Velociraptor MCP - Streamable Variation

This variant is optimized for Streamable HTTP transport (FastMCP 2.3.0+), making it directly compatible with modern MCP proxies and Open WebUI.

Deployment Options

1. Full Stack (Server + Proxy)

This is the recommended way to integrate with Open WebUI. It launches the Velociraptor MCP bridge and a sidecar proxy (mcpo) that exposes the tools via OpenAPI on port 8000.

docker compose up -d

• Bridge URL (MCP): http://localhost:8088/mcp

• Proxy URL (OpenAPI): http://localhost:8000/

2. Core Server Only (Direct Streamable)

Use this if your client already supports Streamable HTTP or if you are using an external proxy.

docker compose up -d velociraptor-mcp

• Bridge URL (MCP): http://localhost:8088/mcp

3. Local Development (No Docker)

1. Install dependencies: pip install -r requirements.txt

2. Configure .env and api_client.yaml.

3. Run: python mcp_velociraptor_bridge.py

Troubleshooting n8n Timeouts

If you receive "MCP error -32001: Request timed out" in n8n, it is because forensic collections (like pslist) take longer than n8n's 60-second response window.

Solution: Async Mode

Set VELOCIRAPTOR_ASYNC_COLLECTIONS=true in your docker-compose.yml or .env.

In this mode:

1. Tools return a flow_id immediately without waiting for the endpoint.

2. You can then use the get_collection_results tool (providing the flow_id) in a separate n8n node after a few moments to fetch the data.

Configuration

• Port: 8088 (Bridge) / 8000 (Proxy)

• Transport: Defaults to streamable-http

• Dangerous Tools: Set ENABLE_DANGEROUS_TOOLS=true in .env.

• Async Collections: Set VELOCIRAPTOR_ASYNC_COLLECTIONS=true for n8n compatibility.