\n\nA Node.js server implementing **Model Context Protocol (MCP)** for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities.\n\n## ✨ Features\n\n- **Asset Management** - List assets in your organization.\n- **Asset Details** - Get detailed information about a specific asset by its ID.\n- **Asset Tasks** - Get all tasks associated with a specific asset by its ID.\n- **Acquisition Profiles** - List acquisition profiles.\n- **Acquisition Tasks** - Assign evidence acquisition tasks to endpoints.\n- **Image Acquisition Tasks** - Assign disk image acquisition tasks to endpoints.\n- **Baseline Acquisition** - Acquire baseline data from specific endpoints to establish a reference point.\n- **Compare Baseline** - Compare multiple baseline acquisition tasks for a specific endpoint to identify changes.\n- **Get Comparison Report** - Retrieve comparison result report for a specific endpoint and task.\n- **Create Acquisition Profiles** - Create new acquisition profiles with specific evidence/artifact/network settings.\n- **Acquisition Artifacts** - List available artifacts for evidence collection.\n- **Acquisition Evidences** - List available evidence items for forensic data collection.\n- **Reboot Tasks** - Assign reboot tasks to specific endpoints.\n- **Shutdown Tasks** - Assign shutdown tasks to specific endpoints.\n- **Isolation Tasks** - Isolate or unisolate specific endpoints.\n- **Log Retrieval Tasks** - Retrieve logs from specific endpoints.\n- **Version Update Tasks** - Assign version update tasks to specific endpoints.\n- **Organization Management** - List organizations.\n- **Case Management** - List cases in your organization.\n- **Policy Management** - See security policies across your organization.\n- **Task Management** - Track forensic collection tasks and their statuses.\n- **Triage Rules** - View YARA, Osquery and Sigma rules for threat detection.\n- **User Management** - List users in your organization.\n- **User Details** - Get detailed information about a specific user by their ID.\n- **Drone Analyzers** - View available drone analyzers with supported operating systems.\n- **Audit Log Export** - Initiate an export of audit logs.\n- **List Audit Logs** - View audit logs from the system.\n- **Uninstall Assets** - Uninstall specific assets based on filters without purging data.\n- **Purge and Uninstall Assets** - Purge data and uninstall specific assets based on filters.\n- **Add Tags to Assets** - Add tags to specific assets based on filters.\n- **Remove Tags from Assets** - Remove tags from specific assets based on filters.\n- **Auto Asset Tagging** - Create and update rules to automatically tag assets based on specific conditions.\n- **List Auto Asset Tags** - List all existing auto asset tag rules.\n- **Get Auto Asset Tag Details** - Get detailed information about a specific auto asset tag rule by its ID.\n- **Delete Auto Asset Tag** - Delete a specific auto asset tag rule by its ID.\n- **Start Auto Tagging** - Initiate the auto tagging process for assets that match specific filter criteria.\n- **E-Discovery Patterns** - List available e-discovery patterns for detecting different file types.\n- **Policy Management** - List, create, update, and delete policies in your organization.\n- **Policy Match Statistics** - See which policies apply to your assets based on various criteria.\n- **Task Assignment Management** - View and manage task assignments.\n- **Triage Rules Management** - List, create, update, and delete triage rules for threat detection.\n- **Triage Tags Management** - List and create triage tags for threat detection.\n- **Validate Triage Rule** - Validate a triage rule syntax without creating it.\n- **Assign Triage Task** - Assign a triage task to endpoints based on filter criteria.\n- **Add Note to Case** - Add a note to a specific case by its ID.\n- **Update Note in Case** - Update an existing note in a specific case.\n- **Delete Note from Case** - Delete a note from a case by its ID.\n- **Export Cases** - Export cases data from the system.\n- **Export Case Notes** - Export notes for a specific case by its ID.\n- **Export Case Endpoints** - Export endpoints for a specific case by its ID.\n- **Export Case Activities** - Export activities for a specific case by its ID.