Binalyze AIR MCP Server

Binalyze AIR MCP Server

A Node.js server implementing Model Context Protocol (MCP) for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities.

✨ Features

• Asset Management - List assets in your organization.
• Asset Details - Get detailed information about a specific asset by its ID.
• Asset Tasks - Get all tasks associated with a specific asset by its ID.
• Acquisition Profiles - List acquisition profiles.
• Acquisition Tasks - Assign evidence acquisition tasks to endpoints.
• Image Acquisition Tasks - Assign disk image acquisition tasks to endpoints.
• Baseline Acquisition - Acquire baseline data from specific endpoints to establish a reference point.
• Compare Baseline - Compare multiple baseline acquisition tasks for a specific endpoint to identify changes.
• Get Comparison Report - Retrieve comparison result report for a specific endpoint and task.
• Create Acquisition Profiles - Create new acquisition profiles with specific evidence/artifact/network settings.
• Acquisition Artifacts - List available artifacts for evidence collection.
• Acquisition Evidences - List available evidence items for forensic data collection.
• Reboot Tasks - Assign reboot tasks to specific endpoints.
• Shutdown Tasks - Assign shutdown tasks to specific endpoints.
• Isolation Tasks - Isolate or unisolate specific endpoints.
• Log Retrieval Tasks - Retrieve logs from specific endpoints.
• Version Update Tasks - Assign version update tasks to specific endpoints.
• Organization Management - List organizations.
• Case Management - List cases in your organization.
• Policy Management - See security policies across your organization.
• Task Management - Track forensic collection tasks and their statuses.
• Triage Rules - View YARA, Osquery and Sigma rules for threat detection.
• User Management - List users in your organization.
• Drone Analyzers - View available drone analyzers with supported operating systems.
• Audit Log Export - Initiate an export of audit logs.
• List Audit Logs - View audit logs from the system.
• Uninstall Assets - Uninstall specific assets based on filters without purging data.
• Purge and Uninstall Assets - Purge data and uninstall specific assets based on filters.
• Add Tags to Assets - Add tags to specific assets based on filters.
• Remove Tags from Assets - Remove tags from specific assets based on filters.
• Auto Asset Tagging - Create and update rules to automatically tag assets based on specific conditions.
• List Auto Asset Tags - List all existing auto asset tag rules.
• Get Auto Asset Tag Details - Get detailed information about a specific auto asset tag rule by its ID.
• Delete Auto Asset Tag - Delete a specific auto asset tag rule by its ID.
• Start Auto Tagging - Initiate the auto tagging process for assets that match specific filter criteria.
• E-Discovery Patterns - List available e-discovery patterns for detecting different file types.
• Policy Management - List, create, update, and delete policies in your organization.
• Policy Match Statistics - See which policies apply to your assets based on various criteria.
• Task Assignment Management - View and manage task assignments.

Overview

This MCP server creates a bridge between Large Language Models (LLMs) and Binalyze AIR, allowing interaction through natural language. Retrieve information about your digital forensics environment without writing code or learning complex APIs.

🔑 API Token Requirement

Important: An API token is required for authentication. Set it using the AIR_API_TOKEN environment variable.

📦 Installation

Local Development

Usage with Claude Desktop

Add the following configuration to your Claude Desktop config file:

Usage with Cursor

1. Navigate to Cursor Settings > MCP
2. Add new MCP server with the following configuration:
   { "mcpServers": { "air-mcp": { "command": "npx", "args": ["-y", "@binalyze/air-mcp"], "env": { "AIR_HOST": "your-api-host.com", "AIR_API_TOKEN": "your-api-token" } } } }

🧩 Usage with Smithery

Note: Don't forget to activate Agent mode in your editor.

One-Line Installation Commands

Claude

Cursor

Windsurf

VSCode

Or use the Magic Link option in VSCode.

How to Use

In Claude Desktop, or any MCP Client, you can use natural language commands:

Viewing Acquisition Artifacts

You can list all available acquisition artifacts for evidence collection:

This will display a categorized list of artifacts that can be collected during an acquisition task, organized by platform (Windows, Linux, macOS, etc.) and group categories (Server, Communication, Cloud, etc.).

Viewing Acquisition Evidences

You can list all available evidence items for forensic data collection:

This will display a categorized list of evidence items that can be collected during a forensic investigation, organized by platform (Windows, Linux, macOS, etc.) and group categories (System, Network, Memory, etc.).

Viewing E-Discovery Patterns

You can list all available e-discovery patterns for file type detection:

Filtering by Organization

You can filter results by organization ID:

Getting Asset Details

You can retrieve detailed information about a specific asset:

Getting Asset Tasks

You can retrieve all tasks associated with a specific asset:

Assigning Acquisition Tasks

You can assign evidence acquisition tasks to specific endpoints:

Assigning Image Acquisition Tasks

You can assign disk image acquisition tasks to specific endpoints and volumes:

Assigning Reboot Tasks

You can assign reboot tasks to specific endpoints:

Assigning Shutdown Tasks

You can assign shutdown tasks to specific endpoints:

Assigning Isolation Tasks

You can isolate or unisolate specific endpoints:

Assigning Log Retrieval Tasks

You can retrieve logs from specific endpoints:

Note: Always specify the organization ID when assigning log retrieval tasks. The endpoint must exist in the specified organization.

Assigning Version Update Tasks

You can assign version update tasks to specific endpoints:

Uninstalling Assets

You can uninstall assets without purging their data using filters. You must specify the exact IDs of the assets to uninstall via filter.includedEndpointIds.

Purging and Uninstalling Assets

You can purge asset data and uninstall assets using filters. You must specify the exact IDs of the assets to purge and uninstall via filter.includedEndpointIds.

Adding Tags to Assets

You can add tags to specific assets using filters. You must specify the exact IDs of the assets to add tags to via filter.includedEndpointIds and provide at least one tag in the tags array.

Removing Tags from Assets

You can remove tags from specific assets using filters. You must specify the exact IDs of the assets to remove tags from via filter.includedEndpointIds and provide at least one tag in the tags array.

Creating Auto Asset Tag Rules

You can define rules to automatically tag assets based on conditions across different operating systems. Describe the tag name and the conditions for Linux, Windows, and macOS.

Getting Auto Asset Tag Details

You can retrieve detailed information about a specific auto asset tag rule by its ID:

Deleting Auto Asset Tag

You can delete an auto asset tag rule by its ID:

Listing Auto Asset Tag Rules

You can list all configured auto asset tag rules to see their IDs, tags, and conditions.

Starting Auto Asset Tagging Process

You can initiate the auto tagging process for assets that match specific filter criteria.

Acquiring Baseline

You can acquire baseline data from specific endpoints by providing a case ID and filter criteria. Baselines establish a reference point for comparison in forensic investigations.

Comparing Baseline Acquisition Tasks

You can compare multiple baseline acquisition tasks for a specific endpoint to identify changes over time or between different system states:

Getting Comparison Report

You can retrieve the comparison result report for a specific endpoint and comparison task:

Creating Policies

You can create new policies with specific storage, compression, and security settings:

Viewing Task Assignments

You can check the status of task assignments: