get_client_info
Retrieve detailed endpoint information including hardware specifications, operating system details, and network addresses from the Velociraptor forensics platform to support incident response investigations.
Instructions
Get detailed information about a specific Velociraptor client.
Args: client_id: The client ID (e.g., 'C.1234567890abcdef')
Returns: Detailed client information including hardware, OS, IP addresses.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| client_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- The get_client_info tool is implemented here as an asynchronous function decorated with @mcp.tool(). It validates input, queries the Velociraptor client via VQL, and formats the output, including error handling.
async def get_client_info(client_id: str) -> list[TextContent]: """Get detailed information about a specific Velociraptor client. Args: client_id: The client ID (e.g., 'C.1234567890abcdef') Returns: Detailed client information including hardware, OS, IP addresses. """ try: # Validate client_id client_id = validate_client_id(client_id) client = get_client() vql = f"SELECT * FROM clients(client_id='{client_id}')" results = client.query(vql) if not results: return [TextContent( type="text", text=json.dumps({ "error": f"Client {client_id} not found", "hint": "Use list_clients tool to find valid client IDs" }) )] # Return the full client info return [TextContent( type="text", text=json.dumps(results[0], indent=2, default=str) )] except ValueError as e: # Validation errors return [TextContent( type="text", text=json.dumps({ "error": str(e), "hint": "Provide a valid client ID starting with 'C.'" }) )] except grpc.RpcError as e: # gRPC errors error_info = map_grpc_error(e, f"fetching client {client_id}") return [TextContent( type="text", text=json.dumps(error_info, indent=2) )] except Exception: # Generic errors - don't expose internals return [TextContent( type="text", text=json.dumps({ "error": "Failed to get client information", "hint": "Check Velociraptor server connection and try again" }) )]