\n- **Create Case** - Create a new case in the system.\n- **Update Case** - Update an existing case by ID.\n- **Get Case by ID** - Get detailed information about a specific case by its ID.\n- **Close Case by ID** - Close a specific case by its ID.\n- **Open Case by ID** - Open a specific case by its ID.\n- **Archive Case by ID** - Archive a specific case by its ID.\n- **Check Case Name** - Check if a case name is already in use.\n- **Get Case Activities** - Get activity history for a specific case by its ID.\n- **Get Case Endpoints** - Get all endpoints associated with a specific case by its ID.\n- **Get Case Tasks by ID** - Get all tasks associated with a specific case by its ID.\n- **Get Case Users** - Get all users associated with a specific case by its ID.\n- **Remove Endpoints from Case** - Remove endpoints from a case based on specified filters.\n- **Remove Task Assignment from Case** - Remove a specific task assignment from a case.\n- **Import Task Assignments to Case** - Import task assignments to a specific case.\n- **List Repositories** - List all evidence repositories in the organization.\n- **Create SMB Repository** - Create a new SMB evidence repository.\n- **Update SMB Repository** - Update an existing SMB evidence repository.\n- **Create SFTP Repository** - Create a new SFTP evidence repository.\n- **Update SFTP Repository** - Update an existing SFTP evidence repository.\n- **Create FTPS Repository** - Create a new FTPS evidence repository.\n- **Update FTPS Repository** - Update an existing FTPS evidence repository.\n- **Validate FTPS Repository** - Validate FTPS repository configuration without creating it.\n- **Create Azure Storage Repository** - Create a new Azure Storage evidence repository.\n- **Update Azure Storage Repository** - Update an existing Azure Storage evidence repository.\n- **Validate Azure Storage Repository** - Validate Azure Storage repository configuration without creating it.\n- **Create Amazon S3 Repository** - Create a new Amazon S3 evidence repository.\n- **Update Amazon S3 Repository** - Update an existing Amazon S3 evidence repository.\n- **Validate Amazon S3 Repository** - Validate Amazon S3 repository configuration without creating it.\n- **Get Repository by ID** - Get detailed information about a specific evidence repository by its ID.\n- **Delete Repository** - Delete an evidence repository by its ID.\n- **Download Case PPC** - Download a PPC file for a specific endpoint and task.\n- **Download Task Report** - Download a task report for a specific endpoint and task.\n- **Get Report File Info** - Get information about a PPC file for a specific endpoint and task.\n- **Get Organization Users** - Get users for a specific organization by its ID.\n- **Assign Users to Organization** - Assign users to a specific organization.\n- **Remove User from Organization** - Remove a user from a specific organization.\n- **Create Organization** - Create a new organization.\n- **Update Organization** - Update an existing organization.\n- **Get Organization by ID** - Get detailed information about a specific organization by its ID.\n- **Check Organization Name Exists** - Check if an organization name already exists in the system.\n- **Get Shareable Deployment Info** - Get information about a shareable deployment using a deployment token.\n- **Update Organization Shareable Deployment** - Update an organization's shareable deployment settings.\n- **Update Organization Deployment Token** - Update the deployment token for a specific organization.\n- **Delete Organization** - Delete an organization by its ID.\n- **Add Tags to Organization** - Add tags to an organization.\n- **Delete Tags from Organization** - Delete tags from an organization.\n- **Call Webhook** - Call a webhook with the specified parameters.\n- **Post Webhook** - Post data to a webhook.\n- **Get Task Assignments** - Get all assignments for a specific task by its ID.\n- **Update Banner Message** - Update the system banner message settings.\n\n## Overview\n\nThis MCP server creates a bridge between **Large Language Models (LLMs)** and Binalyze AIR, allowing interaction through natural language. Retrieve information about your digital forensics environment without writing code or learning complex APIs.