$ loading_
Investigate endpoints and analyze forensic evidence via natural language commands.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "Velociraptor Forensic MCP Server" yet — see the docs or source repo.
Connect to Velociraptor and inspect suspicious processes started on host WIN-023 in the last 24 hours. List process name, parent process, start time, and command line, and flag anomalies.
A structured investigation report listing suspicious processes and anomaly assessments for follow-up forensics.
Use local forensic tools to analyze this memory image, extract active network connections, running processes, and signs of suspicious injection, then summarize high-risk findings.
An evidence analysis summary with key indicators, suspicious traces, and prioritized response recommendations.
Search all online endpoints for these IOCs: a file hash, a malicious domain, and a registry key path. Summarize matched hosts, timestamps, related file paths, and provide short remediation advice.
A cross-endpoint IOC hit report to quickly identify affected assets and remediation scope.
Analyze disk images with AI through MCP for fast forensic investigation.
Analyze PCAPs offline to extract streams, detect threats, and find leaked credentials.
Analyze network traffic, manage Suricata rules, and lint rule quality by chat.
Review fleet-wide vulnerability and PII scan findings with natural language.
Analyze PCAP captures with AI for network forensics and protocol troubleshooting.
Audit MCP servers and plugins for risk before installation with graded findings.