# Clone the repository
git clone https://github.com/binalyze/air-mcp

# Change to the project directory
cd air-mcp

# Install dependencies
npm install

# Build the project
npm run build

{
  "mcpServers": {
    "air-mcp": {
      "command": "npx",
      "args": ["-y", "@binalyze/air-mcp"],
      "env": {
        "AIR_HOST": "your-api-host.com",
        "AIR_API_TOKEN": "your-api-token"
      }
    }
  }
}

npx -y @smithery/cli@latest install @binalyze/air-mcp --client claude --key {smithery_key}

npx -y @smithery/cli@latest install @binalyze/air-mcp --client cursor --key {smithery_key}

npx -y @smithery/cli@latest install@rapidappio/rapidapp-mcp --client windsurf --key {smithery_key}

npx -y @smithery/cli@latest install @binalyze/air-mcp --client vscode --key {smithery_key}

List all acquisition artifacts
Show me all available artifacts for Windows
What artifacts can be collected for evidence?

List all acquisition evidences
Show me all available evidences for Windows
What evidences can be collected during an investigation?

List all e-discovery patterns
Show me all file patterns for e-discovery
What file patterns are available for e-discovery?

List all assets for organization 123
Show me all cases for organization 456
Get policies for organization 789
List tasks for organization 123
List triage rules for organization 123
List users for organization 123
Export audit logs for organization 0
List audit logs for organization 0

Get details for asset "bc906dea-f92d-46b3-87f2-a2fc36667f70"
Show me information about endpoint with ID "bc906dea-f92d-46b3-87f2-a2fc36667f70"

Get tasks for asset "bc906dea-f92d-46b3-87f2-a2fc36667f70"
Show me the tasks assigned to endpoint with ID "bc906dea-f92d-46b3-87f2-a2fc36667f70"
What tasks are currently running on asset "bc906dea-f92d-46b3-87f2-a2fc36667f70"

Assign an acquisition task to endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd" using profile "full" for case "C-2022-0001"
Start an acquisition on endpoints ["id1", "id2"] with profile "memory" for case "C-2023-0045" with analyzers ["bha", "wsa"]

Assign an image acquisition task to endpoint "7a37cfdb-..." for volume "/dev/disk3s5" saving to repository "Q2gCVO..." with case ID "C-2024-0123"
Assign image task for endpoint "ep-id-1" volumes ["/dev/sda1", "/dev/sda2"] and endpoint "ep-id-2" volume "C:" to repository "repo-xyz"

Reboot endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Assign a reboot task to endpoints ["id1", "id2"] for organization 123

Shutdown endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Assign a shutdown task to endpoints ["id1", "id2"] for organization 123

Isolate endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Assign an isolation task to endpoints ["id1", "id2"] for organization 123
Unisolate endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd" (by setting enabled=false)
Assign an unisolation task to endpoints ["id1", "id2"] with enabled=false

Retrieve logs from endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd" with organization ID 0
Assign a log retrieval task to endpoints ["id1", "id2"] for organization 123

Update version for endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Assign a version update task to endpoints ["id1", "id2"] for organization 123

Uninstall asset with ID "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Uninstall assets with IDs ["id1", "id2"] for organization 0

Purge and uninstall asset with ID "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Purge and uninstall assets with IDs ["id1", "id2"] for organization 0

Add tags ["important", "review-needed"] to asset with ID "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Add tag "critical" to assets with IDs ["id1", "id2"] for organization 0

Remove tags ["obsolete"] from asset with ID "0ccbb181-685c-4f1e-982a-6f7c7e88eadd"
Remove tag "needs-review" from assets with IDs ["id1", "id2"] for organization 0

Create an auto asset tag named "Web Server"
- For Linux: if process "apache2" is running OR process "nginx" is running
- For Windows: if process "httpd.exe" is running OR process "nginx.exe" is running
- For macOS: if process "httpd" is running

Create auto asset tag "Domain Controller" if windows registry key "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters" exists

Get auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"
Show me details about the auto asset tag rule "f6kEPhpqMNqJeHfi4RyxiWEm"
Fetch information about auto asset tag "f6kEPhpqMNqJeHfi4RyxiWEm"

Delete auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"
Remove the auto asset tag rule "f6kEPhpqMNqJeHfi4RyxiWEm"
Delete the auto asset tagging rule "f6kEPhpqMNqJeHfi4RyxiWEm"

List all auto asset tags
Show me the auto asset tag rules

Start auto tagging for all Windows assets
Start tagging for managed Windows endpoints
Initiate auto tagging process for assets with platform "linux"
Start auto tagging for endpoints with IDs ["id1", "id2"]

Acquire baseline for case "C-2022-001" from endpoints ["0ccbb181-685c-4f1e-982a-6f7c7e88eadd", "7a37cfdb-..."]
Get baseline data for case "C-2023-042" from all Windows endpoints
Acquire baseline for online endpoints with case ID "C-2024-099"
Collect baseline from managed endpoints with IDs ["id1", "id2", "id3"] for case "C-2024-100"

Compare baselines for endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd" with task IDs ["task1", "task2"]
Compare baseline tasks ["task-id-1", "task-id-2", "task-id-3"] for endpoint "7a37cfdb-..."
Create baseline comparison between tasks "pre-update-task-id" and "post-update-task-id" for endpoint "bc906dea-..."

Get comparison report for endpoint "0ccbb181-685c-4f1e-982a-6f7c7e88eadd" and task "task1"
Show me the comparison result for endpoint "7a37cfdb-..." and task "comparison-task-id"
Download the baseline comparison report for endpoint "bc906dea-..." task "task-xyz"

Create a policy named "Dev Policy" with:
Windows storage at C:\Binalyze\AIR
Linux storage at /opt/binalyze/air
macOS storage at /opt/binalyze/air
Compression enabled
Encryption enable with password "secure123"

Show me all assignments for task abc-123-456