{"tools":[{"name":"correlate","owner":"correlate","description":"Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output.","risk":"read-only","timeoutMs":15000,"retryPolicy":"none","authPolicy":"platform-key","tracePolicy":"propagate"},{"name":"enrich_indicators","owner":"threatpulse","description":"Extract public IPs, domains, URLs, and hashes from grounded Correlate observations, then request provider-attributed external context from ThreatPulse. No record never means safe.","risk":"read-only","timeoutMs":20000,"retryPolicy":"none","authPolicy":"platform-key","tracePolicy":"propagate"},{"name":"map_attack","owner":"investigate","description":"Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"lookup_technique","owner":"investigate","description":"Look up one technique in the pinned official Enterprise ATT&CK 19.1 STIX subset.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"search_techniques","owner":"investigate","description":"Search the pinned official Enterprise ATT&CK 19.1 STIX subset by ID, name, or tactic.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"build_timeline","owner":"investigate","description":"Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"verify_claim","owner":"evidence","description":"Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion.","risk":"read-only","timeoutMs":12000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"}],"specialists":[{"id":"archive.inspect","owner":"zip","canonicalUrl":"https://zip.platphormnews.com","capabilityClass":"artifact-processing","representativeTool":"zip_operation_manifest","inputSchema":{"type":"object","additionalProperties":false,"properties":{}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"service":{"type":"string"},"executionMode":{"type":"string"},"operations":{"type":"array"}}},"acceptedInputs":["ZIP archive"],"outputTypes":["operation manifest","browser-local inspection result"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Browser-local archive processing; the representative server call does not receive archive bytes.","evidenceSemantics":"Artifact-derived content that must retain the archive digest and enter Evidence as an artifact reference.","traceSemantics":"not-observed","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"pdf.inspect","owner":"pdf","canonicalUrl":"https://pdf.platphormnews.com","capabilityClass":"artifact-processing","representativeTool":"pdf_operation_manifest","inputSchema":{"type":"object","additionalProperties":false,"properties":{"includeRoutes":{"type":"boolean"}}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"service":{"type":"string"},"purpose":{"type":"string"},"operations":{"type":"array"}}},"acceptedInputs":["PDF document"],"outputTypes":["operation manifest","browser-local extraction or transformation result"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Browser-local PDF processing; the representative server call does not store document bytes.","evidenceSemantics":"Extracted document content is artifact evidence, not proof that statements inside the document are true.","traceSemantics":"not-observed","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"table.inspect","owner":"sheets","canonicalUrl":"https://sheets.platphormnews.com","capabilityClass":"reporting-projection","representativeTool":"get_sheets_info","inputSchema":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string"},"query":{"type":"string"},"limit":{"type":"number"}}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"service":{"type":"string"},"persistence":{"type":"object"},"trace":{"type":"object"}}},"acceptedInputs":["tabular data","spreadsheet metadata"],"outputTypes":["structured sheet metadata","report projection"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Structured inspection backed by the deployed Sheets service.","evidenceSemantics":"A reporting projection; the canonical evidence remains in Evidence.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"json.validate","owner":"json","canonicalUrl":"https://json.platphormnews.com","capabilityClass":"validation","representativeTool":"validate_json","inputSchema":{"type":"object","additionalProperties":false,"properties":{"json":{"type":"string"}},"required":["json"]},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"valid":{"type":"boolean"},"stats":{"type":"object"}}},"acceptedInputs":["JSON text"],"outputTypes":["syntax validation","structured diagnostics"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Deterministic JSON parsing and validation.","evidenceSemantics":"Establishes structural validity only; it does not establish factual truth.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"xml.validate","owner":"xml","canonicalUrl":"https://xml.platphormnews.com","capabilityClass":"validation","representativeTool":"validate_xml","inputSchema":{"type":"object","additionalProperties":false,"properties":{"xml":{"type":"string"},"indent":{"type":"number"}},"required":["xml"]},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"valid":{"type":"boolean"},"errors":{"type":"array"},"security":{"type":"object"}}},"acceptedInputs":["XML text"],"outputTypes":["syntax validation","safe parser diagnostics"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Deterministic XML validation with DTD and external-entity processing denied.","evidenceSemantics":"Establishes structural validity only; it does not establish factual truth.","traceSemantics":"propagate-when-invoked","verification":"DEGRADED","availability":"degraded","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"markdown.project","owner":"markdown","canonicalUrl":"https://markdown.platphormnews.com","capabilityClass":"reporting-projection","representativeTool":"get_markdown_stats","inputSchema":{"type":"object","additionalProperties":false,"properties":{"markdown":{"type":"string"}},"required":["markdown"]},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"characters":{"type":"number"},"words":{"type":"number"},"headings":{"type":"number"}}},"acceptedInputs":["Markdown text"],"outputTypes":["document statistics","Markdown projection"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Deterministic document inspection and projection.","evidenceSemantics":"A presentation format; it is not the authoritative evidence store.