\n\n### 🔑 API Token Requirement\n\n> **Important:** An API token is required for authentication. Set it using the `AIR_API_TOKEN` environment variable.\n\n## 📦 Installation\n\n### Local Development\n\n```bash\n# Clone the repository\ngit clone https://github.com/binalyze/air-mcp\n\n# Change to the project directory\ncd air-mcp\n\n# Install dependencies\nnpm install\n\n# Build the project\nnpm run build\n```\n\n### Usage with Claude Desktop\n\nAdd the following configuration to your Claude Desktop config file:\n\n```json\n{\n \"mcpServers\": {\n \"air-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@binalyze/air-mcp\"],\n \"env\": {\n \"AIR_HOST\": \"your-api-host.com\",\n \"AIR_API_TOKEN\": \"your-api-token\"\n }\n }\n }\n}\n```\n\n### Usage with Cursor\n\n1. Navigate to Cursor Settings > MCP\n2. Add new MCP server with the following configuration:\n ```json\n {\n \"mcpServers\": {\n \"air-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@binalyze/air-mcp\"],\n \"env\": {\n \"AIR_HOST\": \"your-api-host.com\",\n \"AIR_API_TOKEN\": \"your-api-token\"\n }\n }\n }\n }\n ```\n\n## 🧩 Usage with Smithery\n\n> **Note:** Don't forget to activate Agent mode in your editor.\n\n### One-Line Installation Commands\n\n#### Claude\n```bash\nnpx -y @smithery/cli@latest install @binalyze/air-mcp --client claude --key {smithery_key}\n```\n\n#### Cursor\n```bash\nnpx -y @smithery/cli@latest install @binalyze/air-mcp --client cursor --key {smithery_key}\n```\n\n#### Windsurf\n```bash\nnpx -y @smithery/cli@latest install@rapidappio/rapidapp-mcp --client windsurf --key {smithery_key}\n```\n\n#### VSCode\n```bash\nnpx -y @smithery/cli@latest install @binalyze/air-mcp --client vscode --key {smithery_key}\n```\nOr use the Magic Link option in VSCode.\n\n## How to Use\n\nIn Claude Desktop, or any MCP Client, you can use natural language commands:\n\n| Command | Description |\n|---------|-------------|\n| `List all assets in the system` | Shows all managed/unmanaged endpoints with OS, platform info |\n| `Get details about asset with ID \"abc123\"` | Displays detailed information about a specific asset |\n| `Get tasks for asset with ID \"abc123\"` | Shows all tasks associated with a specific asset |\n| `List all acquisition profiles` | Displays available acquisition profiles |\n| `Get acquisition profile details by ID` | Shows detailed information about a specific acquisition profile, including evidence and artifacts |\n| `List all acquisition artifacts` | Shows all available artifacts for evidence collection, organized by platform and category |\n| `List all acquisition evidences` | Shows all available evidence items for forensic data collection, organized by platform and category |\n| `Assign an acquisition task to endpoint 123abc using profile \"full\" for case \"C-2022-0001\"` | Assigns an evidence acquisition task to specified endpoint(s) |\n| `Assign an image acquisition task to endpoint 123abc for volume /dev/sda1 saving to repository 456def` | Assigns a disk image acquisition task to a specific endpoint and volume, saving to a specified repository |\n| `Create an acquisition profile named \"My Custom Profile\" with windows evidence [\"clp\"] and linux artifact [\"apcl\"]` | Creates a new acquisition profile with the specified configuration |\n| `Reboot endpoint 123abc` | Assigns a reboot task to a specific endpoint |\n| `Shutdown endpoint 123abc` | Assigns a shutdown task to a specific endpoint |\n| `Isolate endpoint 123abc` | Assigns an isolation task to a specific endpoint |\n| `Unisolate endpoint 123abc` | Removes isolation from a specific endpoint |\n| `Retrieve logs from endpoint 123abc` | Assigns a log retrieval task to a specific endpoint |\n| `Update version for endpoint 123abc` | Assigns a version update task to a specific endpoint |\n| `List all organizations` | Shows all organizations in environments |\n| `List all cases` | Displays cases with status and creation time |\n| `List all policies` | Shows security policies and collection policies |\n| `List all tasks` | Lists all tasks with their statuses |\n| `List all triage rules` | Shows YARA, OSQuery and Sigma rules for threat detection |\n| `List all users` | Shows all users