What can you do with this server?

The Binalyze AIR MCP Server enables natural language interaction with Binalyze AIR for digital forensics and incident response tasks. Key capabilities include: * Asset Management: List, manage, tag, and retrieve details about endpoints * Acquisition Management: Create and manage profiles, artifacts, and evidences * Endpoint Control: Reboot, shutdown, isolate endpoints, retrieve logs, and update versions * Baseline Management: Acquire and compare baseline data for endpoints * Case Management: Create, update, and manage cases, including exporting data and managing notes * Policy Management: Create, update, and manage security policies * Task Management: Track, cancel, and delete forensic tasks * Triage Management: Manage rules and tags for threat detection * User & Organization Management: Manage users, roles, and organizational settings * Repository Management: Configure and manage evidence repositories (SMB, SFTP, FTPS, Azure, S3) * Audit Logs: Export and view system audit information * Webhook Integration: Interact with external systems via webhooks * System Configuration: Update system settings and banner messages

Which integrations are available for this server?

Enables querying and managing Linux-based endpoints in the Binalyze AIR forensics platform through natural language interactions. Allows for management and forensic analysis of macOS endpoints within the Binalyze AIR platform through natural language queries. Serves as the runtime environment for the MCP server, allowing the server to connect Binalyze AIR's digital forensics capabilities with language models.

How do I use Binalyze AIR MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Binalyze AIR MCP Server list all assets in my organization" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

Binalyze AIR MCP Server

Official

by binalyze

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

Binalyze AIR MCP Server

A Node.js server implementing Model Context Protocol (MCP) for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities.

