Skip to content

TOOLS.md

Latest commit

 

History

History
1721 lines (1412 loc) · 54.7 KB

TOOLS.md

File metadata and controls

1721 lines (1412 loc) · 54.7 KB
Raw

AIDEFEND MCP Tools - Complete Reference

This document provides detailed documentation for all 18 MCP tools available in the AIDEFEND MCP Service.

Live-data contract: IDs, names, and corpus-size examples in this guide are aligned to AIDEFEND 1.20260911 (public schema 2.3, MCP index schema 3.3: 93 techniques + 272 sub-techniques + 872 guidance records = 1,237 documents). Rankings, scores, timestamps, framework-coverage totals, and tool counts are illustrative because they are recomputed from the version a customer has synchronized; these snapshot counts are examples, not runtime acceptance thresholds. The service dynamically handles content, ID, title, count, order, and compatible additive-field changes, including open-source, source-available/open-weight, and commercial tool entries. A daily upstream canary checks the rolling public source. Invalid or genuinely incompatible candidates are not activated, so an existing installation continues serving its last-known-good index; arbitrary breaking schemas require a service update. Use get_aidefend_status and validate_technique_id before treating sample values as a live result.

Tool Categories

Basic Query Tools (3 tools)

Essential tools for interacting with the AIDEFEND knowledge base.

Professional Analysis Tools (15 tools)

Specialized P0 tools for AI security practitioners, security engineers, and developers.

Basic Query Tools

Tool 1: Query AIDEFEND

Purpose: Search the AIDEFEND AI security defense knowledge base using natural language queries.

When to use: Finding defense strategies, techniques, and best practices for AI/ML security threats.

MCP Mode Example (Claude Desktop):

You: "How do I defend against prompt injection attacks?"

Claude: [Uses query_aidefend tool]
        Based on AIDEFEND, here are the key defense techniques:

        1. AID-H-001: Adversarial Robustness Training
        2. AID-H-002: AI-Contextualized Data Sanitization & Input Validation
        3. AID-D-001: Adversarial Input, Prompt Injection & Signal-Authenticity Detection
        ...

REST API Example:

curl -X POST "http://localhost:8000/api/v1/query" \
  -H "Content-Type: application/json" \
  -d '{
    "query_text": "How to prevent prompt injection",
    "top_k": 5
  }'

Tool 2: Get AIDEFEND Status

Purpose: Check the current status of the AIDEFEND knowledge base including framework version, total indexed documents, embedding model info, and sync status.

When to use: Verifying service readiness, checking framework version, checking sync status, troubleshooting.

MCP Mode Example (Claude Desktop):

You: "What's the status of the AIDEFEND service?"

Claude: [Uses get_aidefend_status tool]
        AIDEFEND Knowledge Base Status
        - Framework Version: 1.20260911
        - Framework Source Revision: e10c1678
        - Framework Public Schema: 2.3
        - MCP Index Schema: 3.3
        - Framework Migration Registry Schema: 1.0
        - Indexed Documents: 1,237
        - Service ready: Yes

REST API Example:

curl http://localhost:8000/api/v1/status

Selected response fields:

{
  "status": "online",
  "sync_info": {
    "framework_version": "1.20260911",
    "source_revision": "e10c1678ee49f03f8fb0c97d446ba3fbc3543655",
    "framework_public_schema_version": "2.3",
    "index_schema_version": "3.3",
    "framework_migrations_schema_version": "1.0",
    "framework_migrations_registry_version": "2026-09-11",
    "total_documents": 1237,
    "is_syncing": false
  }
}

Framework Public Schema metadata is discovered from data/data.json in the same Framework source revision as the indexed tactics.

Tool 3: Sync AIDEFEND

Purpose: Manually trigger synchronization with the AIDEFEND GitHub repository to fetch the latest defense tactics and techniques.

When to use: Force update to latest framework version, troubleshooting outdated content.

Note: Auto-sync runs every hour by default. This may take a few minutes.

MCP Mode Example (Claude Desktop):

You: "Can you sync the AIDEFEND knowledge base to the latest version?"

Claude: [Uses sync_aidefend tool]
        Starting sync with GitHub...
        Downloading latest content...
        Parsing techniques...
        Generating embeddings...
        ✅ Sync complete! Knowledge base updated to version 1.20260911

REST API Example:

curl -X POST "http://localhost:8000/api/v1/sync"

Response:

{
  "status": "success",
  "message": "Sync completed successfully",
  "framework_version": "1.20260911",
  "documents_synced": 1237,
  "sync_duration_seconds": 42.3
}

Professional Analysis Tools (P0 Tools)

Tool 4: Get Statistics

Purpose: Get a comprehensive overview of the AIDEFEND knowledge base - total documents, coverage by tactic/pillar/phase, and threat framework coverage.

When to use: Understanding the scope of the knowledge base, reporting, or checking data completeness.

MCP Mode Example (Claude Desktop):

You: "Can you show me statistics about the AIDEFEND knowledge base?"

Claude: [Uses get_statistics tool]
        The AIDEFEND knowledge base contains:
        - 1,237 total documents (93 techniques, 272 sub-techniques, 872 strategies)
        - Coverage across 7 tactics: Model, Harden, Detect, Isolate, Deceive, Evict, Restore
        - Threat framework coverage: 10 OWASP LLM Top 10 2026 risks, 28 MITRE ATLAS techniques
        - 299 controls with open-source tools, 34 with source-available/open-weight tools,
          and 275 with commercial tools
        - 42 documents with code snippets

REST API Example:

curl http://localhost:8000/api/v1/statistics

Response:

{
  "overview": {
    "total_documents": 1237,
    "total_techniques": 93,
    "total_subtechniques": 272,
    "total_strategies": 872,
    "total_actionable_items": 300
  },
  "by_tactic": {
    "Harden": 18,
    "Detect": 12,
    "Isolate": 8,
    "Model": 7
  },
  "threat_framework_coverage": {
    "owasp_llm_items_covered": 10,
    "owasp_llm_total_items": 10,
    "owasp_llm_coverage_percentage": 100.0,
    "mitre_atlas_items_covered": 28,
    "maestro_items_covered": 15,
    "techniques_with_threat_mappings": 40,
    "techniques_mapped_percentage": 88.9
  },
  "tools_availability": {
    "techniques_with_opensource_tools": 299,
    "techniques_with_source_available_tools": 34,
    "techniques_with_commercial_tools": 275
  },
  "code_snippets": {
    "documents_with_code_snippets": 42
  }
}

Tool 5: Validate Technique ID

Purpose: Validate if a technique ID exists and is correctly formatted. Provides fuzzy matching suggestions if ID is not found.

When to use: Before querying specific techniques, checking if an ID from documentation is valid, or finding similar techniques.

MCP Mode Example (Claude Desktop):

You: "Is AID-H-001 a valid technique ID?"