in the system with their details |\n| `Get user by ID` | Retrieves the details of a specific user by their ID |\n| `List all drone analyzers` | Shows available drone analyzers with supported operating systems |\n| `Export audit logs` | Initiates the export of audit logs. The export runs in the background on the AIR server. |\n| `List audit logs` | Shows audit logs with details like timestamp, user, action, entity |\n| `Uninstall asset with ID \"endpoint-id\"` | Uninstalls the specified asset without purging data (requires providing `filter.includedEndpointIds`) |\n| `Purge and uninstall asset with ID \"endpoint-id\"` | Purges data and uninstalls the specified asset (requires providing `filter.includedEndpointIds`) |\n| `Add tags [\"tag1\", \"tag2\"] to asset with ID \"endpoint-id\"` | Adds specified tags to the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`) |\n| `Remove tags [\"tag1\"] from asset with ID \"endpoint-id\"` | Removes specified tags from the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`) |\n| `Create an auto asset tag named \"Web Server\"` | Creates a new rule to automatically tag assets based on conditions. |\n| `Update auto asset tag \"fkkEPhpqMNqJeHfi4RyxiWEm\" to have tag name \"Updated Container\" with linux process \"containerd\" running` | Updates an existing auto asset tag rule with new conditions. |\n| `List all auto asset tag rules` | Lists all existing auto asset tag rules with their configurations. |\n| `Get auto asset tag with ID \"f6kEPhpqMNqJeHfi4RyxiWEm\"` | Shows detailed information about a specific auto asset tag rule. |\n| `Delete auto asset tag with ID \"f6kEPhpqMNqJeHfi4RyxiWEm\"` | Deletes a specific auto asset tag rule by its ID. |\n| `Start auto tagging for windows machines` | Initiates the auto tagging process for Windows assets matching specified criteria. |\n| `Acquire baseline for case \"C-2022-001\" from endpoints [\"id1\", \"id2\"]` | Acquires baseline data from specified endpoints for a given case ID. |\n| `Compare baselines for endpoint \"id1\" with task IDs [\"task1\", \"task2\"]` | Compares multiple baseline acquisition tasks for a specific endpoint to identify changes. |\n| `Get comparison report for endpoint \"id1\" and task \"task1\"` | Retrieves the comparison result report for a specific endpoint and comparison task. |\n| `List all e-discovery patterns` | Shows all available e-discovery patterns for file type detection |\n| `Create a policy named \"Production Policy\" with specific storage settings` | Creates a new policy with custom settings |\n| `Update policy with ID \"abc123\"` | Updates an existing policy with new settings |\n| `Get policy details for ID \"System\"` | Displays detailed information about a specific policy |\n| `Update policy priorities to [\"policy1\", \"policy2\", \"policy3\"]` | Updates the order of policy application |\n| `Show policy match statistics` | Shows how many endpoints match each policy |\n| `Get policy distribution for Windows endpoints` | Shows policy matches filtered by platform |\n| `Get policy match stats for offline endpoints` | Shows policy matches for offline assets |\n| `Delete policy with ID \"abc123\"` | Permanently removes a policy from the system |\n| `Get all assignments for task with ID \"def456\"` | Shows all assignments associated with a specific task |\n| `Cancel task assignment with ID \"xyz789\"` | Cancels a specific task assignment |\n| `Delete task assignment with ID \"xyz789\"` | Permanently removes a task assignment |\n| `Get details about task with ID \"40a9dc46-d401-4bd1-82d3-ca9cf97c9024\"` | Displays detailed information about a specific task including evidence types and configuration |\n| `Cancel task with ID \"abc123\"` | Cancels a running task with the specified ID |\n| `Delete task with ID \"abc123\"` | Permanently deletes a specific task |\n| `Create triage rule named \"My Rule\"` | Creates a new triage rule |\n| `List all triage tags` | You can work with triage rules and their associated tags |\n| `Create triage tag named \"My Tag\"` | Creates a new triage tag |\n| `Update triage rule with ID \"abc123\"` | Updates an existing triage rule |\n| `Delete triage rule with ID \"abc123\"` | Permanently removes a triage rule |\n| `Get triage