✨ Features

Asset Management - List assets in your organization.
Asset Details - Get detailed information about a specific asset by its ID.
Asset Tasks - Get all tasks associated with a specific asset by its ID.
Acquisition Profiles - List acquisition profiles.
Acquisition Tasks - Assign evidence acquisition tasks to endpoints.
Image Acquisition Tasks - Assign disk image acquisition tasks to endpoints.
Baseline Acquisition - Acquire baseline data from specific endpoints to establish a reference point.
Compare Baseline - Compare multiple baseline acquisition tasks for a specific endpoint to identify changes.
Get Comparison Report - Retrieve comparison result report for a specific endpoint and task.
Create Acquisition Profiles - Create new acquisition profiles with specific evidence/artifact/network settings.
Acquisition Artifacts - List available artifacts for evidence collection.
Acquisition Evidences - List available evidence items for forensic data collection.
Reboot Tasks - Assign reboot tasks to specific endpoints.
Shutdown Tasks - Assign shutdown tasks to specific endpoints.
Isolation Tasks - Isolate or unisolate specific endpoints.
Log Retrieval Tasks - Retrieve logs from specific endpoints.
Version Update Tasks - Assign version update tasks to specific endpoints.
Organization Management - List organizations.
Case Management - List cases in your organization.
Policy Management - See security policies across your organization.
Task Management - Track forensic collection tasks and their statuses.
Triage Rules - View YARA, Osquery and Sigma rules for threat detection.
User Management - List users in your organization.
User Details - Get detailed information about a specific user by their ID.
Drone Analyzers - View available drone analyzers with supported operating systems.
Audit Log Export - Initiate an export of audit logs.
List Audit Logs - View audit logs from the system.
Uninstall Assets - Uninstall specific assets based on filters without purging data.
Purge and Uninstall Assets - Purge data and uninstall specific assets based on filters.
Add Tags to Assets - Add tags to specific assets based on filters.
Remove Tags from Assets - Remove tags from specific assets based on filters.
Auto Asset Tagging - Create and update rules to automatically tag assets based on specific conditions.
List Auto Asset Tags - List all existing auto asset tag rules.
Get Auto Asset Tag Details - Get detailed information about a specific auto asset tag rule by its ID.
Delete Auto Asset Tag - Delete a specific auto asset tag rule by its ID.
Start Auto Tagging - Initiate the auto tagging process for assets that match specific filter criteria.
E-Discovery Patterns - List available e-discovery patterns for detecting different file types.
Policy Management - List, create, update, and delete policies in your organization.
Policy Match Statistics - See which policies apply to your assets based on various criteria.
Task Assignment Management - View and manage task assignments.
Triage Rules Management - List, create, update, and delete triage rules for threat detection.
Triage Tags Management - List and create triage tags for threat detection.
Validate Triage Rule - Validate a triage rule syntax without creating it.
Assign Triage Task - Assign a triage task to endpoints based on filter criteria.
Add Note to Case - Add a note to a specific case by its ID.
Update Note in Case - Update an existing note in a specific case.
Delete Note from Case - Delete a note from a case by its ID.
Export Cases - Export cases data from the system.
Export Case Notes - Export notes for a specific case by its ID.
Export Case Endpoints - Export endpoints for a specific case by its ID.
Export Case Activities - Export activities for a specific case by its ID.
Create Case - Create a new case in the system.
Update Case - Update an existing case by ID.
Get Case by ID - Get detailed information about a specific case by its ID.
Close Case by ID - Close a specific case by its ID.
Open Case by ID - Open a specific case by its ID.
Archive Case by ID - Archive a specific case by its ID.
Check Case Name - Check if a case name is already in use.
Get Case Activities - Get activity history for a specific case by its ID.
Get Case Endpoints - Get all endpoints associated with a specific case by its ID.
Get Case Tasks by ID - Get all tasks associated with a specific case by its ID.
Get Case Users - Get all users associated with a specific case by its ID.
Remove Endpoints from Case - Remove endpoints from a case based on specified filters.
Remove Task Assignment from Case - Remove a specific task assignment from a case.
Import Task Assignments to Case - Import task assignments to a specific case.
List Repositories - List all evidence repositories in the organization.
Create SMB Repository - Create a new SMB evidence repository.
Update SMB Repository - Update an existing SMB evidence repository.
Create SFTP Repository - Create a new SFTP evidence repository.
Update SFTP Repository - Update an existing SFTP evidence repository.
Create FTPS Repository - Create a new FTPS evidence repository.
Update FTPS Repository - Update an existing FTPS evidence repository.
Validate FTPS Repository - Validate FTPS repository configuration without creating it.
Create Azure Storage Repository - Create a new Azure Storage evidence repository.
Update Azure Storage Repository - Update an existing Azure Storage evidence repository.
Validate Azure Storage Repository - Validate Azure Storage repository configuration without creating it.
Create Amazon S3 Repository - Create a new Amazon S3 evidence repository.
Update Amazon S3 Repository - Update an existing Amazon S3 evidence repository.
Validate Amazon S3 Repository - Validate Amazon S3 repository configuration without creating it.
Get Repository by ID - Get detailed information about a specific evidence repository by its ID.
Delete Repository - Delete an evidence repository by its ID.
Download Case PPC - Download a PPC file for a specific endpoint and task.
Download Task Report - Download a task report for a specific endpoint and task.
Get Report File Info - Get information about a PPC file for a specific endpoint and task.
Get Organization Users - Get users for a specific organization by its ID.
Assign Users to Organization - Assign users to a specific organization.
Remove User from Organization - Remove a user from a specific organization.
Create Organization - Create a new organization.
Update Organization - Update an existing organization.
Get Organization by ID - Get detailed information about a specific organization by its ID.
Check Organization Name Exists - Check if an organization name already exists in the system.
Get Shareable Deployment Info - Get information about a shareable deployment using a deployment token.
Update Organization Shareable Deployment - Update an organization's shareable deployment settings.
Update Organization Deployment Token - Update the deployment token for a specific organization.
Delete Organization - Delete an organization by its ID.
Add Tags to Organization - Add tags to an organization.
Delete Tags from Organization - Delete tags from an organization.
Call Webhook - Call a webhook with the specified parameters.
Post Webhook - Post data to a webhook.
Get Task Assignments - Get all assignments for a specific task by its ID.
Update Banner Message - Update the system banner message settings.

Related MCP server: Desktop Commander MCP Server

Overview

This MCP server creates a bridge between Large Language Models (LLMs) and Binalyze AIR, allowing interaction through natural language. Retrieve information about your digital forensics environment without writing code or learning complex APIs.

🔑 API Token Requirement

Important: An API token is required for authentication. Set it using the AIR_API_TOKEN environment variable.

📦 Installation

Local Development

# Clone the repository
git clone https://github.com/binalyze/air-mcp

# Change to the project directory
cd air-mcp

# Install dependencies
npm install

# Build the project
npm run build

Usage with Claude Desktop

Add the following configuration to your Claude Desktop config file:

{
  "mcpServers": {
    "air-mcp": {
      "command": "npx",
      "args": ["-y", "@binalyze/air-mcp"],
      "env": {
        "AIR_HOST": "your-api-host.com",
        "AIR_API_TOKEN": "your-api-token"
      }
    }
  }
}

Usage with Cursor

Navigate to Cursor Settings > MCP

Add new MCP server with the following configuration:

{
  "mcpServers": {
    "air-mcp": {
      "command": "npx",
      "args": ["-y", "@binalyze/air-mcp"],
      "env": {
        "AIR_HOST": "your-api-host.com",
        "AIR_API_TOKEN": "your-api-token"
      }
    }
  }
}

🧩 Usage with Smithery

Note: Don't forget to activate Agent mode in your editor.