Claude: [Uses validate_technique_id tool]
        Yes, AID-H-001 is valid!
        - Name: Adversarial Robustness Training
        - Type: technique
        - Tactic: Harden

You: "What about AID-H-999?"

Claude: [Uses validate_technique_id tool]
        AID-H-999 is not found in the knowledge base.
        Did you mean:
        - AID-H-001 (Adversarial Robustness Training) - 85% match
        - AID-H-002 (AI-Contextualized Data Sanitization & Input Validation) - 78% match

REST API Example:

# Valid ID
curl -X POST "http://localhost:8000/api/v1/validate-technique-id?technique_id=AID-H-001"

Response:

{
  "valid": true,
  "technique": {
    "id": "AID-H-001",
    "name": "Adversarial Robustness Training",
    "type": "technique",
    "tactic": "Harden"
  }
}
# Invalid ID with suggestions
curl -X POST "http://localhost:8000/api/v1/validate-technique-id?technique_id=AID-H-999"

Response:

{
  "valid": false,
  "reason": "NOT_FOUND",
  "suggestions": [
    {
      "id": "AID-H-001",
      "name": "Adversarial Robustness Training",
      "similarity_score": 0.85
    }
  ]
}

Tool 6: Get Technique Detail

Purpose: Get complete details for a specific technique including all sub-techniques, implementation strategies with code examples, tool recommendations, and threat mappings.

When to use: Deep-diving into a specific defense technique, implementing a defense control, or understanding what threats a technique defends against.

MCP Mode Example (Claude Desktop):

You: "Show me all details for technique AID-H-002"

Claude: [Uses get_technique_detail tool]
        Here's the complete breakdown of AID-H-002
        (AI-Contextualized Data Sanitization & Input Validation):

        Main Technique:
        - Tactic: Harden
        - Includes the complete parent and child threat mappings

        Sub-Techniques (8):
        1. AID-H-002.001: Training & Fine-Tuning Data Sanitization
           - 4 implementation guidance records
        2. AID-H-002.002: Inference-Time Prompt & Input Validation
           - 8 implementation guidance records
        3. AID-H-002.003: Multimodal Input Sanitization
           - 4 implementation guidance records
        ... plus 5 additional sub-techniques, returned without truncation

        Tools Available:
        - Open-source, source-available, and commercial entries are returned
          from the synchronized framework without a fixed vendor list

REST API Example:

curl "http://localhost:8000/api/v1/technique/AID-H-002?include_code=true&include_tools=true"

Response (abbreviated):

{
  "technique": {
    "id": "AID-H-002",
    "name": "AI-Contextualized Data Sanitization & Input Validation",
    "type": "technique",
    "tactic": "Harden",
    "description": "AI-contextualized data sanitization and input validation...",
    "tools": {
      "opensource": [],
      "source_available": [],
      "commercial": []
    }
  },
  "subtechniques": [
    {
      "id": "AID-H-002.002",
      "name": "Inference-Time Prompt & Input Validation",
      "strategies": [
        {
          "strategy": "Pydantic-based validation",
          "how_to": "Use Pydantic models to validate input schema...",
          "code_blocks": [
            {
              "language": "python",
              "code": "from pydantic import BaseModel..."
            }
          ]
        }
      ]
    }
  ],
  "metadata": {
    "total_subtechniques": 8,
    "total_strategies": 32
  }
}

⚡ Performance Tip

If you need implementation strategies for multiple techniques at once (e.g., top 5-10 recommendations from an implementation plan), use Tool 13: Get Implementation Plan with detail_level="standard" or "detailed" instead. This avoids a separate detail request for every recommendation. Actual latency depends on the host, model cache, and requested result set.

Example scenario:

  • More round trips: Get implementation plan (basic) → Call get_technique_detail for every recommendation
  • Fewer round trips: Get implementation plan with detail_level="standard"

Use get_technique_detail when you need:

  • Details for a single technique outside the top recommendations
  • Complete information for techniques ranked beyond top 5
  • Direct technique ID queries

Tool 7: Get Defenses for Threat

Purpose: Find AIDEFEND defense techniques for a specific threat. Supports OWASP LLM Top 10 2026 identifiers and declared superseded-edition aliases, MITRE ATLAS, MAESTRO, or natural language keywords. OWASP LLM results are always returned against the active 2026 corpus after a successful current-framework sync.

When to use: Threat-driven defense planning, responding to specific vulnerabilities, or building defense roadmaps.

MCP Mode Example (Claude Desktop):

You: "What current defenses apply to OWASP LLM03:2025 Supply Chain?"

Claude: [Uses get_defenses_for_threat tool]
        Query: LLM03:2025
        Resolution: migrated
        Canonical current risk: LLM04:2026 Supply Chain
        Migrated from: LLM03:2025 Supply Chain

        The returned techniques are the controls reviewed and mapped to the
        current LLM04:2026 Supply Chain definition. The service does not replay
        or automatically carry forward the old 2025 mappings.

OWASP LLM edition-resolution rules:

  • A bare rank or :latest means the active edition. For example, LLM03 and LLM03:latest resolve to LLM03:2026 Excessive Agency, not the 2025 Supply Chain risk.
  • An explicit superseded ID follows its declared semantic successor. LLM03:2025 Supply Chain therefore resolves to LLM04:2026 Supply Chain and uses LLM04 as the reverse-index lookup key.
  • A malformed or unsupported reference such as LLM03:2025x returns resolution.status="invalid". A query containing different concepts, such as LLM03:2025 / LLM06:2025, returns resolution.status="ambiguous" with current candidates.
  • Invalid and ambiguous ID-only queries return zero results with search_method="resolution_only"; they do not guess a rank or scan the defense index. Submit one recognized risk concept to continue.
You: "How do I defend against model poisoning attacks?"

Claude: [Uses get_defenses_for_threat with keyword search]
        For "model poisoning", here are the relevant defenses:

        1. AID-M-001: AI Asset Inventory & Mapping (semantic match: 0.89)
        2. AID-D-003: AI Output Monitoring & Policy-Violation Detection (semantic match: 0.85)
        3. AID-H-004: Identity, Access & Trusted Communication for AI Systems (semantic match: 0.82)

REST API Example:

# Resolve a superseded OWASP LLM concept to the current corpus
curl -X POST "http://localhost:8000/api/v1/defenses-for-threat?threat_id=LLM03%3A2025&top_k=5"

Selected response metadata (the defense list is omitted here):

{
  "threat_query": {
    "threat_id": "LLM03:2025",
    "threat_keyword": null,
    "normalized_threat_id": "LLM04",
    "lookup_threat_id": "LLM04",
    "canonical_threat_id": "LLM04:2026",
    "resolution": {
      "status": "migrated",
      "input": "LLM03:2025",
      "canonical": {
        "frameworkKey": "owasp_llm",
        "framework": "OWASP LLM Top 10 2026",
        "edition": "2026",
        "id": "LLM04:2026",
        "name": "Supply Chain",
        "label": "LLM04:2026 Supply Chain"
      },
      "reason": "The risk moved from rank 3 to rank 4 and now explicitly treats promoted artifacts, adapters, conversion, merge, quantization, and on-device delivery as first-class supply-chain surfaces.",
      "migratedFrom": {
        "edition": "2025",
        "id": "LLM03:2025",
        "name": "Supply Chain",
        "label": "LLM03:2025 Supply Chain"
      }
    }
  },
  "search_method": "exact"
}
# Search by keyword
curl -X POST "http://localhost:8000/api/v1/defenses-for-threat?threat_keyword=prompt%20injection&top_k=10"

Tool 8: Get Secure Code Snippet

Purpose: Extract executable secure code snippets from AIDEFEND implementation strategies. Search by technique ID or topic keyword to get copy-paste ready code examples.

