Add Knowledgebase and Attack Surface server types with example questions and server info (#492)
taylor_socfortress committed
Aug 19, 2025 at 09:45 UTC
abf166084500435fe1d534089e5dea7819086813
3 files changed
+58
backend/app/integrations/copilot_mcp/schema/copilot_mcp.py
+2
@@ -19,6 +19,8 @@ class MCPServerType(str, Enum):
19
VELOCIRAPTOR = "velociraptor"
20
THREAT_INTEL = "threat-intel"
21
CYBER_NEWS = "cyber-news"
22
+ KNOWLEDGEBASE = "knowledgebase"
23
+ ATTACK_SURFACE = "attack-surface"
24
25
26
class MCPServerConfig(BaseModel):
backend/app/integrations/copilot_mcp/services/copilot_mcp.py
+2
@@ -44,6 +44,8 @@ class MCPService:
44
# Cloud services
45
MCPServerType.THREAT_INTEL: MCPServerConfig(MCPServiceType.CLOUD, "threat_intel"),
46
MCPServerType.CYBER_NEWS: MCPServerConfig(MCPServiceType.CLOUD, "cyber_news"),
47
+ MCPServerType.KNOWLEDGEBASE: MCPServerConfig(MCPServiceType.CLOUD, "knowledgebase"),
48
+ MCPServerType.ATTACK_SURFACE: MCPServerConfig(MCPServiceType.CLOUD, "attack_surface"),
49
}
50
51
@classmethod
backend/app/integrations/copilot_mcp/services/example_questions.py
+54
@@ -173,6 +173,40 @@ class ExampleQuestionsService:
173
category="cyber_news",
174
),
175
],
176
+ MCPServerType.KNOWLEDGEBASE: [
177
+ ExampleQuestion(
178
+ question="How would I configure the Office365 API Integration?",
179
+ description="Configure the Office365 API Integration for optimal performance",
180
+ category="knowledgebase",
181
+ ),
182
+ ExampleQuestion(
183
+ question="How can I create a new index set in Graylog?",
184
+ description="Get best practices for creating index sets in Graylog",
185
+ category="knowledgebase",
186
+ ),
187
+ ExampleQuestion(
188
+ question="How do I upgrade CoPilot?",
189
+ description="Follow these steps to upgrade your CoPilot installation",
190
+ category="knowledgebase",
191
+ ),
192
+ ],
193
+ MCPServerType.ATTACK_SURFACE: [
194
+ ExampleQuestion(
195
+ question="Search for breaches related to email example@company.com",
196
+ description="Explore data breaches involving the specified email address",
197
+ category="attack_surface",
198
+ ),
199
+ ExampleQuestion(
200
+ question="Search for exposures regarding service.example.com",
201
+ description="Explore data exposures involving the specified service",
202
+ category="attack_surface",
203
+ ),
204
+ ExampleQuestion(
205
+ question="Has the password `password123` been exposed?",
206
+ description="Check if a specific password has been involved in any data breaches",
207
+ category="attack_surface",
208
+ ),
209
+ ],
210
}
211
212
# Define server information with descriptions and capabilities
@@ -243,6 +277,26 @@ class ExampleQuestionsService:
277
"Vulnerability disclosure tracking",
278
],
279
),
280
+ MCPServerType.KNOWLEDGEBASE: MCPServerInfo(
281
+ name="Knowledgebase",
282
+ value=MCPServerType.KNOWLEDGEBASE.value,
283
+ description="Access documentation and guides for using CoPilot and its integrations",
284
+ capabilities=[
285
+ "Configuration guides",
286
+ "Best practices",
287
+ "Troubleshooting tips",
288
+ ],
289
+ ),
290
+ MCPServerType.ATTACK_SURFACE: MCPServerInfo(
291
+ name="Attack Surface",
292
+ value=MCPServerType.ATTACK_SURFACE.value,
293
+ description="Analyze and manage the attack surface of your organization",
294
+ capabilities=[
295
+ "Attack surface mapping",
296
+ "Exposure management",
297
+ "Risk assessment",
298
+ ],
299
+ ),
300
}
301
302
@classmethod