MCP Tool Reference
The tools the Query MCP Server exposes, and how to write statements that work
Search and Discovery
Execute FSQL Query — Runs a statement against the mesh and returns matched events, normalized to OCSF at query time.
Validate FSQL Query — Checks that a statement parses and resolves before executing it.
Search FSQL Schema — Looks up what the data model can express for an event class or object. Note this describes what OCSF can carry, not what a given connector populates.
FSQL Query Generation — Composes a statement from a description.
FSQL Connectors — Lists connected sources, the event classes each maps, and whether each is enabled.
Connector names are identifiersThe list returns a display
name, a lowercasedalias, and aui_aliasnaming the platform. Onlynameresolves in aFROMclause, and it must match exactly, punctuation included.
Detection Translation
KQL to FSQL — Converts a Kusto query.
Sigma to FSQL — Converts a Sigma rule.
See Federated Detections for running the results on a schedule.
Query Workers
Create Worker Session — Launches an agentic investigation. Returns an identifier and a console link.
Find Worker Artifacts — Lists the artifacts an investigation has produced.
Read Worker Artifact — Retrieves an artifact, including the written report.
Investigations run for minutes. Launch, keep the identifier, and collect the result when ready rather than holding a connection open.
Session State
Create, Read, and Update Session Artifact — Store working state across a long investigation, so an agent can keep an evidence log outside its context.
Organization Context
Read Environment Profile — Returns your organization's environment profile.
Read Org Policies — Returns configured org policies.
Update Environment Profile — Modifies the environment profile.
This is the only tool that writes. Leave it detached unless you intend an assistant to change your organization's configuration.
Writing Statements That Work
Pivot on entity selectors, not field paths. %username, %hostname, %ip, %hash, %email, %filename, %processname and others map across every connected source. See Entities.
Name the event class and select **.
QUERY network_activity.** WITH %hostname = 'host-01' SINCE 6h LIMIT 20Naming the class prevents a result being filled by whichever connector answers fastest. ** returns the whole normalized event, so there are no per-source paths to guess.
Bound the window. Omitting a time clause searches the last 24 hours.
Use LIMIT. A federated search returns as soon as the limit is satisfied from any source, so it bounds latency as well as payload. It only helps where matches are plentiful — a selective predicate over a sparse window has nothing to return early on.
Use FROM only to narrow deliberately. An entity selector already spans every connector mapping that entity, so FROM can only reduce coverage.
Empty results are not always absenceAn entity selector matches only where a connector has mapped that entity for that event class. Where it has not, the query succeeds and returns zero rows, which is indistinguishable from genuine absence. Agents producing a verdict should treat an empty entity search as unconfirmed unless something else in the same run shows the selector binding.
What's Next
- Connecting an MCP Client
- FSQL Query Syntax Reference
Updated about 1 hour ago