When to use: Implementing specific security controls, looking for code examples, or rapid prototyping.

MCP Mode Example (Claude Desktop):

You: "Show me code examples for input validation"

Claude: [Uses get_secure_code_snippet tool]
        I found 5 code snippets for input validation:

        Snippet 1 (Python):
        from pydantic import BaseModel, Field

        class UserPrompt(BaseModel):
            text: str = Field(max_length=500)

        def validate_input(prompt: str):
            return UserPrompt(text=prompt)

        Snippet 2 (JavaScript):
        const Joi = require('joi');
        const schema = Joi.string().max(500).required();
        ...

REST API Example:

# Get code for specific technique
curl -X POST "http://localhost:8000/api/v1/code-snippets?technique_id=AID-H-002.002&max_snippets=5"

Response:

{
  "query": {
    "technique_id": "AID-H-002.002",
    "topic": null,
    "language_filter": null
  },
  "code_snippets": [
    {
      "technique_id": "AID-H-002.002",
      "technique_name": "Inference-Time Prompt & Input Validation",
      "tactic": "Harden",
      "code": "from pydantic import BaseModel, Field\n\nclass UserPrompt(BaseModel):\n    text: str = Field(max_length=500)",
      "language": "python",
      "description": "Use Pydantic for input validation",
      "usage_context": "Validate user prompts before sending to LLM"
    }
  ],
  "total_snippets": 5,
  "usage_notes": {
    "security_warning": "Review and test all code before using in production",
    "adaptation_required": "Code snippets may need adaptation to your specific environment"
  }
}
# Search by topic with language filter
curl -X POST "http://localhost:8000/api/v1/code-snippets?topic=RAG%20security&language=python&max_snippets=3"

💡 Best Practice Workflow

When working with implementation plans, use this recommended workflow:

  1. Get overview: Use Tool 13: Get Implementation Plan with detail_level="standard" to get technique recommendations with brief strategy summaries
  2. Present to user: Show the recommendations and summaries to help user select priorities
  3. Get code examples: Use get_secure_code_snippet for specific techniques the user wants to implement

Example scenario:

  • More round trips: Get plan (basic) → Call get_technique_detail for every recommendation → Call get_secure_code_snippet for every recommendation
  • Fewer round trips: Get plan (standard) → Show summaries → Call get_secure_code_snippet only for selected techniques

Use get_secure_code_snippet when you need:

  • Code for specific techniques outside the top recommendations
  • Complete code collections with language filtering
  • Code from techniques ranked beyond top 5

Tool 9: Analyze Coverage

Purpose: Analyze defense coverage based on implemented techniques and identify gaps. Provides coverage percentage by tactic/pillar/phase, threat framework coverage, and prioritized recommendations.

When to use: Security program management, gap analysis, prioritizing security investments, or reporting to leadership.

MCP Mode Example (Claude Desktop):

You: "I've implemented AID-H-001, AID-H-002, and AID-D-001. What's my coverage?"

Claude: [Uses analyze_coverage tool]
        Your defense coverage analysis:

        Overall Coverage: 1.0% (3 of 300 actionable controls implemented)
        Coverage Level: Minimal

        Coverage by Tactic:
        - Harden: 11% (2 of 18 techniques)
        - Detect: 8% (1 of 12 techniques)
        - Isolate: 0% ⚠️ CRITICAL GAP
        - Model: 0% ⚠️ CRITICAL GAP

        Critical Gaps:
        1. No Isolate techniques - Complete lack of isolation capability
        2. No Model techniques - No model hardening defenses

        Recommended Next Steps:
        1. Implement AID-I-001 (AI Execution Sandboxing & Runtime Isolation) - HIGH PRIORITY
        2. Implement AID-M-001 (AI Asset Inventory & Mapping) - HIGH PRIORITY
        3. Achieve 50%+ coverage in Harden tactic

REST API Example:

curl -X POST "http://localhost:8000/api/v1/analyze-coverage" \
  -H "Content-Type: application/json" \
  -d '{
    "implemented_techniques": ["AID-H-001", "AID-H-002", "AID-D-001"],
    "system_type": "rag"
  }'

Response:

{
  "analysis_summary": {
    "total_techniques_available": 300,
    "techniques_implemented": 3,
    "coverage_percentage": 1.0,
    "coverage_level": "Minimal",
    "system_type": "rag"
  },
  "coverage_by_tactic": {
    "Harden": {
      "implemented": 2,
      "total": 18,
      "percentage": 11.1,
      "status": "minimal"
    },
    "Detect": {
      "implemented": 1,
      "total": 12,
      "percentage": 8.3,
      "status": "minimal"
    },
    "Isolate": {
      "implemented": 0,
      "total": 8,
      "percentage": 0.0,
      "status": "not_covered"
    }
  },
  "critical_gaps": [
    {
      "gap_type": "tactic",
      "tactic": "Isolate",
      "severity": "HIGH",
      "reason": "No Isolate techniques implemented",
      "risk": "Complete lack of Isolate capability"
    }
  ],
  "recommendations": [
    {
      "rank": 1,
      "technique_id": "AID-I-001",
      "name": "AI Execution Sandboxing & Runtime Isolation",
      "tactic": "Isolate",
      "priority": "HIGH",
      "reason": "Fills Isolate tactic gap",
      "impact": "High - Establishes defensive capability"
    }
  ],
  "next_steps": {
    "immediate": [
      "Implement AID-I-001 (AI Execution Sandboxing & Runtime Isolation) - Fills Isolate tactic gap"
    ],
    "short_term": [
      "Achieve 50%+ coverage in all tactics",
      "Cover the top 5 OWASP LLM Top 10 2026 risks"
    ],
    "long_term": [
      "Achieve 80%+ overall coverage",
      "Implement defense-in-depth across all pillars"
    ]
  }
}

Tool 10: Map to Compliance Framework

Purpose: Map AIDEFEND techniques to compliance framework requirements (NIST AI RMF, EU AI Act, ISO 42001, CSA AI Controls, OWASP ASVS) using heuristic-based analysis.

