add con for mcp to graylog

src/fgai/monitor.py

@@ -7,6 +7,7 @@ from pathlib import Path
 from .anomaly import anomaly_summary, detect_source_anomalies
 from .baseline import BaselineStore
 from .config import ConfigStore
+from .graylog_mcp import GraylogMcpClient
 from .llm import ollama_dashboard_assessment
 from .logs import local_in_failures, read_events, summarize_events, top_field_values
 from .mitigation import parse_allowlist, suggest_block_candidates
@@ -34,6 +35,17 @@ def build_status(
     config_exists = bool(config_store and config_store.path.exists())
     runtime_values = config_store.read() if config_exists and config_store else {}
     runtime_config = config_store.public() if config_store else {}
+    mcp_status: dict[str, object] = {"status": "not_configured"}
+    if runtime_values.get("log_source") == "graylog_mcp":
+        url = str(runtime_values.get("graylog_mcp_url", ""))
+        token = str(runtime_values.get("graylog_mcp_token", ""))
+        if not url or not token:
+            mcp_status = {"status": "missing_configuration"}
+        else:
+            try:
+                mcp_status = GraylogMcpClient(url, token).probe()
+            except RuntimeError as exc:
+                mcp_status = {"status": "error", "error": str(exc)}
     intel_ips = sorted(
         {
             ip
@@ -68,7 +80,7 @@ def build_status(
         "summary": summarize_events(events),
         "anomaly_summary": anomaly_summary(anomalies),
         "baseline": {"enabled": bool(baseline), "sources_ready": len(profiles), "new_events_recorded": baseline_events},
-        "capabilities": {"threat_intel": threat_intel_status},
+        "capabilities": {"threat_intel": threat_intel_status, "graylog_mcp": mcp_status},
         "configuration": runtime_config,
         "diagnostics": {
             "top_source_ips": top_field_values(events, "srcip", limit=10),