Loading ToolBench
Production-ready MCP server for threat hunting with HEARTH community integration, PEAK framework support, threat intelligence analysis, and advanced hunting capabilities
Server has 13 tools with mostly complete schemas and descriptions, but significant gaps in parameter documentation, error handling guidance, and output schema clarity. Tool names follow verb_noun convention well (search_, get_, create_, list_). Descriptions average ~150 chars, meeting baseline. However, many parameters lack descriptions or constraints. No tool annotations (readOnlyHint/destructiveHint). Error responses are generic ('success': false, 'error': str(e)) without recovery guidance. Output schemas are not formally documented, responses are inferred from code. Two write tools (create_behavioral_hunt, create_custom_peak_hunt) lack confirmation/dry-run patterns. HEARTH integration is undocumented in tool descriptions.
Analyze MITRE ATT&CK tactic coverage in community hunts. See which tactics have the most community-contributed hunt ideas.
Creates a behavioral PEAK hunt focused on a MITRE ATT&CK technique. This tool emphasizes hunting for behaviors (TTPs) at the top of the Pyramid of Pain, not atomic indicators.
Creates a custom PEAK hunt report with full control over all fields.
Retrieve a specific community hunt by ID. Get detailed information about a specific hunt from the HEARTH database.
Get community hunts for a MITRE ATT&CK tactic. Retrieve hunt hypotheses from the community for a specific tactic.
Get community hunts for a MITRE ATT&CK technique. Find hunts that reference a specific ATT&CK technique ID.
Output schemas not formally documented. Tool responses inferred from code (e.g., search_community_hunts returns {success, count, hunts, filters, source}). LLMs cannot plan downstream calls without explicit schema documentation.
Write tools (create_behavioral_hunt, create_custom_peak_hunt) lack confirmation/dry-run pattern. Agents can accidentally create duplicate hunts without verification. No idempotency guarantees documented.
Error responses are generic: {'success': false, 'error': str(e)}. No recovery guidance. E.g., 'Hunt not found' does not suggest calling search_community_hunts or list_hunts. Agents cannot self-correct.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | <=2025-11-25 | v2 |
Returns the PEAK template content for reference.
Get recently added community hunts. Discover the latest threat hunting ideas from the community.
Check server health and feature availability. Returns comprehensive diagnostic information about the server, including which features are enabled, configuration status, and resource counts.
Lists all PEAK hunts in the hunts directory.
Get personalized hunt recommendations from community knowledge. AI-powered recommendations based on your environment and threat landscape.
Search HEARTH community hunt database. Search through hundreds of community-curated threat hunting hypotheses from security professionals worldwide.
Suggests behavioral hunt alternatives when given an IOC. This is a KEY function that pivots from bottom-of-pyramid IOCs to top-of-pyramid behavioral hunts.
Tool annotations missing. No readOnlyHint on read tools, no destructiveHint on write tools. Agents cannot infer safety/reversibility without explicit hints.
Parameter descriptions incomplete. E.g., 'data_sources' in create_behavioral_hunt is 'List of log sources with format: [...]' but lacks type clarity (array of objects with required fields?). 'hunt_type' in create_custom_peak_hunt lacks enum constraint documentation.