Fix return type inconsistencies in security tools

[dandye]

Problem

Several functions in the security tools modules have inconsistent return types where:

• Functions are declared with -> str return type annotation
• But they return dict/object responses instead of strings
• Some functions use str() for serialization which produces invalid JSON

Affected Files

• server/secops/secops_mcp/tools/security_alerts.py
• server/secops/secops_mcp/tools/threat_intel.py

Issues Found

1. security_alerts.py:

   • get_security_alerts() was returning a raw string but needed JSON serialization
   • get_security_alert_by_id() was returning raw dict response instead of string
   • do_update_security_alert() was returning raw dict response instead of string

2. threat_intel.py:

   • Used str(response) which produces Python string representation instead of valid JSON

Solution

• Add missing json imports
• Use json.dumps() consistently for serializing dict/object responses
• Ensure all functions with -> str return type actually return strings

Why json.dumps() over str()

• json.dumps() produces valid JSON that can be parsed by clients
• str() produces Python-specific representations with single quotes (not valid JSON)
• Ensures consistency across the codebase
• Preserves proper data structure for client parsing

Related PR

PR #160 addresses this issue