One-Line Installation Commands

Claude

npx -y @smithery/cli@latest install @binalyze/air-mcp --client claude --key {smithery_key}

Cursor

npx -y @smithery/cli@latest install @binalyze/air-mcp --client cursor --key {smithery_key}

Windsurf

npx -y @smithery/cli@latest install@rapidappio/rapidapp-mcp --client windsurf --key {smithery_key}

VSCode

npx -y @smithery/cli@latest install @binalyze/air-mcp --client vscode --key {smithery_key}

Or use the Magic Link option in VSCode.

How to Use

In Claude Desktop, or any MCP Client, you can use natural language commands:

Command	Description
`List all assets in the system`	Shows all managed/unmanaged endpoints with OS, platform info
`Get details about asset with ID "abc123"`	Displays detailed information about a specific asset
`Get tasks for asset with ID "abc123"`	Shows all tasks associated with a specific asset
`List all acquisition profiles`	Displays available acquisition profiles
`Get acquisition profile details by ID`	Shows detailed information about a specific acquisition profile, including evidence and artifacts
`List all acquisition artifacts`	Shows all available artifacts for evidence collection, organized by platform and category
`List all acquisition evidences`	Shows all available evidence items for forensic data collection, organized by platform and category
`Assign an acquisition task to endpoint 123abc using profile "full" for case "C-2022-0001"`	Assigns an evidence acquisition task to specified endpoint(s)
`Assign an image acquisition task to endpoint 123abc for volume /dev/sda1 saving to repository 456def`	Assigns a disk image acquisition task to a specific endpoint and volume, saving to a specified repository
`Create an acquisition profile named "My Custom Profile" with windows evidence ["clp"] and linux artifact ["apcl"]`	Creates a new acquisition profile with the specified configuration
`Reboot endpoint 123abc`	Assigns a reboot task to a specific endpoint
`Shutdown endpoint 123abc`	Assigns a shutdown task to a specific endpoint
`Isolate endpoint 123abc`	Assigns an isolation task to a specific endpoint
`Unisolate endpoint 123abc`	Removes isolation from a specific endpoint
`Retrieve logs from endpoint 123abc`	Assigns a log retrieval task to a specific endpoint
`Update version for endpoint 123abc`	Assigns a version update task to a specific endpoint
`List all organizations`	Shows all organizations in environments
`List all cases`	Displays cases with status and creation time
`List all policies`	Shows security policies and collection policies
`List all tasks`	Lists all tasks with their statuses
`List all triage rules`	Shows YARA, OSQuery and Sigma rules for threat detection
`List all users`	Shows all users in the system with their details
`Get user by ID`	Retrieves the details of a specific user by their ID
`List all drone analyzers`	Shows available drone analyzers with supported operating systems
`Export audit logs`	Initiates the export of audit logs. The export runs in the background on the AIR server.
`List audit logs`	Shows audit logs with details like timestamp, user, action, entity
`Uninstall asset with ID "endpoint-id"`	Uninstalls the specified asset without purging data (requires providing `filter.includedEndpointIds`)
`Purge and uninstall asset with ID "endpoint-id"`	Purges data and uninstalls the specified asset (requires providing `filter.includedEndpointIds`)
`Add tags ["tag1", "tag2"] to asset with ID "endpoint-id"`	Adds specified tags to the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`)
`Remove tags ["tag1"] from asset with ID "endpoint-id"`	Removes specified tags from the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`)
`Create an auto asset tag named "Web Server"`	Creates a new rule to automatically tag assets based on conditions.
`Update auto asset tag "fkkEPhpqMNqJeHfi4RyxiWEm" to have tag name "Updated Container" with linux process "containerd" running`	Updates an existing auto asset tag rule with new conditions.
`List all auto asset tag rules`	Lists all existing auto asset tag rules with their configurations.
`Get auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"`	Shows detailed information about a specific auto asset tag rule.
`Delete auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"`	Deletes a specific auto asset tag rule by its ID.
`Start auto tagging for windows machines`	Initiates the auto tagging process for Windows assets matching specified criteria.
`Acquire baseline for case "C-2022-001" from endpoints ["id1", "id2"]`	Acquires baseline data from specified endpoints for a given case ID.
`Compare baselines for endpoint "id1" with task IDs ["task1", "task2"]`	Compares multiple baseline acquisition tasks for a specific endpoint to identify changes.
`Get comparison report for endpoint "id1" and task "task1"`	Retrieves the comparison result report for a specific endpoint and comparison task.
`List all e-discovery patterns`	Shows all available e-discovery patterns for file type detection
`Create a policy named "Production Policy" with specific storage settings`	Creates a new policy with custom settings
`Update policy with ID "abc123"`	Updates an existing policy with new settings
`Get policy details for ID "System"`	Displays detailed information about a specific policy
`Update policy priorities to ["policy1", "policy2", "policy3"]`	Updates the order of policy application
`Show policy match statistics`	Shows how many endpoints match each policy
`Get policy distribution for Windows endpoints`	Shows policy matches filtered by platform
`Get policy match stats for offline endpoints`	Shows policy matches for offline assets
`Delete policy with ID "abc123"`	Permanently removes a policy from the system
`Get all assignments for task with ID "def456"`	Shows all assignments associated with a specific task
`Cancel task assignment with ID "xyz789"`	Cancels a specific task assignment
`Delete task assignment with ID "xyz789"`	Permanently removes a task assignment
`Get details about task with ID "40a9dc46-d401-4bd1-82d3-ca9cf97c9024"`	Displays detailed information about a specific task including evidence types and configuration
`Cancel task with ID "abc123"`	Cancels a running task with the specified ID
`Delete task with ID "abc123"`	Permanently deletes a specific task
`Create triage rule named "My Rule"`	Creates a new triage rule
`List all triage tags`	You can work with triage rules and their associated tags
`Create triage tag named "My Tag"`	Creates a new triage tag
`Update triage rule with ID "abc123"`	Updates an existing triage rule
`Delete triage rule with ID "abc123"`	Permanently removes a triage rule
`Get triage rule with ID "abc123"`	Retrieves the details of a specific triage rule
`Validate triage rule syntax`	Validates a triage rule syntax without creating it
`Assign triage task to endpoints with IDs ["id1", "id2"]`	Assigns a triage task to endpoints based on filter criteria
`Add note to case with ID "C-2022-0002"`	Adds a note to a specific case by its ID
`Update note with ID "8d9baa16-9aa3-4e4f-a08e-a74341ce2f90" in case "C-2022-0002"`	Updates an existing note in a specific case
`Delete note with ID "8d9baa16-9aa3-4e4f-a08e-a74341ce2f90" from case "C-2022-0002"`	Deletes a specific note from a case by its ID
`Export cases data`	Initiates an export of cases data for your organization
`Export notes for case with ID "case123"`	Initiates an export of notes for a specific case by its ID
`Export endpoints for case with ID "case123"`	Initiates an export of endpoints for a specific case by its ID
`Export activities for case with ID "case123"`	Initiates an export of activities for a specific case by its ID
`Create a new case named "Incident Response"`	Creates a new case in the system
`Update case with ID "C-2022-0003" to have name "Updated Case"`	Updates an existing case by ID
`Get case with ID "C-2022-0003"`	Retrieves the details of a specific case by its ID
`Close case with ID "C-2022-0003"`	Closes a specific case by its ID
`Open case with ID "C-2022-0003"`	Opens a specific case by its ID
`Archive case with ID "C-2022-0003"`	Archives a specific case by its ID
`Change case owner with ID "C-2022-0003" to user with ID "user123"`	Changes the owner of a specific case by its ID
`Check if case name "Incident 2023-05" is available`	Checks if a case name is already in use
`Get case activities for case with ID "C-2022-0003"`	Displays the activity history for a specific case by its ID
`Get endpoints for case with ID "C-2022-0001"`	Retrieves all endpoints associated with a specific case by its ID
`Get tasks for case with ID "C-2022-0001"`	Displays all tasks associated with the specified case
`Get users for case with ID "C-2022-0001"`	Retrieves all users associated with a specific case by its ID
`Remove endpoints from case with ID "C-2022-0001"`	Removes endpoints from a case based on specified filters
`Remove task assignment with ID "f04666c9-62c7-4cb0-8638-967f05eb7936" from case "C-2022-0001"`	Removes a specific task assignment from a case
`Import task assignments to case with ID "C-2022-0001"`	Imports task assignments to a specific case
`List repositories`	Lists all evidence repositories in the organization
`Create SMB repository with name "My SMB Repository"`	Creates a new SMB evidence repository with specified credentials
`Update SMB repository with ID "abc123"`	Updates an existing SMB repository's configuration
`Create SFTP repository with name "My SFTP Repository"`	Creates a new SFTP evidence repository with specified credentials
`Update SFTP repository with ID "abc123"`	Updates an existing SFTP repository's configuration
`Validate FTPS repository configuration`	Tests if a FTPS repository configuration is valid without creating it
`Create Azure Storage repository with name "My Azure Storage Repository"`	Creates a new Azure Storage evidence repository with specified credentials
`Update Azure Storage repository with ID "abc123"`	Updates an existing Azure Storage repository's configuration
`Validate Azure Storage repository with SAS URL`	Checks if the provided SAS URL is valid for Azure Storage access
`Create a new Amazon S3 repository`	Sets up a new S3 bucket as an evidence repository
`Update Amazon S3 repository with ID "abc123"`	Modifies an existing S3 repository configuration
`Validate Amazon S3 repository configuration`	Checks if S3 credentials and bucket are valid
`Get details about repository with ID "abc123"`	Displays detailed information about a specific evidence repository
`Delete repository with ID "abc123"`	Deletes a specific evidence repository
`Download PPC file for endpoint "ep-1" and task "task-1"`	Downloads a PPC file for the specified endpoint and task
`Download task report for endpoint "123" and task "456"`	Downloads a task report for the specified endpoint and task
`Get report file information for endpoint "123" and task "456"`	Retrieves information about a PPC file for a specific endpoint and task
`Get users for organization with ID "2"`	Displays all users belonging to the specified organization
`Assign users with IDs ["user1", "user2"] to organization "123"`	Assigns users to the specified organization
`Remove user with ID "user1" from organization "123"`	Removes a user from the specified organization
`Create organization with name "My Organization" and contact information`	Creates a new organization with the specified name and contact information
`Update organization with ID "123"`	Updates an existing organization with new settings
`Get details about organization with ID 2`	Displays detailed information about a specific organization
`Check if organization name "My Organization" already exists`	Checks if an organization name is already in use
`Get shareable deployment information using deployment token "token123"`	Retrieves information about a shareable deployment using a deployment token
`Update organization shareable deployment with ID "123" to be enabled`	Updates an organization's shareable deployment settings
`Update deployment token for organization with ID 2`	Updates the deployment token for a specific organization
`Delete organization with ID "123"`	Permanently removes an organization from the system
`Add tags to organization with ID "123"`	Adds tags to an organization
`Delete tags ["tag1", "tag2" ] from organization with ID "123"`	Removes tags from an organization
`Call webhook with slug "air-generic-url-webhook" and data "192.168.1.100" and token "token123"`	Calls a webhook with the specified parameters
`Post data to webhook with slug "air-generic-url-webhook"`	Sends a POST request to a webhook with provided data
`Get task assignments for task with ID "task123"`	Retrieves all assignments for a specific task by its ID
`Update banner message`	Updates the system banner message settings

