{"jsonrpc":"2.0","id":null,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":false}},"serverInfo":{"name":"soar-record-gateway","version":"1.0.0"},"tools":[{"name":"fetch_security_records","description":"Fetch synthesized SOAR playbooks grounded in the golden security dataset, filtered by platform, executability, and safety flags. Returns derived playbooks with provenance (record_id, content_hash, source_url) - never raw records. Metered at $0.25 USD per UNIQUE record ID (billed the first time a record is served to your account in a month; repeat retrievals are free), capped at 1,400 distinct records per account per month. Request only the records you need.","inputSchema":{"type":"object","properties":{"platform":{"type":"string","description":"SIEM/SOAR platform filter, e.g. sentinel, crowdstrike, splunk."},"is_executable":{"type":"boolean","description":"Only records containing runnable automation."},"has_destructive_step":{"type":"boolean","description":"Only records containing state-modifying or destructive steps."},"requires_human_approval":{"type":"boolean","description":"Only records flagged as requiring human approval before execution."},"limit":{"type":"integer","minimum":1,"maximum":100,"default":10,"description":"Maximum number of records to return (1-100, default 10)."}},"additionalProperties":false}},{"name":"get_total_record_count","description":"Returns the total number of records currently in the SOAR security database (the golden dataset). Free, unmetered metadata call - no records are returned or billed.","inputSchema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"search_security_records","description":"Keyword/full-text search across the golden SOAR security dataset (payload content, ranked by relevance). Returns synthesized playbooks with provenance (record_id, content_hash, source_url) - never raw records. Flat price: $0.01 USD per search call regardless of matches returned (billed via Stripe meter). Matches served count toward the monthly 1,400-unique-records-per-account cap shared with fetch_security_records. Use instead of fetch_security_records when you need to find records by content rather than sample the corpus.","inputSchema":{"type":"object","properties":{"q":{"type":"string","minLength":1,"maxLength":200,"description":"Search term (1-200 chars) matched against record payload content."},"platform":{"type":"string","description":"SIEM/SOAR platform filter: sentinel, splunk_soar, xsoar, google_secops, knowledge_qa."},"is_executable":{"type":"boolean","description":"Only records containing runnable automation."},"has_destructive_step":{"type":"boolean","description":"Only records containing state-modifying or destructive steps."},"requires_human_approval":{"type":"boolean","description":"Only records flagged as requiring human approval before execution."},"limit":{"type":"integer","minimum":1,"maximum":50,"default":10,"description":"Maximum number of matching records to return (1-50, default 10)."}},"required":["q"],"additionalProperties":false}}]}}