[dandye]

Summary

Adds 14 net-new Google Threat Intelligence (GTI) and VirusTotal v3 MCP tools across two self-contained modules in server/gti/gti_mcp/tools/ (expanding gti-mcp from 36 to 50 tools), adds dedicated static-site workflow guides under docs/gti_workflows/, updates the security persona catalogs, and reconciles all 50 tool signatures in docs/servers/gti_mcp.md and server/gti/README.md.

1. Scanning, reanalysis, and analysis status (server/gti/gti_mcp/tools/analyses.py)

• submit_file(file_path): Uploads a local file via vt.Client.scan_file_async without blocking on scan completion, exposing only os.path.basename(file_path) in the multipart Content-Disposition header rather than the caller's local directory path.
• reanalyze_file(hash): Triggers POST /api/v3/files/{hash}/analyse for an existing MD5, SHA-1, or SHA-256 hash.
• submit_url(url): Submits a URL via vt.Client.scan_url_async and returns the queued analysis descriptor immediately.
• reanalyze_url(url): Encodes the URL via unpadded URL-safe base64 (vt.url_id) and triggers POST /api/v3/urls/{id}/analyse.
• reanalyze_domain(domain): Triggers POST /api/v3/domains/{domain}/analyse.
• reanalyze_ip(ip_address): Triggers POST /api/v3/ip_addresses/{ip_address}/analyse.
• get_analysis(analysis_id, include_engine_results=False): Fetches GET /api/v3/analyses/{id}, returning status (queued, in-progress, completed), aggregate stats, and meta (file_info or url_info) while omitting per-engine scanner results unless include_engine_results=True.

2. GTI Agentic investigation sessions (server/gti/gti_mcp/tools/agentic.py)

• ask_gti_agent(message): Starts a stateful session via POST /api/v3/agentspace/sessions (multipart/form-data), returning synthesized markdown response, citations, structured widgets, agent_id, and session_id.
• continue_chat(session_id, message): Continues an existing session via POST /api/v3/agentspace/sessions/{session_id} (multipart/form-data).
• list_sessions(limit=5, order=None, filter=None, cursor=None): Lists sessions via GET /api/v3/agentspace/sessions, dropping None and empty-string query parameters.
• get_session_history(session_id, include_intermediate_events=False): Retrieves session turns via GET /api/v3/agentspace/sessions/{session_id} (USER_MESSAGE and AGENT_FINAL_RESPONSE turns by default).
• delete_session(session_id): Deletes a session via DELETE /api/v3/agentspace/sessions/{session_id} (handling both 200 JSON and 204 empty responses).
• share_session(session_id): Generates a session share token via GET /api/v3/agentspace/sessions/{session_id}/token.
• copy_shared_session(share_token): Clones a shared session into the caller's workspace via POST /api/v3/agentspace/sessions/token (handling 201 Created).

3. Static-site documentation, workflow guides, and persona catalogs

• Added docs/gti_workflows/ (index.md, scanning_and_reanalysis.md, agentic_investigations.md, collections_and_hunting.md) wired into docs/index.md, docs/toc.md, and docs/servers/gti_mcp.md, including configuration for both local gti-mcp (50 tools) and the hosted https://www.virustotal.com/api/v3/agentspace/mcp/ Streamable HTTP endpoint (7 session tools).
• Reconciled all 50 @server.tool() signatures, required descriptors_only parameters, and supported relationship_name values across docs/servers/gti_mcp.md and server/gti/README.md (eliminating 15 previously undocumented tools and outdated relationship names).
• Updated 10 persona tool catalogs under docs/personas/ (cti_researcher, soc_analyst_tier_1, soc_analyst_tier_2, soc_analyst_tier_3, incident_responder, threat_hunter, detection_engineer, security_engineer, ciso, red_team).

Verification

• Unit and HTTP-mocked integration tests (pytest-httpserver): 77 passed across server/gti/tests.
• Live end-to-end verification against GTI API v3 (https://www.virustotal.com/api/v3): verified all 14 new tools (50 total registered MCP tools), including multi-turn ask_gti_agent -> continue_chat -> list_sessions -> get_session_history -> share_session -> copy_shared_session -> delete_session cleanup.
• Sphinx static site build (sphinx-build -b html -E docs <build_dir>) verified with zero warnings on all modified and newly created GTI pages, plus AST signature parity check confirming 50/50 tools match across docs/servers/gti_mcp.md and server/gti/README.md.