Documentation Index

Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt

Use this file to discover all available pages before exploring further.

🚀 ThreatConnect® 8.0 is now available!

The Command Center AI Chat

  • Published on Jul 29, 2026
  • 1 minute(s) read
Prev Next

The Polarity Interface includes a built-in AI chat feature known as “Command Center”.  This is accessible from the Overlay or Search interface.  

This chat uses the same integration lookup infrastructure as the MCP, but with an expanded tool set and additional context passing.  Understanding how the built-in chat works helps clarify the difference between the external MCP and the internal chat pipeline.

How Command Center Differs from the MCP

Aspect

External MCP ( /mcp)

Built-in Chat ( /api/conversations/chat)

Transport

StreamableHTTP (MCP protocol)

JSON API over HTTPS (custom REST)

Tools Available

3 tools:

  • list integrations

  • lookup

  • parse entities

9 tools:  

  • the 3 MCP tools

  • plus 6 notification context tools

Notification Context

Not included (context not passed to external clients)

Passed from the browser via the request payload or WebSocket

Target User

External AI agents and developers

End users in the Polarity UI

LLM Provider

Selected by admin in Model Settings

Same as MCP:

admin-configured provider

Notification Context Tools

The Command Center chat exposes six additional tools that operate on the notification context.  Notification context is the set of integration findings currently visible to the user in their Polarity window, passed from the interface as part of each chat request.  These tools are not available through the external MCP endpoint.

Tool

Description

notification\_context\_overview

Returns a high-level summary of entities, integrations, and finding counts currently visible in the overlay.

Supports verbosity levels:

  • minimal (~50 tokens)

  • summary (~100 tokens)

  • detailed (~200 tokens)

notification\_context\_inspect

Analyzes the data schema of integration findings in the context, returning field names and types.  

Use this before querying to understand what fields are available for filtering.

notification\_context\_query

Executes filtered queries against notification context data with WHERE clause support (risk\_score > 70 AND status = 'malicious'), field extraction via dot notation and wildcards, and a configurable result limit.

notification\_context\_aggregate

Performs statistical aggregations over context data:  

  • count

  • min

  • max

  • avg

  • sum

  • value distribution

Supports group-by on entity, integration, or any field.

notification\_context\_view\_state

Returns the current view state of the notification overlay (what is visible, selected, or expanded).

get\_notification\_context

Requests a fresh copy of notification context from the user's browser over the active WebSocket connection.

Only available during real-time chat sessions.

Token Management in the Command Center

The Command Center chat service tracks token usage across conversation turns and uses a context management service (chat-context) to keep the total conversation within the model's context window.  

When a conversation grows large, older messages are summarized before being included in subsequent requests.  This allows long investigative sessions without hitting context limits.