100% LOCAL - Uses local heuristic matching based on tactic alignment, no external API calls.

When to use: Compliance reporting, audit preparation, governance documentation, or demonstrating regulatory alignment.

MCP Mode Example (Claude Desktop):

You: "Map AID-H-001 and AID-D-001 to NIST AI RMF"

Claude: [Uses map_to_compliance_framework tool]
        Compliance mapping to NIST AI RMF:

        AID-H-001 (Adversarial Robustness Training):
        - Maps to: GOVERN-1.2, MANAGE-2.1
        - Confidence: Medium
        - Rationale: Input validation aligns with risk management and governance controls

        AID-D-001 (Adversarial Input, Prompt Injection & Signal-Authenticity Detection):
        - Maps to: MEASURE-2.1, MANAGE-4.1
        - Confidence: Medium
        - Rationale: Detection techniques align with measurement and incident management

        ⚠️ Note: Mappings should be reviewed by compliance experts

REST API Example:

curl -X POST "http://localhost:8000/api/v1/compliance-mapping" \
  -H "Content-Type: application/json" \
  -d '{
    "technique_ids": ["AID-H-001", "AID-D-001"],
    "framework": "nist_ai_rmf"
  }'

Response:

{
  "framework": {
    "id": "nist_ai_rmf",
    "name": "NIST AI Risk Management Framework"
  },
  "mappings": [
    {
      "technique_id": "AID-H-001",
      "technique_name": "Adversarial Robustness Training",
      "technique_tactic": "Harden",
      "framework": "nist_ai_rmf",
      "framework_name": "NIST AI Risk Management Framework",
      "framework_controls": ["GOVERN-1.2", "MANAGE-2.1"],
      "mapping_confidence": "medium",
      "mapping_rationale": "Mapped based on tactic 'Harden' alignment with framework requirements",
      "additional_considerations": [
        "Review with compliance team for completeness",
        "May require additional controls depending on specific use case",
        "Consider combination with other techniques for full compliance"
      ]
    }
  ],
  "total_mapped": 2,
  "mapping_method": "heuristic",
  "disclaimer": "Compliance mappings are generated automatically using heuristic analysis and should be reviewed by compliance experts. Mappings may not cover all requirements and should be used as guidance only."
}
# Map to EU AI Act
curl -X POST "http://localhost:8000/api/v1/compliance-mapping" \
  -H "Content-Type: application/json" \
  -d '{
    "technique_ids": ["AID-H-001"],
    "framework": "eu_ai_act"
  }'

Tool 11: Get Quick Reference

Purpose: Generate a quick reference guide for a specific security topic. Provides actionable checklist organized by priority (quick wins, must-haves, nice-to-haves).

When to use: Fast decision-making, presentations to leadership, onboarding new team members, or creating security checklists.

MCP Mode Example (Claude Desktop):

You: "Give me a quick reference for prompt injection defense"

Claude: [Uses get_quick_reference tool]
        Quick Reference: Prompt Injection Defense

        🚀 QUICK WINS (Low Effort, High Impact):
        [ ] AID-H-001: Adversarial Robustness Training
            Effort: Low | Impact: High
        [ ] AID-H-002: AI-Contextualized Data Sanitization & Input Validation
            Effort: Low | Impact: Critical

        ⚡ MUST-HAVES (Essential Defenses):
        [ ] AID-D-001: Adversarial Input, Prompt Injection & Signal-Authenticity Detection
            Effort: Medium | Impact: High
        [ ] AID-I-001: AI Execution Sandboxing & Runtime Isolation
            Effort: Medium | Impact: High
        [ ] AID-H-003: Secure ML Supply Chain Management
            Effort: Medium | Impact: High

        ✨ NICE-TO-HAVES (Additional Depth):
        [ ] AID-D-002: AI Model Anomaly & Performance Drift Detection
            Effort: High | Impact: Medium

REST API Example:

curl -X POST "http://localhost:8000/api/v1/quick-reference?topic=RAG%20security&format=checklist&max_items=10"

Response:

{
  "topic": "RAG security",
  "format": "checklist",
  "generated_at": "2025-11-11T12:00:00Z",
  "quick_wins": [
    {
      "priority": 1,
      "technique_id": "AID-H-001",
      "name": "Adversarial Robustness Training",
      "tactic": "Harden",
      "description": "Implement baseline input validation for RAG queries...",
      "estimated_effort": "Low",
      "estimated_impact": "High"
    }
  ],
  "must_haves": [
    {
      "priority": 1,
      "technique_id": "AID-H-003",
      "name": "Secure ML Supply Chain Management",
      "tactic": "Harden",
      "description": "Validate retrieved documents before sending to LLM...",
      "estimated_effort": "Medium",
      "estimated_impact": "High"
    }
  ],
  "nice_to_haves": [
    {
      "priority": 1,
      "technique_id": "AID-D-004",
      "name": "AI Artifact, Runtime Configuration, Route & Lifecycle Integrity Monitoring",
      "tactic": "Detect",
      "description": "Monitor retrieval patterns for anomalies...",
      "estimated_effort": "High",
      "estimated_impact": "Medium"
    }
  ],
  "formatted_output": "# QUICK WINS (Low Effort, High Impact)\n[ ] AID-H-001: Adversarial Robustness Training\n    Effort: Low | Impact: High\n\n# MUST-HAVES (Essential Defenses)\n[ ] AID-H-003: Secure ML Supply Chain Management\n    Effort: Medium | Impact: High\n...",
  "total_items": 10,
  "usage_notes": {
    "quick_wins": "Low effort, high impact - implement first",
    "must_haves": "Essential defenses - prioritize after quick wins",
    "nice_to_haves": "Additional depth - implement when foundational defenses are in place"
  }
}
# Get as markdown table
curl -X POST "http://localhost:8000/api/v1/quick-reference?topic=model%20hardening&format=table"

Tool 12: Get Threat Coverage

Purpose: Analyze threat coverage for implemented defense techniques. Given a list of AIDEFEND technique IDs, calculates which threats are covered (OWASP LLM Top 10 2026, MITRE ATLAS, MAESTRO) and provides coverage rates.

OWASP LLM coverage arrays use stable bare rank keys such as LLM03; read them together with framework_labels.owasp_llm, which identifies the edition atomically associated with the active index. In a current sync, that label is OWASP LLM Top 10 2026.

When to use: Track which threats your implemented defenses cover, identify coverage gaps, report security posture to stakeholders, validate defense investments.