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"script.analyze","owner":"desa","canonicalUrl":"https://desa.platphormnews.com","capabilityClass":"specialist-analysis","representativeTool":"analyze_script","inputSchema":{"type":"object","additionalProperties":false,"properties":{"content":{"type":"string"},"analysis_type":{"type":"string"}},"required":["content"]},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"analysis":{"type":"object"},"iocs":{"type":"array"},"staticOnly":{"type":"boolean"},"executionDisabled":{"type":"boolean"}}},"acceptedInputs":["PowerShell or script text"],"outputTypes":["static analysis","decoded indicators","risk findings"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Static analysis only; execution is disabled and belongs to Sandbox.","evidenceSemantics":"Specialist analysis that must be verified against incident observations before becoming a factual claim.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"msi.inspect","owner":"msi","canonicalUrl":"https://msi.platphormnews.com","capabilityClass":"artifact-processing","representativeTool":"load_demo_database","inputSchema":{"type":"object","additionalProperties":false,"properties":{"database":{"type":"object"},"tableName":{"type":"string"},"query":{"type":"string"},"fileBase64":{"type":"string"}}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"database":{"type":"object"},"traceId":{"type":"string"}}},"acceptedInputs":["MSI database"],"outputTypes":["MSI table and property inspection"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"The observed server tool loads a sample database only; arbitrary MSI upload was not verified.","evidenceSemantics":"Showcase-only until a real incident artifact contract is verified.","traceSemantics":"propagate-when-invoked","verification":"DEGRADED","availability":"ready","integration":"showcase-only","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"fingerprint.inspect","owner":"fingerprint","canonicalUrl":"https://fingerprint.platphormnews.com","capabilityClass":"specialist-analysis","representativeTool":"get_fingerprint_info","inputSchema":{"type":"object","additionalProperties":false,"properties":{}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"capabilities":{"type":"array"},"deterministic":{"type":"boolean"},"modelAssisted":{"type":"boolean"}}},"acceptedInputs":["browser or session signals"],"outputTypes":["deterministic fingerprint metadata"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Deterministic local fingerprint analysis; model assistance was not active in the observed call.","evidenceSemantics":"Automation characteristics do not establish a human identity.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"indicator.enrich","owner":"threatpulse","canonicalUrl":"https://enrich.platphormnews.com","capabilityClass":"external-enrichment","representativeTool":"enrich_indicators","inputSchema":{"type":"object","additionalProperties":false,"properties":{"query":{"type":"string","minLength":1,"maxLength":8000}},"required":["query"]},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"results":{"type":"array"},"summary":{"type":"object"},"trace":{"type":"array"}}},"acceptedInputs":["IP address","domain","URL","hash"],"outputTypes":["provider-attributed intelligence context"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"External intelligence enrichment only.","evidenceSemantics":"No record does not mean safe; enrichment cannot replace incident evidence.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"sandbox.execute","owner":"sandbox","canonicalUrl":"https://sandbox.platphormnews.com","capabilityClass":"bounded-execution","representativeTool":"get_sandbox_status","inputSchema":{"type":"object","additionalProperties":false,"properties":{}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"ok":{"type":"boolean"},"data":{"type":"object"}}},"acceptedInputs":["governed execution request"],"outputTypes":["policy decision","execution receipt","bounded output"],"risk":"bounded-write","readWriteState":"mutating","authPolicy":"platform-key","publicRead":true,"platformKeyRequired":true,"executionSemantics":"The provider is reachable, but live execution was disabled in the observed status.","evidenceSemantics":"Execution output requires input digest, policy decision, receipt, and trace before Evidence can reference it.","traceSemantics":"propagate-when-invoked","verification":"DEGRADED","availability":"degraded","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"},{"id":"contract.validate","owner":"spec","canonicalUrl":"https://spec.platphormnews.com","capabilityClass":"validation","representativeTool":"validate_openapi","inputSchema":{"type":"object","additionalProperties":false,"properties":{"content":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"outputSchema":{"type":"object","additionalProperties":false,"properties":{"specType":{"type":"string"},"validation":{"type":"object"}}},"acceptedInputs":["OpenAPI document","JSON schema","service contract"],"outputTypes":["conformance result","contract diagnostics"],"risk":"read-only","readWriteState":"read-only","authPolicy":"public-read","publicRead":true,"platformKeyRequired":false,"executionSemantics":"Deterministic content validation used for release conformance, not a synchronous investigation dependency. URL-mode validation currently fails internally.","evidenceSemantics":"Proves contract conformance, not incident facts.","traceSemantics":"propagate-when-invoked","verification":"VERIFIED","availability":"ready","integration":"optional","allowed":true,"reachable":true,"schemaValid":true,"observedAt":"2026-08-17T02:18:30.867Z"}],"dependencies":[{"name":"correlate","state":"READY","mode":"remote","target":"https://correlate.platphormnews.com","url":"https://correlate.platphormnews.com/api/health","method":"GET","httpStatus":200,"responseSchema":"Envelope{ok,data:CorrelateHealth{status,service,version,contractVersion,ruleSet,storage},error,meta} or legacy CorrelateHealth","auth":"none","durationMs":114,"observedAt":"2026-09-01T01:38:44.473Z","error":null},{"name":"evidence","state":"READY","mode":"remote","target":"https://evidence.platphormnews.com","url":"https://evidence.platphormnews.com/api/ui/datasets/CASE-CORRELATE-LIVE/events","method":"GET","httpStatus":200,"responseSchema":"Envelope{ok:true,data:{events:SanitizedEvent[]}}","auth":"Evidence Vercel PLATPHORM_API_KEY","durationMs":439,"observedAt":"2026-09-01T01:38:44.794Z","error":null,"traceEnabled":false},{"name":"attack","state":"READY","mode":"local-engine","target":"pinned ATT&CK mapping engine","url":null,"method":null,"httpStatus":null,"responseSchema":"pinned ATT&CK 19.1 bundle","auth":"none","durationMs":0,"observedAt":"2026-09-01T01:38:44.794Z","error":null}],"traceExport":{"method":"GET","responseSchema":"Envelope{ok:true,data:TraceSummary[],pagination}","auth":"server-side PLATPHORM_API_KEY","state":"DISABLED","url":null,"httpStatus":null,"durationMs":0,"observedAt":"2026-09-01T01:38:44.794Z","error":"Trace is disabled by Evidence feature policy; Evidence verdicts and receipts are authoritative"}}