutMs":12000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate","inputSchema":{"type":"object","required":["statement"],"properties":{"statement":{"type":"string","minLength":1},"classification":{"enum":["OBSERVED","INFERRED","HYPOTHESIS"]},"entityId":{"type":"string"}},"additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"run_investigation","owner":"investigate","description":"Run the bounded Investigate orchestration loop and return its structured event stream.","risk":"read-only","timeoutMs":60000,"retryPolicy":"none","authPolicy":"platform-key","tracePolicy":"propagate","inputSchema":{"type":"object","required":["question","datasetId"],"properties":{"question":{"type":"string","minLength":1,"maxLength":500},"datasetId":{"type":"string","minLength":1,"maxLength":128}},"additionalProperties":false},"outputSchema":{"type":"object","properties":{"events":{"type":"array"}}}}],"resources":[{"uri":"investigate://incident","name":"incident","mimeType":"application/json"},{"uri":"investigate://tools","name":"tools","mimeType":"application/json"},{"uri":"investigate://policy","name":"policy","mimeType":"application/json"}],"prompts":[{"name":"investigate_incident","description":"Investigate the loaded incident with verified claims."},{"name":"assess_source_gap","description":"Assess whether available telemetry can support a requested conclusion."}]}}