Argus Annotation Filter MCP Tools#

These MCP tools let you retrieve Argus annotation filters from the event filter API.

They support two common tasks:

General Notes#

Use these tools when you want the LLM to retrieve annotation filter data from Argus APIs.
If you ask the LLM to search annotation filters, it may first use the annotation filter search translator tools to construct and validate the search request and then use the search tool to fetch results.
Each search tool call returns only one page of results. It does not automatically fetch additional pages.
When more results may exist, the response includes pagination metadata under page, such as nextOffset, stop, and reason, which the LLM can use if you ask it to continue.
Search pagination supports 1 to 100 items per page.
If sorting is involved, the LLM can use the annotation filter search translator tools to look up valid sort values before retrieving results.

Purpose

Fetch full details for one Argus annotation filter by ID. The response includes statement details and trigger code for the detection rule.

Arguments

Field	Description	Type	Default	Required
`id`	The annotation filter ID to fetch.	`number`	None	Yes

Purpose

Retrieve Argus annotation filter search results for the search criteria the LLM has prepared.

Arguments

Field	Description	Type	Default	Required
`request`	The full annotation filter search definition the LLM builds from your request.	`object`	None	Yes

Field	Description	Type	Default	Required
`filterID`	Match annotation filters by any of these filter IDs.	`array<number>`	None	No
`customer`	Match annotation filters belonging to any of the specified customers, using customer ID or short name.	`array<string>`	None	No
`includeAscendingCustomer`	When customer filtering is used, also include parent customers.	`boolean`	`false`	No
`includeDescendingCustomer`	When customer filtering is used, also include child customers.	`boolean`	`true`	No
`includeFilterFlag`	Annotation filter flags that must all be present. Allowed values: `enabled`, `controlled`.	`array<string>`	None	No
`excludeFilterFlag`	Annotation filter flags that must not be present. Exclusion still applies even if included flags match. Allowed values: `enabled`, `controlled`.	`array<string>`	None	No
`keywordFilter`	Keyword-based matching across annotation filter fields.	`object`	None	No
`timeFilter`	Time-based narrowing for annotation filter search.	`object`	None	No
`includeCode`	Whether statement and trigger code should be included in the result objects.	`boolean`	`false`	No
`page`	Pagination settings.	`object`	`{ "limit": 25, "offset": 0 }`	No
`sortBy`	Sort order list. Use list order as priority. Prefix with `-` for descending.	`array<string>`	None	No

Field	Description	Type	Default	Required
`keywords`	Search terms to match.	`array<string>`	None	No
`keywordField`	Which annotation filter keyword fields to search. Allowed values: `id`, `name`, `description`, `label`, `preStatement1`, `preStatement2`, `statementCode`, `triggerCode`, `all`.	`array<string>`	`["all"]`	No
`keywordMatch`	How to evaluate multiple keywords. Allowed values: `any`, `all`. Required when keywords are present.	`string`	`all`	No

Field	Description	Type	Default	Required
`timeField`	Which annotation filter time field(s) the range applies to. Allowed values: `created`, `lastUpdated`.	`array<string>`	`["lastUpdated"]`	No
`startTime`	Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as `startOfDay - 1 day`.	`string`	None	No
`endTime`	End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as `now`.	`string`	`now`	No
`timeMatchStrategy`	How to evaluate multiple `timeField` values. Allowed values: `any`, `all`. Mainly relevant when more than one time field is provided.	`string`	`any`	No

Field	Description	Type	Default	Required
`limit`	Maximum number of items per page. Accepted range: `1` to `100`.	`number`	`25`	No
`offset`	Number of items to skip before returning results. Must be `0` or greater.	`number`	`0`	No

Usage notes

If your request is a search, the LLM may first use generateArgusAnnotationFilterSearchQuery to shape and validate the query.
If you want statement and trigger code included in the results, ask for that explicitly so the LLM can enable includeCode.
If you want more than one page of results, ask the LLM to continue fetching more pages. The tool itself returns one page at a time.
For descending sorting, the LLM can use a - prefix such as -lastUpdated.
To search statement text, the LLM can use preStatement1, preStatement2, and statementCode.