From ecc8fdc06c1db4c0f1fca08c2e855460b0a608eb Mon Sep 17 00:00:00 2001 From: Antoine Parent Date: Mon, 13 Jul 2026 11:53:59 -0400 Subject: [PATCH] Add the events_get_event tool. Fixes a few typo. Ran lint + format which is why we have ~11 files touched --- .../v4/endpoints/assign-policy.mdx | 4 +- .../v4/endpoints/create-identifier.mdx | 4 +- .../v4/endpoints/create-matching-policy.mdx | 4 +- .../v4/endpoints/delete-identifier.mdx | 2 +- .../v4/endpoints/delete-matching-policy.mdx | 4 +- .../v4/endpoints/get-matching-policy.mdx | 4 +- .../v4/endpoints/list-identifiers.mdx | 2 +- ...ist-matching-policies-by-identifier-id.mdx | 4 +- .../v4/endpoints/list-matching-policies.mdx | 4 +- .../v4/endpoints/list-policy-assignments.mdx | 4 +- .../v4/endpoints/retrieve-identifier.mdx | 4 +- .../v4/endpoints/unassign-policy.mdx | 4 +- .../v4/endpoints/update-identifier.mdx | 4 +- .../v4/endpoints/update-matching-policy.mdx | 4 +- docs/event-types-v2/overview.mdx | 29 ++++---- docs/sdk/api-mcp.mdx | 67 ++++++++++--------- scripts/openapi-post-process.py | 1 + 17 files changed, 76 insertions(+), 73 deletions(-) diff --git a/docs/api-reference/v4/endpoints/assign-policy.mdx b/docs/api-reference/v4/endpoints/assign-policy.mdx index 19518418..b1748d12 100644 --- a/docs/api-reference/v4/endpoints/assign-policy.mdx +++ b/docs/api-reference/v4/endpoints/assign-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Assign Policy (Beta)" -openapi: post /firework/v4/matching-policies/{policy_uuid}/assignments +openapi: firework-v4-openapi post /firework/v4/matching-policies/{policy_uuid}/assignments +title: Assign Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/create-identifier.mdx b/docs/api-reference/v4/endpoints/create-identifier.mdx index 375957ee..af57f746 100644 --- a/docs/api-reference/v4/endpoints/create-identifier.mdx +++ b/docs/api-reference/v4/endpoints/create-identifier.mdx @@ -1,4 +1,4 @@ --- -title: "Create Identifier" -openapi: post /firework/v4/identifiers/ +openapi: firework-v4-openapi post /firework/v4/identifiers/ +title: Create Identifier --- \ No newline at end of file diff --git a/docs/api-reference/v4/endpoints/create-matching-policy.mdx b/docs/api-reference/v4/endpoints/create-matching-policy.mdx index c0e6e46a..d1fc77d3 100644 --- a/docs/api-reference/v4/endpoints/create-matching-policy.mdx +++ b/docs/api-reference/v4/endpoints/create-matching-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Create Matching Policy (Beta)" -openapi: post /firework/v4/matching-policies +openapi: firework-v4-openapi post /firework/v4/matching-policies +title: Create Matching Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/delete-identifier.mdx b/docs/api-reference/v4/endpoints/delete-identifier.mdx index 23c42f80..ef3d3c2b 100644 --- a/docs/api-reference/v4/endpoints/delete-identifier.mdx +++ b/docs/api-reference/v4/endpoints/delete-identifier.mdx @@ -1,5 +1,5 @@ --- -openapi: delete /firework/v4/identifiers/{identifier_id} +openapi: firework-v4-openapi delete /firework/v4/identifiers/{identifier_id} --- diff --git a/docs/api-reference/v4/endpoints/delete-matching-policy.mdx b/docs/api-reference/v4/endpoints/delete-matching-policy.mdx index 2d3e79b4..548b9d3c 100644 --- a/docs/api-reference/v4/endpoints/delete-matching-policy.mdx +++ b/docs/api-reference/v4/endpoints/delete-matching-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Delete Matching Policy (Beta)" -openapi: delete /firework/v4/matching-policies/{policy_uuid} +openapi: firework-v4-openapi delete /firework/v4/matching-policies/{policy_uuid} +title: Delete Matching Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/get-matching-policy.mdx b/docs/api-reference/v4/endpoints/get-matching-policy.mdx index 7e2d5d65..582e6f2a 100644 --- a/docs/api-reference/v4/endpoints/get-matching-policy.mdx +++ b/docs/api-reference/v4/endpoints/get-matching-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Retrieve Matching Policy (Beta)" -openapi: get /firework/v4/matching-policies/{policy_uuid} +openapi: firework-v4-openapi get /firework/v4/matching-policies/{policy_uuid} +title: Retrieve Matching Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/list-identifiers.mdx b/docs/api-reference/v4/endpoints/list-identifiers.mdx index b908308c..34367881 100644 --- a/docs/api-reference/v4/endpoints/list-identifiers.mdx +++ b/docs/api-reference/v4/endpoints/list-identifiers.mdx @@ -1,3 +1,3 @@ --- -openapi: get /firework/v4/identifiers/ +openapi: firework-v4-openapi get /firework/v4/identifiers/ --- \ No newline at end of file diff --git a/docs/api-reference/v4/endpoints/list-matching-policies-by-identifier-id.mdx b/docs/api-reference/v4/endpoints/list-matching-policies-by-identifier-id.mdx index 8c5a7ed6..965198d1 100644 --- a/docs/api-reference/v4/endpoints/list-matching-policies-by-identifier-id.mdx +++ b/docs/api-reference/v4/endpoints/list-matching-policies-by-identifier-id.mdx @@ -1,6 +1,6 @@ --- -title: "List Matching Policies By Identifier Id (Beta)" -openapi: get /firework/v4/matching-policies/by_identifier_id/{identifier_id} +openapi: firework-v4-openapi get /firework/v4/matching-policies/by_identifier_id/{identifier_id} +title: List Matching Policies By Identifier Id (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/list-matching-policies.mdx b/docs/api-reference/v4/endpoints/list-matching-policies.mdx index 172c1c3f..92aebe93 100644 --- a/docs/api-reference/v4/endpoints/list-matching-policies.mdx +++ b/docs/api-reference/v4/endpoints/list-matching-policies.mdx @@ -1,6 +1,6 @@ --- -title: "List Matching Policies (Beta)" -openapi: get /firework/v4/matching-policies +openapi: firework-v4-openapi get /firework/v4/matching-policies +title: List Matching Policies (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/list-policy-assignments.mdx b/docs/api-reference/v4/endpoints/list-policy-assignments.mdx index a018b830..55d57c3e 100644 --- a/docs/api-reference/v4/endpoints/list-policy-assignments.mdx +++ b/docs/api-reference/v4/endpoints/list-policy-assignments.mdx @@ -1,6 +1,6 @@ --- -title: "List Policy Assignments (Beta)" -openapi: get /firework/v4/matching-policies/{policy_uuid}/assignments +openapi: firework-v4-openapi get /firework/v4/matching-policies/{policy_uuid}/assignments +title: List Policy Assignments (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/retrieve-identifier.mdx b/docs/api-reference/v4/endpoints/retrieve-identifier.mdx index 243c5fec..80e49270 100644 --- a/docs/api-reference/v4/endpoints/retrieve-identifier.mdx +++ b/docs/api-reference/v4/endpoints/retrieve-identifier.mdx @@ -1,4 +1,4 @@ --- -title: "Retrieve Identifier" -openapi: get /firework/v4/identifiers/{identifier_id} +openapi: firework-v4-openapi get /firework/v4/identifiers/{identifier_id} +title: Retrieve Identifier --- \ No newline at end of file diff --git a/docs/api-reference/v4/endpoints/unassign-policy.mdx b/docs/api-reference/v4/endpoints/unassign-policy.mdx index 6a8dbbb8..80b5f728 100644 --- a/docs/api-reference/v4/endpoints/unassign-policy.mdx +++ b/docs/api-reference/v4/endpoints/unassign-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Unassign Policy (Beta)" -openapi: delete /firework/v4/matching-policies/{policy_uuid}/assignments +openapi: firework-v4-openapi delete /firework/v4/matching-policies/{policy_uuid}/assignments +title: Unassign Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/api-reference/v4/endpoints/update-identifier.mdx b/docs/api-reference/v4/endpoints/update-identifier.mdx index f30a937d..3861aec7 100644 --- a/docs/api-reference/v4/endpoints/update-identifier.mdx +++ b/docs/api-reference/v4/endpoints/update-identifier.mdx @@ -1,4 +1,4 @@ --- -title: "Update Identifier" -openapi: put /firework/v4/identifiers/{identifier_id} +openapi: firework-v4-openapi put /firework/v4/identifiers/{identifier_id} +title: Update Identifier --- \ No newline at end of file diff --git a/docs/api-reference/v4/endpoints/update-matching-policy.mdx