Uncoder supports Model Context Protocol (MCP), which allows you to access Uncoder capabilities from your own AI environment via the MCP Server. By generating an MCP token in Uncoder, you can connect your AI agents to the MCP Server and use Uncoder tools without opening the Uncoder interface.

To generate an MCP token in Uncoder, follow the steps below.

To connect to the MCP Server, authenticate using a Bearer Token in the Authorization header:

Authorization: Bearer <your-token>

Note: We currently support only Bearer Token authentication. OAuth, OpenID Connect (OIDC) and other authentication methods are currently not supported.

Here you can find descriptions of the MCP tools your agent can call once connected to the MCP Server, along with examples of requests you can write to the agent and the responses you can expect to get back.

What it does:

A concise summary of the detection logic in human language. You can provide a threat report or a detection rule and receive a brief overview with key insights.

Example:

Here's a Sigma rule. Give me a short summary.

Response:

You get a brief overview of what the rule detects and why it matters.

What it does:

A detailed explanation of the detection logic in human language. You can provide a threat report or a detection rule and receive an in-depth breakdown with all relevant details.

Example:

Here's a Sigma rule. Give me a full summary.

Response:

You get an in-depth summary that covers all relevant details and fine points involved in the detection logic.

What it does:

Explains how a detection logic works step by step, with all the embeddings, branches, and other intricate logic. Requires specifying the SIEM type.

Example:

Build a decision tree for this Sentinel rule: what to check first, what next.

Response:

You get a step-by-step breakdown of a detection logic.

What it does:

From a threat report, builds a structured Attack Flow: MITRE ATT&CK techniques, attack diagram, and ATT&CK Matrix. Visualizes adversary activity so defenders can move from tracking individual behaviors to tracking the full sequence of behaviors an adversary uses to achieve their goals.

Example:

Here's a threat report. Build an attack flow: techniques, diagram, and ATT&CK matrix.

Response:

You get:

What it does:

Generates Sigma behavior rules from a threat report, one by one as each is ready.

Example:

From this threat report, generate Sigma detection rules. Show each rule as soon as it's ready.

Response:

Rules appear gradually (Rule 1, Rule 2, …) without waiting for the full batch.

What it does:

Runs deep, multi-stage research on a threat report to turn it into comprehensive threat intelligence, including a summary, Attack Flow (MITRE ATT&CK techniques, attack diagram, and ATT&CK Matrix), behavior rules, and malicious activity simulations.

Example:

Run deep threat research on this threat report. Show results stage by stage.

Response:

You get the output structured stage by stage from initial summary to final simulation. For the Attack Flow stage, expect both the diagram and the ATT&CK matrix.

What it does:

Translates a rule/query from one SIEM format to another.

Example:

Translate this Sigma rule to a Splunk query.

Or:

Convert this Sentinel KQL to Elastic.

Response:

You get the rule/query in the target format with the same detection logic preserved.

What it does:

Recommendations to make a query/rule more efficient. Requires specifying the SIEM type.

Example:

Here's my Splunk query. How can I optimize it?

Or:

Optimize this Sigma for better performance.

Response:

You get concrete improvement suggestions.

You can generate detection rules and queries for the following platforms:

You can optimize queries, generate short summaries, full summaries, and decision trees for the following platforms: