Back to Home
Flurin17 icon

velociraptor-mcp-server

Verified Safe

by Flurin17

Overview

This server acts as an intermediary, exposing Velociraptor's digital forensics and incident response (DFIR) capabilities via the FastMCP protocol to AI agents (e.g., Codex, ChatGPT).

Installation

Run Command
velociraptor-mcp --config /absolute/path/to/velociraptor_lab/volumes/api/api.config.yaml --log-level INFO --server-name velociraptor-mcp

Environment Variables

  • VELOCIRAPTOR_API_CONFIG
  • MCP_LOG_LEVEL
  • MCP_SERVER_NAME

Security Notes

The project uses mTLS for API communication, generates unique credentials for the API client, and explicitly sanitizes user-provided strings to prevent VQL injection in most tool functions. Default admin credentials are only for the local lab setup and are intended to be overridden by environment variables. The `query_vql` tool allows arbitrary VQL execution, which is an intentional feature for agents, shifting responsibility for safe VQL to the agent.

Similar Servers

Stats

Interest Score0
Security Score9
Cost ClassMedium
Avg Tokens2500
Stars0
Forks0
Last Update2025-12-03

Tags

VelociraptorDFIRForensicsMCPAI Agent