b/docs/api-reference/v4/endpoints/update-matching-policy.mdx index bcd887d3..e9a026a1 100644 --- a/docs/api-reference/v4/endpoints/update-matching-policy.mdx +++ b/docs/api-reference/v4/endpoints/update-matching-policy.mdx @@ -1,6 +1,6 @@ --- -title: "Update Matching Policy (Beta)" -openapi: put /firework/v4/matching-policies/{policy_uuid} +openapi: firework-v4-openapi put /firework/v4/matching-policies/{policy_uuid} +title: Update Matching Policy (Beta) --- import BetaEndpoint from '/snippets/beta-endpoint.mdx' diff --git a/docs/event-types-v2/overview.mdx b/docs/event-types-v2/overview.mdx index b28bc619..cb7613b1 100644 --- a/docs/event-types-v2/overview.mdx +++ b/docs/event-types-v2/overview.mdx @@ -2,22 +2,21 @@ title: "Event Types V2 (Beta)" description: "Overview of all Flare API event types" --- - -Event Types V2 are still in beta and are subject to change. - + +Event Types V2 are still in beta and are subject to change. Currently these event type models are supported on the [Retrieve Event V2 Endpoint ](/api-reference/v4/endpoints/get-event) -| Event Type | Documentation | -| --------------------------- | -------------------------------------------------------------------------------------------- | -| `blog_post` | [Blog Post ](/event-types-v2/blog-post) | -| `bucket` | [Bucket ](/event-types-v2/bucket) | -| `chat_message` | [Chat Message ](/event-types-v2/chat-message) | -| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) | -| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) | -| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) | -| `listing` | [Listing ](/event-types-v2/listing) | -| `paste` | [Paste ](/event-types-v2/paste) | -| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) | -| `social_media` | [Social media ](/event-types-v2/social-media-account) | +| Event Type | Documentation | +| -------------- | ----------------------------------------------------------------------------------- | +| `blog_post` | [Blog Post ](/event-types-v2/blog-post) | +| `bucket` | [Bucket ](/event-types-v2/bucket) | +| `chat_message` | [Chat Message ](/event-types-v2/chat-message) | +| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) | +| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) | +| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) | +| `listing` | [Listing ](/event-types-v2/listing) | +| `paste` | [Paste ](/event-types-v2/paste) | +| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) | +| `social_media` | [Social media ](/event-types-v2/social-media-account) | diff --git a/docs/sdk/api-mcp.mdx b/docs/sdk/api-mcp.mdx index c97051f2..cb7eee95 100644 --- a/docs/sdk/api-mcp.mdx +++ b/docs/sdk/api-mcp.mdx @@ -2,9 +2,7 @@ title: "API MCP (beta)" --- - - The Flare API MCP server is still in beta and is subject to change. - +The Flare API MCP server is still in beta and is subject to change. Flare provides a [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server that @@ -19,18 +17,17 @@ themselves), see the ## Available Tools -| Tool | Description | -| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -| `search_global` | Global Search — execute a Lucene query against the entire Flare threat-intel dataset. | -| `search_tenant` | Tenant Search — execute a Lucene query scoped to events matching the caller's monitored identifiers. | -| `search_validate_search_query` | Validate that a Lucene query complies with Flare's search rules before running it. Useful when composing or debugging a query. | -| `events_get_event_type` | Return the documentation and searchable field list for a given event type (e.g. `chat_message`, `forum_post`, `stealer_log`). | -| `profile_get` | Return the current user's profile, including tenants, permissions, feature flags, and default tenant id. | - +| Tool | Description | +| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | +| `search_global` | Global Search — executes a Lucene query against the entire Flare threat-intel dataset. | +| `search_tenant` | Tenant Search — executes a Lucene query scoped to events matching the caller's monitored identifiers. | +| `search_validate_search_query` | Validates that a Lucene query complies with Flare's search rules before running it. Useful when composing or debugging a query. | +| `events_get_event` | Returns the complete event payload (metadata + data) for a single uid. | +| `events_get_event_type` | Returns the documentation and searchable field list for a given event type (e.g. `chat_message`, `forum_post`, `stealer_log`). | +| `profile_get` | Returns the current user's profile, including tenants, permissions, feature flags, and default tenant id. | - `search_global` requires the Global Search permission on the target - tenant. + `search_global` requires the Global Search permission on the target tenant. ### Search Parameters @@ -89,12 +86,13 @@ Requests default to your account's default tenant. To scope MCP tool calls to a specific tenant, set the `X-Flare-Tenant-Id` header on the MCP connection to the target tenant id. You can find your tenant ids via the `profile_get` MCP tool, or on the [Profile page](https://app.flare.io/#/profile) under the "Tenants" section (also documented in the -[Authentication Guide ](/concepts/authentication#finding-tenant-ids)). +[Authentication Guide ](/concepts/authentication#finding-tenant-ids)). ## Client Setup -The `X-Flare-Tenant-Id` header is optional: omitting it uses your default tenant. + The `X-Flare-Tenant-Id` header is optional: omitting it uses your default + tenant. ### Claude Code @@ -108,6 +106,7 @@ claude mcp add flare --transport http https://api.flare.io/mcp \ --header "Authorization: " \ --header "X-Flare-Tenant-Id: " ``` + The Flare API key is obtained from the [Authentication Guide ](/concepts/authentication). @@ -134,9 +133,9 @@ under the `flare` server in the `/mcp` command output, and Claude will call them automatically when your prompts match their descriptions. - Store the API key outside version control. Claude Code also supports - reading headers from environment variables — see the - [Claude Code MCP docs](https://code.claude.com/docs/en/mcp#environment-variable-expansion-in-mcp-json) + Store the API key outside version control. Claude Code also supports reading + headers from environment variables — see the [Claude Code MCP + docs](https://code.claude.com/docs/en/mcp#environment-variable-expansion-in-mcp-json) for details. @@ -168,26 +167,30 @@ The file is also reachable through **Settings → Developer → Edit Config**. } } ``` + Once the change is in place, you should fully quit and relaunch Claude Desktop. ### Cursor - The server can be added to the `.cursor/mcp.json` in your project (or - `~/.cursor/mcp.json` to make it available in all projects). - ```json .cursor/mcp.json - { - "mcpServers": { - "flare": { - "url": "https://api.flare.io/mcp", - "headers": { - "Authorization": "", - "X-Flare-Tenant-Id": "" - } + +The server can be added to the `.cursor/mcp.json` in your project (or +`~/.cursor/mcp.json` to make it available in all projects). + +```json .cursor/mcp.json +{ + "mcpServers": { + "flare": { + "url": "https://api.flare.io/mcp", + "headers": { + "Authorization": "", + "X-Flare-Tenant-Id": "" } } } - ``` - Cursor picks up the change automatically: check **Settings → MCP** to confirm the MCP server is connected. - See [Cursor's MCP docs](https://cursor.com/docs/mcp) for details. +} +``` + +Cursor picks up the change automatically: check **Settings → MCP** to confirm the MCP server is connected. +See [Cursor's MCP docs](https://cursor.com/docs/mcp) for details. ## Quotas & Rate Limits diff --git a/scripts/openapi-post-process.py b/scripts/openapi-post-process.py index f403eb36..220335ad 100755 --- a/scripts/openapi-post-process.py +++ b/scripts/openapi-post-process.py @@ -5,6 +5,7 @@ from typing import Any + HTTP_METHODS = {"get", "put", "post", "delete", "options", "head", "patch", "trace"}