# Velociraptor MCP - Streamable Variation

This variant is optimized for **Streamable HTTP** transport (FastMCP 2.3.0+), making it directly compatible with modern MCP proxies and Open WebUI.

## Deployment Options

### 1. Full Stack (Server + Proxy)
This is the recommended way to integrate with Open WebUI. It launches the Velociraptor MCP bridge and a sidecar proxy (`mcpo`) that exposes the tools via OpenAPI on port 8000.

```bash
docker compose up -d
```
*   **Bridge URL (MCP):** `http://localhost:8088/mcp`
*   **Proxy URL (OpenAPI):** `http://localhost:8000/`

### 2. Core Server Only (Direct Streamable)
Use this if your client already supports Streamable HTTP or if you are using an external proxy.

```bash
docker compose up -d velociraptor-mcp
```
*   **Bridge URL (MCP):** `http://localhost:8088/mcp`

### 3. Local Development (No Docker)
1. Install dependencies: `pip install -r requirements.txt`
2. Configure `.env` and `api_client.yaml`.
3. Run: `python mcp_velociraptor_bridge.py`

## Troubleshooting n8n Timeouts

If you receive **"MCP error -32001: Request timed out"** in n8n, it is because forensic collections (like `pslist`) take longer than n8n's 60-second response window.

### Solution: Async Mode
Set `VELOCIRAPTOR_ASYNC_COLLECTIONS=true` in your `docker-compose.yml` or `.env`. 

In this mode:
1.  Tools return a `flow_id` immediately without waiting for the endpoint.
2.  You can then use the `get_collection_results` tool (providing the `flow_id`) in a separate n8n node after a few moments to fetch the data.

## Configuration
- **Port:** 8088 (Bridge) / 8000 (Proxy)
- **Transport:** Defaults to `streamable-http`
- **Dangerous Tools:** Set `ENABLE_DANGEROUS_TOOLS=true` in `.env`.
- **Async Collections:** Set `VELOCIRAPTOR_ASYNC_COLLECTIONS=true` for n8n compatibility.