Velociraptor MCP Server

What it does

This server bridges the Velociraptor endpoint visibility and forensics platform with AI agents. It enables LLMs to perform complex digital forensics and incident response (DFIR) tasks, such as querying client information, collecting specific forensic artifacts, and executing VQL (Velociraptor Query Language) queries across a fleet of endpoints.

Tools

• GetAgentInfo: Retrieves detailed system and OS info for a specific Velociraptor client.
• RunVQLQueryTool: Executes custom VQL queries for advanced investigations.
• CollectArtifactTool: Initiates the collection of a specific forensic artifact from a client.
• GetCollectionResultsTool: Retrieves the results of a previously initiated artifact collection flow.
• ListWindowsArtifactsTool: Lists all available Windows-specific forensic artifacts.
• ListLinuxArtifactsTool: Lists all available Linux-specific forensic artifacts.
• CollectArtifactDetailsTool: Provides detailed parameters and descriptions for a specific artifact.

Installation

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "velociraptor": {
      "command": "velociraptor-mcp-server",
      "env": {
        "VELOCIRAPTOR_API_KEY": "/path/to/api.config.yaml"
      }
    }
  }
}

Supported hosts

• Claude Desktop