Available Tools

116 tools

acquire_baselineC

Assign a baseline acquisition task to specific endpoints

Inputs: caseId (required), filter (required).

add_note_to_caseC

Add a note to a specific case by its ID

Inputs: caseId (required), note (required).

add_tags_to_assetsB

Add tags to specific assets based on filters. Requires specifying filter.includedEndpointIds and tags.

Inputs: filter (required), tags (required).

add_tags_to_organizationC

Add tags to an organization

Inputs: id (required), tags (required).

archive_case_by_idB

Archive a case by its ID

Inputs: id (required).

assign_acquisition_taskC

Assign an evidence acquisition task to specific endpoints

Inputs: caseId (required), acquisitionProfileId (required), endpointIds (required), organizationIds, +6 more.

assign_image_acquisition_taskC

Assign a disk image acquisition task to specific endpoints and volumes

Inputs: repositoryId (required), endpoints (required), caseId, organizationIds, +7 more.

assign_isolation_taskC

Assign an isolation task to specific endpoints

Inputs: endpointIds (required), enabled, organizationIds, managedStatus.

assign_log_retrieval_taskC

Assign a log retrieval task to specific endpoints

Inputs: endpointIds (required), organizationIds (required), managedStatus.

assign_reboot_taskC

Assign a reboot task to specific endpoints

Inputs: endpointIds (required), organizationIds, managedStatus.

assign_shutdown_taskC

Assign a shutdown task to specific endpoints

Inputs: endpointIds (required), organizationIds, managedStatus.

assign_triage_taskC

Assign a triage task to endpoints based on filter criteria

Inputs: caseId (required), triageRuleIds (required), taskConfig (required), mitreAttack (required), +1 more.

assign_users_to_organizationC

Assign users to a specific organization

Inputs: id (required), userIds (required).

assign_version_update_taskC

Assign a version update task to specific endpoints

Inputs: endpointIds (required), organizationIds, managedStatus.

call_webhookC

Call a webhook with the specified parameters

Inputs: slug (required), data (required), token (required).

cancel_task_assignmentC

Cancel a task assignment by its ID

Inputs: assignmentId (required).

cancel_task_by_idC

Cancel a specific task by its ID

Inputs: id (required).

change_case_ownerC

Change the owner of a case

Inputs: id (required), newOwnerId (required).

check_case_nameC

Check if a case name is already in use

Inputs: name (required).

check_organization_name_existsB

Check if an organization name already exists in the system

Inputs: name (required).

close_case_by_idC

Close a case by its ID

Inputs: id (required).

compare_baselineC

Compare baseline acquisition tasks for a specific endpoint

Inputs: endpointId (required), taskIds (required).

create_acquisition_profileC

Create a new acquisition profile

Inputs: name (required), windows (required), linux (required), macos (required), +3 more.

create_amazon_s3_repositoryC

Create a new Amazon S3 repository for evidence storage

Inputs: name (required), region (required), bucket (required), accessKeyId (required), +2 more.

create_auto_asset_tagC

Create a new rule to automatically tag assets based on specified conditions for Linux, Windows, and macOS.

