Get Field Structure

Description

Returns the tenant-configured field structure for one of the primary data models (Asset, Project, Project Reporting, Project Summary, Vulnerability, Writeup, Project Request, Testcase, Project Testcase, User, Group). The response lists every system and custom field the tenant has enabled on that model, grouped into named sections where the UI defines them, along with each field's key, label, required flag, info text, and - for custom fields - an access level (view or edit) and a usage_hints string describing how to format the value.

Use this before: (a) requesting custom fields on find_* / count_* tools via custom_field_keys (you need the keys from here), or (b) constructing args for create_* / patch_* tools when you want to understand which custom fields exist and how to populate them.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool get_field_structure and click Add

Example Prompts

• Show me what fields are available on vulnerabilities.

• What custom fields are configured on the project data model?

• Show me the field structure for assets.

• What are all the available fields on writeups?

• Which custom field keys can I use to query vulnerabilities?

• What fields are configured on project requests?

• Which custom fields are configured on users?

• Which custom fields are configured on groups?

Parameters

Parameter	Type	Required	Description
model	string	Yes	The data model whose field structure is required. One of asset, project, project-reporting, project-summary, vulnerability, writeup, project-request, testcase, project-testcase, user, group.

Notes:

• asset is only meaningful when the Assets module is enabled (returns an empty structure otherwise). Use it before find_assets, find_affected_assets, find_project_scope, count_assets, count_project_scope (Project Scope and Affected Assets inherit Asset custom fields).

• project-reporting describes the project reporting page - the reporting custom fields that accompany the executive summary. Use it before find_project_reporting_fields and patch_project_reporting_fields to discover the custom_field_keys you can read or write.

• project-summary describes the project summary page custom fields, a set distinct from project and project-reporting. Use it before find_project_summary_fields and patch_project_summary_fields.

• project-request is only meaningful when project requests are enabled (frontend.enable_project_requests).

• testcase describes library test cases - the reusable methodology that makes up a testsuite. Use it before find_testcases, count_testcases, create_testcase, patch_testcase.

• project-testcase describes the per-project instances of those test cases, and carries a different set of custom fields to testcase. Use it before find_project_testcases, count_project_testcases, patch_project_testcase, and create_abuse_case (whose custom_fields are set on the project test case, not on the abuse case itself).

• user describes the user custom fields. Use it before find_users, count_users, create_user and patch_user. Only keys configured to display in tables are accepted in a find_users / count_users filter.

• group describes the group custom fields. Use it before find_groups, count_groups, create_group and patch_group.

Example Response

{
  "model": "vulnerability",
  "structure": [
    {
      "type": "section",
      "label": "Info",
      "info": "<p>This section should include basic information about the vulnerability.</p>",
      "fields": [
        {
          "type": "system",
          "key": "writeupAndAssets",
          "label": "Writeup and Affected Assets",
          "required": true
        },
        {
          "type": "system",
          "key": "visibility",
          "label": "Visibility",
          "required": true
        }
      ]
    },
    {
      "type": "section",
      "label": "Red Team",
      "fields": [
        {
          "type": "custom",
          "key": "attack_narrative",
          "access": "edit",
          "label": "Attack Narrative",
          "required": false,
          "usage_hints": "Richtext field. See the `richtext_format` block in the get_args_schema_for_tool response for the full specification. Type: string."
        },
        {
          "type": "custom",
          "key": "critical_steps",
          "access": "edit",
          "label": "Critical Steps",
          "required": false,
          "usage_hints": "Provide an array of row objects. Each object maps column key strings to cell values (string, string[], or null). Example: [{\"col1\": \"value\", \"col2\": [\"a\", \"b\"]}, {\"col1\": null, \"col2\": \"x\"}]. Type: Record<string, string | string[] | null>[]."
        }
      ]
    },
    {
      "type": "section",
      "label": "Ownership",
      "fields": [
        {
          "type": "custom",
          "key": "vuln_owner",
          "access": "edit",
          "label": "Vulnerability Owner",
          "required": false,
          "usage_hints": "Provide an array of AttackForge user ids, each a 24-character hex string. Example: [\"5ad737d6e576e6290aff1808\"]. Type: string[]."
        }
      ]
    }
  ]
}