MCP Mode Example (Claude Desktop):

You: "Analyze threat coverage for AID-D-001.001, AID-H-002.001, and AID-I-003.004"

Claude: [Uses get_threat_coverage tool]
        Threat Coverage Analysis

        Techniques Analyzed: 3
        Valid Techniques: 3
        Invalid Techniques: 0

        ## Threat Coverage by Framework

        ### OWASP LLM Top 10 2026
        Coverage: 50.0% (5/10)
        Threats Covered: LLM01, LLM02, LLM03, LLM05, LLM07

        ## Coverage by Technique

        ### AID-D-001.001: Per-Prompt Content, Intent & Obfuscation Analysis
        - OWASP: LLM01

        ### AID-H-002.001: Training & Fine-Tuning Data Sanitization
        - OWASP: LLM02, LLM05

        ### AID-I-003.004: High-Risk Agent Action Containment
        - OWASP: LLM03, LLM07

        Other mapped-framework sections are omitted from this shortened example.

REST API Example:

curl -X POST "http://localhost:8000/api/v1/threat-coverage" \
  -H "Content-Type: application/json" \
  -d '{
    "implemented_techniques": ["AID-D-001.001", "AID-H-002.001", "AID-I-003.004"]
  }'

Selected OWASP-related response fields (other framework keys are omitted):

{
  "input_count": 3,
  "valid_count": 3,
  "invalid_count": 0,
  "invalid_techniques": [],
  "framework_labels": {
    "owasp_llm": "OWASP LLM Top 10 2026"
  },
  "covered": {
    "owasp_llm": ["LLM01", "LLM02", "LLM03", "LLM05", "LLM07"]
  },
  "coverage_rate": {
    "owasp_llm": 0.5
  },
  "by_technique": [
    {
      "technique_id": "AID-D-001.001",
      "technique_name": "Per-Prompt Content, Intent & Obfuscation Analysis",
      "tactic": "Detect",
      "threats_covered": {
        "owasp_llm": ["LLM01"]
      }
    }
  ],
  "timestamp": "2025-11-12T10:30:00Z"
}

Tool 13: Get Implementation Plan

Purpose: Get ranked recommendations for next defense techniques to implement based on heuristic scoring (threat importance, ease of implementation, phase weight, pillar weight). Helps prioritize security investments.

When to use: Plan security roadmap, prioritize technique implementation, find quick wins, justify security budget, optimize defense-in-depth strategy.

Note: This tool provides ONLY heuristic scores. LLM should use these scores to make final recommendations via RAG.

⚡ Compound Tool Pattern: Use detail_level="standard" (recommended) or detail_level="detailed" to get actionable strategy summaries for the top 5 recommendations in a single call, avoiding an N+1 sequence of detail requests.

Strategy Querying:

  • Uses union logic to query BOTH parent-level and sub-technique-level strategies
  • Adds context_source field for strategies from sub-techniques (helps identify which sub-technique a strategy relates to)
  • NEVER includes code snippets automatically - use get_secure_code_snippet separately for specific techniques

Parameters:

  • implemented_techniques (optional): List of already implemented technique IDs
  • exclude_tactics (optional): List of tactics to exclude (e.g., ["Model", "Harden"])
  • top_k (default: 10): Number of recommendations to return (1-20)
  • detail_level (default: "basic"): Level of detail
    • "basic": Returns technique IDs and scores only (fastest, original behavior)
    • "standard": Returns brief summaries (200 chars) for top 5 techniques (recommended for most use cases)
    • "detailed": Returns full summaries (500 chars) for top 5 techniques (for comprehensive planning)

MCP Mode Example (Claude Desktop):

You: "Give me an implementation plan, excluding techniques AID-D-001 and AID-H-002"

Claude: [Uses get_implementation_plan tool]
        Defense Implementation Plan

        Implemented Techniques: 2
        Recommendations Generated: 10

        ## Priority Categories

        - ⚡ Quick Wins (3 techniques): High score + open-source tools available
        - 🎯 High Priority (5 techniques): Score ≥ 7.0
        - 📋 Standard (2 techniques): Score < 7.0

        ## Top Recommendations

        🥇 AID-D-014: RAG Content, Relevance & Retrieval-Provenance Monitoring
           - Score: 8.5/10
           - Tactic: Detect
           - Pillar: Detect | Phase: Development
           - Score Breakdown:
             - Threat Importance: 3.0/3
             - Ease of Implementation: 2.0/2
             - Phase Weight: 1.5/2
             - Pillar Weight: 1.5/2
             - Tool Ecosystem: 0.5/1
           - Reasoning: Covers high-risk threats; Has open-source tools available; Detection adds defense-in-depth
           - ✅ Open-source tools available

        🥈 AID-H-010: Classifier-Free Guidance Hardening
           - Score: 7.5/10
           - Tactic: Harden
           - Pillar: Prevent | Phase: Design
           - Reasoning: Covers high-risk threats; Early-stage implementation (Design)

        🥉 AID-I-005: Emergency "Kill-Switch" / AI System Halt
           - Score: 7.0/10
           - Tactic: Isolate
           - Pillar: Prevent | Phase: Development

REST API Example 1: Basic Mode (default)

curl -X POST "http://localhost:8000/api/v1/implementation-plan" \
  -H "Content-Type: application/json" \
  -d '{
    "implemented_techniques": ["AID-D-001", "AID-H-002"],
    "exclude_tactics": ["Model"],
    "top_k": 10
  }'

Response:

{
  "input": {
    "implemented_count": 2,
    "exclude_tactics": ["Model"],
    "top_k": 10,
    "detail_level": "basic"
  },
  "recommendations": [
    {
      "rank": 1,
      "technique_id": "AID-D-014",
      "technique_name": "Prompt Injection Detection",
      "tactic": "Detect",
      "score": 8.5,
      "score_breakdown": {
        "threat_importance": 3.0,
        "ease_of_implementation": 2.0,
        "phase_weight": 1.5,
        "pillar_weight": 1.5,
        "tool_ecosystem": 0.5
      },
      "reasoning": "Covers high-risk threats; Has open-source tools available; Detection adds defense-in-depth",
      "has_opensource_tools": true,
      "pillar": "Detect",
      "phase": "Development"
    }
  ],
  "categories": {
    "quick_wins": ["AID-D-014", "AID-D-015"],
    "high_priority": ["AID-D-014", "AID-H-010"],
    "standard": ["AID-I-005", "AID-R-001"]
  },
  "timestamp": "2025-11-12T10:30:00Z"
}

REST API Example 2: Standard Mode (Recommended - Compound Tool)

curl -X POST "http://localhost:8000/api/v1/implementation-plan" \
  -H "Content-Type: application/json" \
  -d '{
    "implemented_techniques": [],
    "exclude_tactics": [],
    "top_k": 5,
    "detail_level": "standard"
  }'

Response:

{
  "input": {
    "implemented_count": 0,
    "exclude_tactics": [],
    "top_k": 5,
    "detail_level": "standard"
  },
  "recommendations": [
    {
      "rank": 1,
      "technique_id": "AID-D-014",
      "technique_name": "Prompt Injection Detection",
      "score": 8.5,
      ...
    }
  ],
  "categories": {
    "quick_wins": ["AID-D-014"],
    "high_priority": ["AID-D-014", "AID-H-010"],
    "standard": []
  },
  "actionable_strategies": [
    {
      "technique_id": "AID-D-014",
      "technique_name": "Prompt Injection Detection",
      "strategy_count": 3,
      "strategies": [
        {
          "strategy_name": "Semantic Similarity Detection",
          "summary": "Use embeddings to detect prompt injections by measuring semantic similarity between user inputs and known attack patterns. This approach compares input text against a database of known..."
        },
        {
          "strategy_name": "Rule-Based Detection",
          "summary": "Implement pattern matching rules to identify common injection techniques. Rules check for suspicious patterns like system commands, SQL syntax, and script tags...",
          "context_source": "Direct Injection"
        }
      ]
    }
  ],
  "metadata": {
    "compound_tool_enabled": true,
    "detail_level": "standard",
    "strategies_fetched": 5
  },
  "timestamp": "2025-11-12T10:30:00Z"
}

Note: Strategies with context_source field indicate they come from a sub-technique. This helps you understand the specific context of the strategy.

💡 Recommended Workflow:

  1. Use detail_level="standard" to get a concise overview with 200-character summaries
  2. Present recommendations to user
  3. Use get_secure_code_snippet(technique_id, strategy_name) for specific techniques user selects

This workflow reduces request round trips. Measure end-to-end latency in your own deployment if it is an operational requirement.

Tool 14: Classify Threat (2-Tier Local Matching)

Purpose: Classify threats in text using a fast, local 2-tier matching system:

  1. Tier 1 (Static Keyword): Direct keyword matching (instant)
  2. Tier 2 (RapidFuzz Fuzzy Matching): Optimized typo-tolerant matching

Maps common threat terms (prompt injection, training data poisoning, etc.) to canonical framework IDs (OWASP LLM Top 10 2026, MITRE ATLAS, MAESTRO).

Language note: Both tiers match an English keyword dictionary. Text in other languages returns no_match; use query_aidefend or comprehensive_search, which run multilingual semantic search, for non-English input.

When to use: Normalize threat keywords from incident reports, security alerts, vulnerability descriptions, or threat intelligence to standard framework IDs. Quick triage of security events.

How it works:

  • 100% LOCAL - No external API calls, all processing happens locally
  • Tier 1: Tries static keyword matching first (instant exact matches)
  • Tier 2: If no static match, uses RapidFuzz for typo-tolerant fuzzy matching
  • Always indicates which tier produced the result (static_keyword, fuzzy_match, or no_match)
  • OWASP LLM classifier claims are explicit, versioned 2026 IDs such as LLM05:2026; bare ranks are accepted as lookup aliases but are not emitted as classifier claims
  • mapping_status distinguishes the bundled classifier catalog edition from the active synchronized index edition and reports whether the two are aligned
  • A classification remains visible when its ID is absent from the active index, but it is marked unresolved and no ID-based defense follow-up is recommended for that claim

Key Features:

  • 100% Local & Private: Zero external API calls, all processing on your machine
  • FREE: No API costs, no tokens consumed
  • Fast path: RapidFuzz provides optimized local fuzzy matching
  • Offline-Ready: Works completely offline after initial setup

MCP Mode Example (Claude Desktop):

You: "Classify the following threat: 'We detected a prompt injection attack that bypassed our input validation'"

Claude: [Uses classify_threat tool]
        Threat Classification Results

        Classification Source: 🔍 Static Keyword Match (Tier 1)
        Input Text: We detected a prompt injection attack that bypassed our input validation
        Keywords Matched: 1

        ## Matched Keywords

        🟢 Prompt Injection (Primary, confidence: 0.98)

        ## Normalized Threat IDs

        OWASP LLM Top 10 2026: LLM01:2026
        MITRE ATLAS: AML.T0051
        MAESTRO: Adversarial Examples (L1), Goal Misalignment Cascades (Cross-Layer)

        ## Threat Details

        - OWASP-LLM01:2026: Prompt Injection
          - Confidence: 0.98
          - Matched Keyword: prompt injection
          - Match Type: primary

        ## Recommended Next Steps

        - get_defenses_for_threat
          - Args: {'threat_id': 'LLM01:2026'}
          - Reason: Find defense techniques for LLM01:2026

        - get_quick_reference
          - Args: {'topic': 'prompt injection', 'max_items': 10}
          - Reason: Get actionable mitigation steps for prompt injection

REST API Example:

curl -X POST "http://localhost:8000/api/v1/classify-threat" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Recent training data poisoning attack detected in our ML pipeline",
    "top_k": 5
  }'

Selected response fields (additional ATLAS/MAESTRO details and follow-up actions are omitted):

{
  "source": "static_keyword",
  "input_text_preview": "Recent training data poisoning attack detected in our ML pipeline",
  "keywords_found": [
    {
      "keyword": "training data poisoning",
      "match_type": "primary",
      "confidence": 0.96
    }
  ],
  "normalized_threats": {
    "owasp": ["LLM05:2026"],
    "atlas": ["AML.T0010", "AML.T0018", "AML.T0020"],
    "maestro": [
      "Data Poisoning (L2)",
      "Data Poisoning (Training Phase) (L1)",
      "Supply Chain Attacks (Cross-Layer)"
    ]
  },
  "threat_details": [
    {
      "threat_id": "OWASP-LLM05:2026",
      "threat_name": "Training Data Poisoning",
      "confidence": 0.96,
      "matched_keyword": "training data poisoning",
      "match_type": "primary",
      "resolvable": true
    }
  ],
  "recommended_actions": [
    {
      "tool": "get_defenses_for_threat",
      "args": {"threat_id": "LLM05:2026"},
      "reason": "Find defense techniques for LLM05:2026"
    },
    {
      "tool": "get_quick_reference",
      "args": {"topic": "training data poisoning", "max_items": 10},
      "reason": "Get actionable mitigation steps for training data poisoning"
    }
  ],
  "mapping_status": {
    "all_emitted_claims_resolvable": true,
    "corpus_mapping_available": true,
    "unresolved_claims": [],
    "unmapped_keywords": [],
    "classifier_owasp_llm_edition": "2026",
    "classifier_owasp_llm_label": "OWASP LLM Top 10 2026",
    "active_index_owasp_llm_edition": "2026",
    "active_index_owasp_llm_label": "OWASP LLM Top 10 2026",
    "migration_registry_status": "active",
    "owasp_llm_catalog_aligned": true
  },
  "timestamp": "2026-09-11T10:30:00Z"
}

classifier_owasp_llm_edition describes the IDs emitted by this MCP build. active_index_owasp_llm_edition describes the corpus currently loaded from AIDEFEND. Treat owasp_llm_catalog_aligned=false, a non-active migration registry, or non-empty unresolved_claims as a signal to sync before requesting defenses for the affected editioned ID; the classifier does not silently reinterpret a 2026 claim through a legacy 2025 index.