Inputs: tag (required), linuxConditions (required), windowsConditions (required), macosConditions (required).

create_azure_storage_repositoryC

Create a new Azure Storage repository

Inputs: name (required), SASUrl (required), organizationIds.

create_caseC

Create a new case in the system

Inputs: name (required), ownerUserId (required), organizationId, visibility, +1 more.

create_ftps_repositoryC

Create a new FTPS evidence repository

Inputs: name (required), host (required), path (required), username (required), +5 more.

create_organizationC

Create a new organization

Inputs: name (required), contact (required), shareableDeploymentEnabled, note.

create_policyC

Create a new policy with specific storage and compression settings

Inputs: name (required), saveTo (required), compression (required), sendTo (required), +2 more.

create_sftp_repositoryC

Create a new SFTP evidence repository

Inputs: name (required), host (required), path (required), username (required), +3 more.

create_smb_repositoryC

Create a new SMB evidence repository

Inputs: name (required), path (required), username (required), password (required), +1 more.

create_triage_ruleC

Create a new triage rule

Inputs: description (required), rule (required), searchIn (required), engine (required), +1 more.

create_triage_tagC

Create a new triage rule tag

Inputs: name (required), organizationId.

delete_auto_asset_tag_by_idC

Delete a specific auto asset tag rule by its ID

Inputs: id (required).

delete_note_from_caseC

Delete a note from a case by its ID

Inputs: caseId (required), noteId (required).

delete_organizationC

Delete an organization by its ID

Inputs: id (required).

delete_policy_by_idC

Delete a specific policy by its ID

Inputs: id (required).

delete_repositoryC

Delete an evidence repository by its ID

Inputs: id (required).

delete_tags_from_organizationC

Delete specific tags from an organization

Inputs: id (required), tags (required).

delete_task_assignmentC

Delete a specific task assignment by its ID

Inputs: assignmentId (required).

delete_task_by_idC

Delete a specific task by its ID

Inputs: id (required).

delete_triage_ruleC

Delete an existing triage rule by ID

Inputs: id (required).

download_case_ppcC

Download a PPC file for a specific endpoint and task

Inputs: endpointId (required), taskId (required).

download_task_reportC

Download a task report for a specific endpoint and task

Inputs: endpointId (required), taskId (required).

export_audit_logsC

Initiate an export of audit logs from the AIR system

Inputs: organizationIds.

export_case_activitiesC

Export activities for a specific case by its ID

Inputs: caseId (required).

export_case_endpointsC

Export endpoints for a specific case by its ID

Inputs: caseId (required), organizationIds.

export_case_notesC

Export notes for a specific case by its ID

Inputs: caseId (required).

export_casesC

Export cases data from the system

Inputs: organizationIds.

get_acquisition_profile_by_idB

Get details of a specific acquisition profile by its ID

Inputs: profileId (required).

get_asset_by_idB

Get detailed information about a specific asset by its ID

Inputs: id (required).

get_asset_tasks_by_idC

Get all tasks associated with a specific asset by its ID

Inputs: id (required).

get_auto_asset_tag_by_idC

Get details of a specific auto asset tag rule by its ID

Inputs: id (required).

get_case_activitiesC

Get activity history for a specific case by its ID

Inputs: id (required).

get_case_by_idC

Get detailed information about a specific case by its ID

Inputs: id (required).

get_case_endpointsB

Get all endpoints associated with a specific case by its ID

Inputs: id (required), organizationIds.

get_case_tasks_by_idB

Get all tasks associated with a specific case by its ID

Inputs: id (required), organizationIds.

get_case_usersC

Get all users associated with a specific case by its ID

Inputs: id (required), organizationIds.

get_comparison_reportC

Get comparison result report for a specific endpoint and task

Inputs: endpointId (required), taskId (required).

get_organization_by_idC

Get detailed information about a specific organization by its ID

Inputs: id (required).

get_organization_usersB

Get users for a specific organization by its ID

Inputs: id (required).

get_policy_by_idC

Get detailed information about a specific policy by its ID

Inputs: id (required).

get_policy_match_statsC

Get statistics on how many endpoints match each policy based on filter criteria

Inputs: name, searchTerm, ipAddress, groupId, +12 more.

get_report_file_infoC

Get information about a PPC file for a specific endpoint and task

Inputs: endpointId (required), taskId (required).

get_repository_by_idB

Get detailed information about a specific evidence repository by its ID

Inputs: id (required).

