Velociraptor MCP Server

What it does

Connects AI agents to Velociraptor, a powerful open-source endpoint monitoring and digital forensics tool. It allows agents to execute VQL (Velociraptor Query Language) queries, manage hunts, collect forensic artifacts, and monitor server/client health across a fleet of endpoints.

Tools

• query_vql: Execute raw VQL queries against the server or clients.
• list_clients / get_client_info / search_clients: Discover and inspect managed endpoints.
• list_hunts / create_hunt / get_hunt_results: Orchestrate and retrieve results from fleet-wide hunts.
• list_artifacts / collect_artifact: Manage and trigger forensic artifact collection.
• list_directory / download_file: Access the Velociraptor Virtual File System (VFS) to retrieve files from endpoints.
• get_server_stats / list_alerts: Monitor the health and security alerts of the Velociraptor deployment.

Installation

{
  "mcpServers": {
    "velociraptor": {
      "command": "velociraptor-mcp",
      "args": ["--config", "/path/to/api.config.yaml"],
      "env": {
        "VELOCIRAPTOR_API_CONFIG": "/path/to/api.config.yaml"
      }
    }
  }
}

Supported hosts

• Codex