Frequently Asked Questions about the Enrichment MCP Server

Q: What is an MCP Server? A: An MCP (Model Context Protocol) server acts as a bridge, allowing AI models to access and interact with external data sources and tools. It provides a standardized way for applications to provide context to Large Language Models (LLMs).

Q: What is the purpose of the Enrichment MCP Server? A: The Enrichment MCP Server enhances security data by adding contextual information from third-party services such as VirusTotal, Hybrid Analysis, and AlienVault. This helps security teams identify and respond to threats more effectively.

Q: What observable types does the Enrichment MCP Server support? A: The server supports enrichment for IP addresses, domains, URLs, and email addresses. Support for file hashes (MD5, SHA1, SHA256) is planned for future implementation.

Q: Which threat intelligence services are currently supported? A: Currently supported services include VirusTotal, Hybrid Analysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned.

Q: Do I need API keys to use the Enrichment MCP Server? A: Yes, most of the supported services require API keys. It is highly recommended to store these API keys as environment variables for security.

Q: How do I configure the Enrichment MCP Server? A: The server is configured using a config.yaml file, where you can specify which services to use for each observable type and provide the necessary API keys.

Q: Where can I find the config.yaml file? A: A sample configuration file (config.yaml.example) is provided. You should copy this file, rename it to config.yaml, and modify it with your desired settings.

Q: How do I add new services to the Enrichment MCP Server? A: New services can be added by modifying the config.yaml file and creating corresponding Jinja2 templates for prompt construction. Refer to the project documentation for detailed instructions.

Q: What are Jinja2 templates used for in the Enrichment MCP Server? A: Jinja2 templates are used to format the prompts sent to the various enrichment services. This allows for better management of the returned prompts/results and future use cases.

Q: Can I use the Enrichment MCP Server with the UBOS platform? A: Yes, the Enrichment MCP Server seamlessly integrates with the UBOS platform, enabling you to build powerful AI Agents that leverage enriched security data.

Q: Where can I find more information about the UBOS platform? A: Visit the UBOS website at https://ubos.tech for more information about the platform and its capabilities.

Q: Is the Enrichment MCP Server suitable for production environments? A: The current implementation is primarily for development and testing purposes. While it can be used in production, it’s important to thoroughly test and configure it according to your specific requirements.

Q: How can I contribute to the Enrichment MCP Server project? A: Contributions are welcome! You can submit pull requests with bug fixes, new features, or improvements to the documentation.