get_shareable_deployment_infoC

Get shareable deployment information using a deployment token

Inputs: deploymentToken (required).

get_task_assignmentsC

Get all assignments for a specific task by its ID

Inputs: slug (required), taskId (required), token (required).

get_task_assignments_by_idC

Get all assignments associated with a specific task by its ID

Inputs: taskId (required).

get_task_by_idC

Get detailed information about a specific task by its ID

Inputs: id (required).

get_triage_rule_by_idC

Get a specific triage rule by its ID

Inputs: id (required).

get_user_by_idB

Get detailed information about a specific user by their ID

Inputs: id (required).

import_task_assignments_to_caseC

Import task assignments to a specific case

Inputs: caseId (required), taskAssignmentIds (required).

list_acquisition_artifactsB

List all acquisition artifacts available for evidence collection

Inputs: random_string (required).

list_acquisition_profilesC

List all acquisition profiles in the system

Inputs: organizationIds, allOrganizations.

list_assetsC

List all assets in the system

Inputs: organizationIds.

list_audit_logsC

List audit logs from the AIR system

Inputs: organizationIds.

list_auto_asset_tagsB

List all auto asset tag rules in the system.

Inputs: no named parameters.

list_casesC

List all cases in the system

Inputs: organizationIds.

list_drone_analyzersB

List all drone analyzers in the system

Inputs: no named parameters.

list_e_discovery_patternsB

List all e-discovery patterns for file type detection

Inputs: random_string (required).

list_organizationsB

List all organizations in the system

Inputs: no named parameters.

list_policiesB

List all policies in the system

Inputs: organizationIds.

list_repositoriesB

List all evidence repositories in the system

Inputs: organizationIds.

list_tasksB

List all tasks in the system

Inputs: organizationIds.

list_triage_rulesC

List all triage rules in the system

Inputs: organizationIds.

list_triage_tagsB

List all triage rule tags in the system

Inputs: organizationIds, withCount.

list_usersC

List all users in the system

Inputs: organizationIds.

open_case_by_idB

Open a previously closed case by its ID

Inputs: id (required).

post_webhookC

Post data to a webhook

Inputs: slug (required), data (required), token (required).

purge_and_uninstall_assetsC

Purge data and uninstall specific assets based on filters. Requires specifying filter.includedEndpointIds.

Inputs: filter (required).

remove_endpoints_from_caseC

Remove endpoints from a case based on specified filters

Inputs: id (required), filter.

remove_tags_from_assetsB

Remove tags from specific assets based on filters. Requires specifying filter.includedEndpointIds and tags.

Inputs: filter (required), tags (required).

remove_task_assignment_from_caseC

Remove a specific task assignment from a case

Inputs: caseId (required), taskAssignmentId (required).

remove_user_from_organizationC

Remove a user from an organization

Inputs: organizationId (required), userId (required).

start_taggingC

Start the auto asset tagging process for assets matching filter criteria.

Inputs: filter (required).

uninstall_assetsC

Uninstall specific assets based on filters without purging data. Requires specifying filter.includedEndpointIds.

Inputs: filter (required).

update_amazon_s3_repositoryC

Update an existing Amazon S3 repository

Inputs: id (required), name (required), region (required), bucket (required), +3 more.

update_auto_asset_tagC

Update an existing auto asset tag rule.

Inputs: id (required), tag (required), linuxConditions, windowsConditions, +1 more.

update_azure_storage_repositoryC

Update an existing Azure Storage repository

Inputs: id (required), name (required), SASUrl (required), organizationIds.

update_banner_messageC

Update the system banner message settings

Inputs: enabled (required).

update_caseC

Update an existing case by ID

Inputs: id (required), name, ownerUserId, visibility, +3 more.

update_ftps_repositoryC

Update an existing FTPS evidence repository

Inputs: id (required), name (required), host (required), path (required), +6 more.

update_note_in_caseC

Update an existing note in a specific case

Inputs: caseId (required), noteId (required), note (required).

update_organization_by_idC

Update an existing organization by ID

Inputs: id (required), name, shareableDeploymentEnabled, contact, +1 more.

update_organization_deployment_tokenC

Update the deployment token for a specific organization

Inputs: id (required), deploymentToken (required).

update_organization_shareable_deploymentC

Update an organization's shareable deployment settings

Inputs: id (required), status (required).

update_policyC

Update an existing policy with specific storage and filter settings

Inputs: id (required), name (required), saveTo (required), compression (required), +4 more.

update_policy_prioritiesC

Update the priority order of policies

Inputs: ids (required), organizationIds.

update_sftp_repositoryC

Update an existing SFTP repository

Inputs: id (required), name (required), host (required), path (required), +4 more.

update_smb_repositoryC

Update an existing SMB repository by ID

Inputs: id (required), name (required), path (required), username (required), +2 more.

