{"server":"correlate","protocol":"JSON-RPC 2.0","endpoint":"/api/mcp","methods":["initialize","ping","tools/list","tools/call","resources/list","resources/read","prompts/list","prompts/get"],"tools":[{"name":"correlate_events","description":"Correlate supplied SIEM events into relationships, chains, and a receipt.","inputSchema":{"type":"object","required":["events"],"properties":{"events":{"type":"array","items":{"type":"object"}},"internalNetworks":{"type":"array","items":{"type":"string"}}}},"outputSchema":{"type":"object"}},{"name":"normalize_events","description":"Normalize supplied SIEM events into canonical observations.","inputSchema":{"type":"object","required":["events"],"properties":{"events":{"type":"array","items":{"type":"object"}}}},"outputSchema":{"type":"object"}},{"name":"get_activity_chains","description":"Return activity chains from supplied events or the sanitized demo fixture.","inputSchema":{"type":"object","properties":{"events":{"type":"array","items":{"type":"object"}}}},"outputSchema":{"type":"object"}},{"name":"get_activity_chain","description":"Return one activity chain and its explanation.","inputSchema":{"type":"object","required":["chainId"],"properties":{"events":{"type":"array","items":{"type":"object"}},"chainId":{"type":"string"}}},"outputSchema":{"type":"object"}},{"name":"get_relationship","description":"Return one deterministic relationship by id.","inputSchema":{"type":"object","required":["relationshipId"],"properties":{"events":{"type":"array","items":{"type":"object"}},"relationshipId":{"type":"string"}}},"outputSchema":{"type":"object"}},{"name":"explain_relationship","description":"Explain a relationship with rule factors and source observations.","inputSchema":{"type":"object","required":["relationshipId"],"properties":{"events":{"type":"array","items":{"type":"object"}},"relationshipId":{"type":"string"}}},"outputSchema":{"type":"object"}},{"name":"query_entities","description":"Query normalized entities by id, type, or value.","inputSchema":{"type":"object","properties":{"events":{"type":"array","items":{"type":"object"}},"query":{"type":"string"},"limit":{"type":"integer","minimum":1,"maximum":100}}},"outputSchema":{"type":"object"}},{"name":"get_observations","description":"Read bounded canonical observations by id, entity, or source type.","inputSchema":{"type":"object","properties":{"events":{"type":"array","items":{"type":"object"}},"refs":{"type":"array","items":{"type":"string"},"maxItems":100},"entityRef":{"type":"string"},"sourceType":{"type":"string"},"limit":{"type":"integer","minimum":1,"maximum":100}}},"outputSchema":{"type":"object"}},{"name":"list_rules","description":"List the deterministic correlation rule registry.","inputSchema":{"type":"object","additionalProperties":false},"outputSchema":{"type":"object"}},{"name":"run_demo","description":"Run the sanitized 242-event reference incident.","inputSchema":{"type":"object","additionalProperties":false},"outputSchema":{"type":"object"}}],"resources":[{"uri":"correlate://rules","name":"rule registry","mimeType":"application/json"},{"uri":"correlate://demo/receipt","name":"demo receipt","mimeType":"application/json"},{"uri":"correlate://tools","name":"tool registry","mimeType":"application/json"}],"prompts":[{"name":"explain_activity_chain","description":"Explain an activity chain from deterministic relationships and raw observations."},{"name":"inspect_relationship","description":"Inspect a relationship's matched factors without adding attack interpretation."}]}