Velociraptor MCP Bridge

Example Use Cases

• 1

  Collect and inspect network connections on a specific Windows host and flag suspicious processes.

• 2

  Locate and enumerate forensic artifacts (for example, those targeting the USN journal) across managed hosts.

• 3

  Run Velociraptor collections remotely via an MCP client and return triage results for analyst review.

Description

This repository implements a POC Model Context Protocol (MCP) bridge to allow MCP clients (e.g., Claude desktop) to query Velociraptor servers and retrieve forensic/triage data from endpoints. It includes Windows-oriented collections and helper code to query machines by name (for example, list network connections or search for artifacts targeting the USN journal). Installation and API client setup instructions are provided, and the README calls out caveats about data volume, context windows, and dynamic collection creation.