rockfish chat
Enterprise license feature. The chat server (and the MCP backend it uses) requires an Enterprise license.
Start an AI-powered chat server for conversational network security analysis.
Overview
The chat server provides a web-based conversational interface for querying network security data using natural language. It integrates with MCP for live data queries and supports pluggable LLM backends.
Usage
rockfish chat [OPTIONS]
LLM Modes
| Mode | Description |
|---|---|
slm (default) | Local small language model via Ollama |
cloud | Cloud LLM (OpenAI, Anthropic) |
hybrid | Try local SLM first, fall back to cloud |
# Local SLM mode
rockfish chat --mode slm
# Cloud mode
rockfish chat --mode cloud
# Hybrid mode
rockfish chat --mode hybrid
Data Modes
| Mode | Description |
|---|---|
cache (default) | Query local pre-filtered Parquet files |
store | Query via MCP cold storage |
Options
| Option | Default | Description |
|---|---|---|
-c, --config | — | Chat configuration file (chat.yaml) |
--host | 127.0.0.1 | HTTP server host |
--port | 8082 | HTTP server port |
--mode | slm | LLM mode: slm, cloud, hybrid |
--data-mode | cache | Data mode: cache or store |
--mcp-endpoint | http://localhost:3000 | MCP server endpoint |
--slm-endpoint | http://localhost:8081/v1/chat/completions | Local SLM endpoint |
--data-dir | ./output | Data directory for cache mode |
--sensor | sensor | Sensor name for cache mode |
Features
- Session management with state persistence
- Security guardrails and response caching
- MCP integration for live data queries
- Natural language to SQL translation
Examples
# Start chat server with local SLM
rockfish chat --mode slm \
--data-dir /data/rockfish --sensor prod-01
# Start with MCP integration
rockfish chat --mode cloud \
--mcp-endpoint http://localhost:3000 \
--host 0.0.0.0 --port 8082