update_triage_ruleC

Update an existing triage rule by ID

Inputs: id (required), description (required), rule (required), searchIn (required), +1 more.

validate_amazon_s3_repositoryC

Validate Amazon S3 repository configuration

Inputs: name (required), region (required), bucket (required), accessKeyId (required), +2 more.

validate_azure_storage_repositoryC

Validate an Azure Storage repository configuration

Inputs: SASUrl (required).

validate_ftps_repositoryB

Validate FTPS repository configuration without creating it

Inputs: name (required), host (required), path (required), username (required), +4 more.

validate_triage_ruleA

Validate a triage rule syntax without creating it

Inputs: rule (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

C2.9/5.0

Scored 2026-04-18 10:25 across 116 tools

Disambiguation3/5

Most tools have distinct purposes, but there is some overlap and potential confusion. For example, 'cancel_task_assignment' and 'cancel_task_by_id' both cancel tasks but target different IDs, and 'get_task_assignments' vs 'get_task_assignments_by_id' are similarly named but serve different functions. The descriptions help clarify, but the sheer number of tools increases the risk of misselection due to subtle distinctions.

Naming Consistency4/5

The tool names generally follow a consistent verb_noun pattern (e.g., 'create_case', 'update_organization_by_id', 'list_assets'), with clear actions and objects. There are minor deviations, such as 'call_webhook' vs 'post_webhook' (both involve webhooks but use different verbs) and some tools include 'by_id' while others do not, but overall the naming is predictable and readable.

Tool Count2/5

With 116 tools, the count is excessive for a single server, even given the broad scope of endpoint management and forensics. This large number suggests over-fragmentation, such as having separate tools for similar operations (e.g., multiple task assignment and cancellation tools) and many list/get pairs, which could overwhelm agents and lead to inefficiency in tool selection.

Completeness5/5

The tool set provides comprehensive coverage for the domain of endpoint management, forensics, and case handling. It includes full CRUD operations for cases, organizations, policies, repositories, and more, along with task management, evidence acquisition, tagging, and validation tools. There are no obvious gaps; agents can perform end-to-end workflows without dead ends.

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

Node Command
io.github.huseyincig
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
File Systems Shell Access Browser Automation
1
https://mcp.nodecommand.app/mcp
hithereiamaliff-mcp-nextcloud
ai.smithery
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Cloud Storage File Systems Workplace & Productivity
239
https://server.smithery.ai/@hithereiamaliff/mcp-nextcloud/mcp
mcpC
com.wix
A Model Context Protocol server for Wix AI tools
Developer Tools Content Management Systems App Automation
215
https://mcp.wix.com/mcp
jumpcloud-genai
com.jumpcloud
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Cloud Platforms Security Developer Tools
2
https://mcp.jumpcloud.com/v1

Related MCP Servers

Discourse MCP Server
Developer Tools Communication Databases
AshDevFr
A
license
Not graded
quality
D
maintenance
Node.js server that allows searching Discourse forum posts through the Model Context Protocol (MCP), enabling AI assistants to retrieve content from Discourse forums.
Updated 2 years ago (2025-03-10 23:36 UTC)
41 npm
5
MIT
Desktop Commander MCP Server
File Systems Shell Access OS Automation
Nexus-Digital-Automations
-
license
A
quality
Not graded
maintenance
A comprehensive Node.js server implementing Model Context Protocol (MCP) that enables filesystem operations, process management, and terminal session handling with an enterprise-grade security approach.
Updated a year ago (2025-06-21 06:52 UTC)
14
1,426,013 npm
-
Remote MCP with Azure
Agent Orchestration Cloud Platforms Code Execution
powerstar13
A
license
Not graded
quality
D
maintenance
A Node.js-based remote Model Context Protocol (MCP) server that runs on Azure Container Apps, allowing different AI models and tools to communicate with each other in a serverless environment.
Updated a year ago (2025-06-24 04:45 UTC)
MIT
@supcon-international/node-red
Developer Tools App Automation
supcon-international
A
license
B
quality
D
maintenance
Model Context Protocol (MCP) server for Node-RED that allows language models to interact with Node-RED through a standardized API.
Updated a year ago (2025-08-15 03:21 UTC)
27
32 npm
4
MIT

Appeared in Searches

A platform for IoT or industrial applications working with real assets

Binalyze AIR MCP Server

✨ Features

Overview

🔑 API Token Requirement

📦 Installation

Local Development

Usage with Claude Desktop

Usage with Cursor

🧩 Usage with Smithery

One-Line Installation Commands

Claude

Cursor

Windsurf

VSCode

How to Use

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Discourse MCP Server

Desktop Commander MCP Server

Remote MCP with Azure

@supcon-international/node-red

Appeared in Searches