Tool 15: Comprehensive Search (Multi-Query Aggregation)

Purpose: Execute multiple search queries in parallel and aggregate results intelligently. Auto-expands broad topics into specific queries for comprehensive coverage.

When to use: Broad security topics, research-oriented exploration, getting full picture of a security domain, or when you don't know exact keywords.

MCP Mode Example (Claude Desktop):

You: "Tell me everything about deepfake defenses in AIDEFEND"

Claude: [Uses comprehensive_search tool]
        Comprehensive Search Results for: deepfake defenses

        Queries Executed: 3 parallel searches
        Total Results: 15 unique techniques

        Query 1: "deepfake detection" (5 results)
        Query 2: "synthetic media defense" (5 results)
        Query 3: "media authenticity" (5 results)

        Top Techniques:
        1. AID-D-008: Secondary AI Defender Fusion & Assurance (Score: 0.92)
        2. AID-H-015: Certified Defenses (Score: 0.88)
        3. AID-D-009: Fact Assurance & Multi-Agent Hallucination Detection (Score: 0.85)
        ...

REST API Example:

curl -X POST "http://localhost:8000/api/v1/comprehensive-search" \
  -H "Content-Type: application/json" \
  -d '{
    "topic": "RAG security best practices",
    "max_results": 20
  }'

Response:

{
  "topic": "RAG security best practices",
  "queries_executed": 4,
  "total_results": 18,
  "query_breakdown": [
    {
      "query": "retrieval augmented generation security",
      "results_count": 6
    },
    {
      "query": "vector database security",
      "results_count": 5
    },
    {
      "query": "document injection prevention",
      "results_count": 4
    },
    {
      "query": "RAG prompt safety",
      "results_count": 3
    }
  ],
  "aggregated_results": [
    {
      "technique_id": "AID-H-003",
      "name": "Secure ML Supply Chain Management",
      "tactic": "Harden",
      "relevance_score": 0.91,
      "matched_queries": ["retrieval augmented generation security", "document injection prevention"]
    }
  ]
}

Tool 16: Analyze Security Posture

Purpose: Unified security posture analysis combining technical coverage, threat framework coverage, and actionable recommendations. One-stop shop for comprehensive security assessment.

When to use: Executive reporting, security program assessment, quarterly reviews, or establishing security baseline.

MCP Mode Example (Claude Desktop):

You: "Analyze my security posture. I've implemented: AID-H-001, AID-H-002, AID-D-001, AID-I-001"

Claude: [Uses analyze_security_posture tool]
        Security Posture Analysis

        Overall Assessment: DEVELOPING
        Techniques Implemented: 4

        ## Technical Coverage
        - Coverage: 1.3% (4/300 actionable controls)
        - By Tactic:
          • Harden: 11% (2/18) ⚠️
          • Detect: 8% (1/12) ⚠️
          • Isolate: 12.5% (1/8) ⚠️

        ## Threat Framework Coverage
        - OWASP LLM Top 10 2026: 40% (4/10 threats covered)
        - MITRE ATLAS: 7% (3/43 threats covered)
        - MAESTRO: 15% (2/13 threats covered)

        ## Key Insights
        - ✅ Good foundation in Harden tactic
        - ⚠️ Limited detection capabilities
        - ❌ No Model hardening techniques
        - ⚠️ Low ATLAS coverage

        ## Top Priorities
        1. Implement AID-D-002 (Anomaly Detection) - Fills detection gap
        2. Implement AID-M-001 (AI Asset Inventory & Mapping) - Addresses Model tactic gap
        3. Cover top ATLAS threats: AML.T0043, AML.T0020

REST API Example:

curl -X POST "http://localhost:8000/api/v1/analyze-security-posture" \
  -H "Content-Type" application/json" \
  -d '{
    "implemented_techniques": ["AID-H-001", "AID-H-002", "AID-D-001", "AID-I-001"],
    "view": "both",
    "system_type": "rag"
  }'

Response:

{
  "implemented_count": 4,
  "summary": {
    "overall_posture": "developing",
    "key_insights": [
      "Good foundation in Harden tactic",
      "Limited detection capabilities",
      "No Model hardening techniques"
    ],
    "top_priorities": [
      "Implement AID-D-002 (Anomaly Detection)",
      "Implement AID-M-001 (AI Asset Inventory & Mapping)"
    ]
  },
  "technical_coverage": {
    "overall_coverage": {
      "percentage": 25.0,
      "implemented": 4,
      "total": 300
    },
    "by_tactic": [
      {"tactic": "Harden", "percentage": 11.1, "implemented": 2, "total": 18}
    ],
    "critical_gaps": [
      {"technique_id": "AID-M-001", "name": "AI Asset Inventory & Mapping", "tactic": "Model"}
    ]
  },
  "threat_coverage": {
    "coverage_rate": {
      "owasp": 0.4,
      "atlas": 0.07,
      "maestro": 0.15
    },
    "covered_threats": {
      "owasp": ["LLM01", "LLM02", "LLM03", "LLM05"],
      "atlas": ["AML.T0020", "AML.T0043", "AML.T0051"]
    },
    "uncovered_threats": {
      "owasp": ["LLM04", "LLM06", "LLM07", "LLM08", "LLM09", "LLM10"]
    }
  }
}

Tool 17: Compare Techniques

Purpose: Side-by-side comparison of multiple AIDEFEND techniques with heuristic scoring (effectiveness, complexity, cost). Helps make informed implementation decisions.

When to use: Technology selection, budget prioritization, understanding trade-offs, or educating stakeholders.

100% LOCAL - All scoring uses heuristic algorithms based on metadata, no external API calls.

Scoring Logic (Context-Aware)

  • Effectiveness (0-100):

    • Prevention Bonus (+25): Higher score for preventive controls (hardening, filters) vs. detection.
    • Asset Criticality (+15): Bonus for protecting critical assets like Model Weights or Training Data.
    • Validation Ready (+10): Bonus if technique is verifiable/testable.
    • Threat Coverage: Points for each OWASP/ATLAS/MAESTRO threat covered.

  • Complexity (0-100):

    • Cross-Domain Friction: Penalties for techniques requiring cross-team coordination (e.g., DevOps + Data Science).
    • Human Scale: Penalties for process-heavy techniques (training, policy).
    • Integration Phase: "Building" phase techniques are rated as higher complexity than runtime deployment.

  • Cost (0-100):

    • OpEx vs CapEx: "Detection" techniques have higher OpEx scores (logs, alerts) than "Prevention" (set-and-forget).
    • Cloud Costs: Cloud-native techniques include estimated infrastructure costs.
    • Tooling: Commercial tools add cost; pure open-source reduces cost.

MCP Mode Example (Claude Desktop):

You: "Compare AID-H-001, AID-D-001, and AID-I-001. Which should I implement first?"

Claude: [Uses compare_techniques tool]
        Technique Comparison Matrix

        Techniques Compared: 3

        ## Summary Statistics
        - Average Effectiveness: 75.0/100
        - Average Complexity: 45.0/100
        - Average Cost: 38.0/100

        ## Comparison Matrix

        | Technique | Effectiveness | Complexity | Cost |
        |-----------|---------------|------------|------|
        | AID-H-001 | 85/100 | 35/100 | 30/100 |
        | AID-D-001 | 75/100 | 50/100 | 40/100 |
        | AID-I-001 | 65/100 | 50/100 | 45/100 |

        ## Implementation Recommendations

        ### Quick Wins
        - AID-H-001: High effectiveness (85), low complexity (35), low cost (30)

        ### Implementation Priority (by effectiveness/complexity ratio)
        1. AID-H-001 (ratio: 2.43) ⭐ Highest ROI
        2. AID-D-001 (ratio: 1.50)
        3. AID-I-001 (ratio: 1.30)

        Recommendation: Start with AID-H-001 for quick impact!

REST API Example:

curl -X POST "http://localhost:8000/api/v1/compare-techniques" \
  -H "Content-Type: application/json" \
  -d '{
    "technique_ids": ["AID-H-001", "AID-D-001", "AID-I-001"],
    "include_recommendations": true
  }'

Response:

{
  "input_techniques": ["AID-H-001", "AID-D-001", "AID-I-001"],
  "comparison_matrix": [
    {
      "source_id": "AID-H-001",
      "name": "Adversarial Robustness Training",
      "tactic": "Harden",
      "effectiveness_score": 85,
      "complexity_score": 35,
      "cost_score": 30,
      "threat_coverage": {
        "owasp": 3,
        "atlas": 2,
        "maestro": 1
      },
      "has_implementation_strategies": true,
      "has_code_snippets": true,
      "has_opensource_tools": true
    }
  ],
  "summary": {
    "techniques_compared": 3,
    "average_effectiveness": 75.0,
    "average_complexity": 45.0,
    "average_cost": 38.3
  },
  "recommendations": [
    {
      "category": "Quick Wins",
      "description": "High effectiveness, low complexity, low cost",
      "techniques": [
        {"id": "AID-H-001", "name": "Adversarial Robustness Training"}
      ]
    },
    {
      "category": "Implementation Priority",
      "description": "Ordered by effectiveness-to-complexity ratio",
      "techniques": [
        {"id": "AID-H-001", "name": "Adversarial Robustness Training"},
        {"id": "AID-D-001", "name": "Adversarial Input, Prompt Injection & Signal-Authenticity Detection"},
        {"id": "AID-I-001", "name": "AI Execution Sandboxing & Runtime Isolation"}
      ]
    }
  ]
}

Tool 18: Generate Incident Playbook

Purpose: Generate structured incident response playbooks for AI security incidents. Provides timeline-based action plans following NIST incident response phases.

When to use: Active incident response, IR planning, training materials, or security operations runbook development.

100% LOCAL - Integrates with local classify_threat and get_defenses_for_threat tools, no external API calls.

MCP Mode Example (Claude Desktop):

You: "We detected suspicious prompt injection attempts bypassing our validation. Generate an incident playbook."

Claude: [Uses generate_incident_playbook tool]
        🚨 Incident Response Playbook

        Primary Threat Identified: OWASP-LLM01:2026 (Prompt Injection)
        Confidence: 98%
        Total Action Items: 23

        ## Immediate Actions (0-15 min)

        1. 🔴 Activate Incident Response Team
           Priority: CRITICAL
           Time: 2-5 minutes

        2. 🔴 Isolate Affected LLM Endpoints
           Priority: CRITICAL
           Time: 5 minutes
           Description: Temporarily disable or rate-limit affected endpoints

        ## Investigation (15 min - 2 hours)

        1. 🟠 Perform Threat Classification
           Priority: HIGH
           Time: 10-15 minutes
           Tools: classify_threat tool

        2. 🟠 Collect IOCs
           Priority: HIGH
           Time: 20-30 minutes
           Description: Gather IP addresses, user IDs, timestamps, request patterns

        ## Containment (2-8 hours)

        1. 🔴 Deploy Defense: AID-H-001 (Adversarial Robustness Training)
           Priority: HIGH
           Time: 1-3 hours

        2. 🔴 Deploy Defense: AID-H-002 (AI-Contextualized Data Sanitization & Input Validation)
           Priority: HIGH
           Time: 1-3 hours

        ## Recovery & Remediation (8+ hours)

        1. 🟠 Implement Security Controls
           Priority: HIGH
           Time: 4-8 hours
           Reference: See defense techniques in containment phase

        2. 🟡 Conduct Post-Incident Review
           Priority: MEDIUM
           Time: 2-3 hours

REST API Example:

curl -X POST "http://localhost:8000/api/v1/generate-incident-playbook" \
  -H "Content-Type: application/json" \
  -d '{
    "incident_description": "Production LLM API showing unusual outputs. Users report getting responses that reveal internal system prompts and training data. Attack patterns from multiple IPs.",
    "include_defense_techniques": true
  }'

Response:

{
  "incident_summary": {
    "description": "Production LLM API showing unusual outputs...",
    "total_action_items": 23,
    "estimated_total_time": "1-3 days",
    "primary_threat": {
      "threat_id": "OWASP-LLM01:2026",
      "framework": "OWASP",
      "description": "Prompt Injection",
      "confidence": 98.0
    }
  },
  "timeline": {
    "immediate": {
      "phase": "Immediate Actions",
      "timeframe": "0-15 minutes",
      "objective": "Initial response, evidence preservation, and containment",
      "actions": [
        {
          "action": "Activate Incident Response Team",
          "priority": "CRITICAL",
          "description": "Notify designated IR team members",
          "estimated_time": "2-5 minutes"
        },
        {
          "action": "Isolate Affected LLM Endpoints",
          "priority": "CRITICAL",
          "description": "Temporarily disable or rate-limit affected LLM API endpoints",
          "estimated_time": "5 minutes"
        }
      ]
    },
    "investigation": {
      "phase": "Investigation",
      "timeframe": "15 minutes - 2 hours",
      "actions": [...]
    },
    "containment": {
      "phase": "Containment",
      "timeframe": "2-8 hours",
      "actions": [...]
    },
    "recovery": {
      "phase": "Recovery & Remediation",
      "timeframe": "8+ hours",
      "actions": [...]
    }
  },
  "defense_techniques": {
    "techniques": [
      {
        "source_id": "AID-H-001",
        "name": "Adversarial Robustness Training",
        "tactic": "Harden",
        "description": "Implement robust input validation..."
      },
      {
        "source_id": "AID-H-002",
        "name": "AI-Contextualized Data Sanitization & Input Validation",
        "tactic": "Harden",
        "description": "Deploy prompt injection detection..."
      }
    ]
  },
  "generated_at": "2025-01-18T10:30:00Z"
}

Additional Resources