MCP server

OpenTide MCP server — search, validate, deploy, and query detection content from AI agents and editors.

The OpenTide MCP server exposes catalogue search, validation, deployment, and read-only resources to AI agents and editor integrations.

Quick start

pip install 'opentide==0.1.0'
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide setup mcp --cursor --yes

Start manually:

opentide-mcp

Transport: stdio (standard MCP over stdin/stdout).

What agents can do

Capability	Tool / resource
Search catalogue	`search`
Threat → objective → rule graph	`get_chaining`
ATT&CK coverage gaps	`coverage`
Validate a rule	`validate_rule`, `validation_report`
Validate query syntax	`validate_query`
Run read-only query	`run_query` (capped at 100 rows)
Deploy (dry-run default)	`deploy_rule`
Deployment state	`deployment_status`
Read schemas, templates, vocab	`opentide://*` resources

Stub tools: validate_query and run_query are placeholders — they do not parse queries or execute live platform queries yet. Use CLI opentide validate query for real syntax validation.

Server instructions

The server advertises this purpose to MCP hosts:

Detection engineering assistant. Search and analyse detection content, validate rules and queries, test queries against live platforms, and deploy detection rules.

Documentation map

Page	Content
Installation	PyPI extra and host requirements
Configuration	Editor config files and environment
Tools	Tool parameters and response shapes
Resources	URI catalogue and JSON payloads

Usage guide

Human-oriented agent setup: Agentic setup

Source

src/opentide/mcp_server/server.py, src/opentide/mcp_server/tools.py, src/opentide/mcp_server/resources.py