Security Monitoring for AI Agents and MCP

				
					import re
from fastmcp import FastMCP, Context

mcp = FastMCP("PhishingTriage")

@mcp.tool
async def extract_iocs_from_email(email_body: str, ctx: Context) -> dict:
    """
    Extracts Indicators of Compromise (IOCs) such as URLs, domains, IP addresses,
    and file hashes from the body of an email.
    """
    await ctx.info("Starting IOC extraction from email body.")
    
    # Simple regex for demo purposes. Production use requires more robust parsing.
    urls = re.findall(r'https?://\S+', email_body)
    hashes_md5 = re.findall(r'\b[a-fA-F0-9]{32}\b', email_body)
    
    iocs = {"urls": urls, "hashes_md5": hashes_md5}
    await ctx.info(f"Extracted IOCs: {iocs}")
    
    return {"success": True, "iocs": iocs}

@mcp.tool
async def get_url_reputation(url: str, ctx: Context) -> dict:
    """
    Checks the reputation of a given URL against a threat intelligence source.
    """
    await ctx.info(f"Querying threat intelligence for URL: {url}")
    try:
        result = mock_threat_intel_api_url(url)
        await ctx.info(
            f"Reputation for {url} is '{result['verdict']}'"
            f"with threat type '{result['threat_type']}'."
        )
        return {"success": True, "url": url, **result}
    except Exception as e:
        await ctx.error(f"Failed to get URL reputation for {url}: {str(e)}")
        raise

@mcp.tool
async def get_file_hash_reputation(file_hash: str, ctx:Context) -> dict:
    """
    Checks the reputation of a given MD5 file hash against a threat intelligence source.
    """
    await ctx.info(f"Querying threat intelligence for file hash: {file_hash}")
    try:
        result = mock_threat_intel_api_hash(file_hash)
        await ctx.info(
            f"Reputation for {file_hash} is '{result['verdict']}'"
            f"with threat type '{result['threat_type']}'."
        )
        return {"success": True, "file_hash": file_hash, **result}
    except Exception as e:
        await ctx.error(f"Failed to get file hash reputation for {file_hash}: {str(e)}")
        raise