rule with ID \"abc123\"` | Retrieves the details of a specific triage rule |\n| `Validate triage rule syntax` | Validates a triage rule syntax without creating it |\n| `Assign triage task to endpoints with IDs [\"id1\", \"id2\"]` | Assigns a triage task to endpoints based on filter criteria |\n| `Add note to case with ID \"C-2022-0002\"` | Adds a note to a specific case by its ID |\n| `Update note with ID \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\" in case \"C-2022-0002\"` | Updates an existing note in a specific case |\n| `Delete note with ID \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\" from case \"C-2022-0002\"` | Deletes a specific note from a case by its ID |\n| `Export cases data` | Initiates an export of cases data for your organization |\n| `Export notes for case with ID \"case123\"` | Initiates an export of notes for a specific case by its ID |\n| `Export endpoints for case with ID \"case123\"` | Initiates an export of endpoints for a specific case by its ID |\n| `Export activities for case with ID \"case123\"` | Initiates an export of activities for a specific case by its ID |\n| `Create a new case named \"Incident Response\"` | Creates a new case in the system |\n| `Update case with ID \"C-2022-0003\" to have name \"Updated Case\"` | Updates an existing case by ID |\n| `Get case with ID \"C-2022-0003\"` | Retrieves the details of a specific case by its ID |\n| `Close case with ID \"C-2022-0003\"` | Closes a specific case by its ID |\n| `Open case with ID \"C-2022-0003\"` | Opens a specific case by its ID |\n| `Archive case with ID \"C-2022-0003\"` | Archives a specific case by its ID |\n| `Change case owner with ID \"C-2022-0003\" to user with ID \"user123\"` | Changes the owner of a specific case by its ID |\n| `Check if case name \"Incident 2023-05\" is available` | Checks if a case name is already in use |\n| `Get case activities for case with ID \"C-2022-0003\"` | Displays the activity history for a specific case by its ID |\n| `Get endpoints for case with ID \"C-2022-0001\"` | Retrieves all endpoints associated with a specific case by its ID |\n| `Get tasks for case with ID \"C-2022-0001\"` | Displays all tasks associated with the specified case |\n| `Get users for case with ID \"C-2022-0001\"` | Retrieves all users associated with a specific case by its ID |\n| `Remove endpoints from case with ID \"C-2022-0001\"` | Removes endpoints from a case based on specified filters |\n| `Remove task assignment with ID \"f04666c9-62c7-4cb0-8638-967f05eb7936\" from case \"C-2022-0001\"` | Removes a specific task assignment from a case |\n| `Import task assignments to case with ID \"C-2022-0001\"` | Imports task assignments to a specific case |\n| `List repositories` | Lists all evidence repositories in the organization |\n| `Create SMB repository with name \"My SMB Repository\"` | Creates a new SMB evidence repository with specified credentials |\n| `Update SMB repository with ID \"abc123\"` | Updates an existing SMB repository's configuration |\n| `Create SFTP repository with name \"My SFTP Repository\"` | Creates a new SFTP evidence repository with specified credentials |\n| `Update SFTP repository with ID \"abc123\"` | Updates an existing SFTP repository's configuration |\n| `Validate FTPS repository configuration` | Tests if a FTPS repository configuration is valid without creating it |\n| `Create Azure Storage repository with name \"My Azure Storage Repository\"` | Creates a new Azure Storage evidence repository with specified credentials |\n| `Update Azure Storage repository with ID \"abc123\"` | Updates an existing Azure Storage repository's configuration |\n| `Validate Azure Storage repository with SAS URL` | Checks if the provided SAS URL is valid for Azure Storage access |\n| `Create a new Amazon S3 repository` | Sets up a new S3 bucket as an evidence repository |\n| `Update Amazon S3 repository with ID \"abc123\"` | Modifies an existing S3 repository configuration |\n| `Validate Amazon S3 repository configuration` | Checks if S3 credentials and bucket are valid |\n| `Get details about repository with ID \"abc123\"` | Displays detailed information about a specific evidence repository |\n| `Delete repository with ID \"abc123\"` | Deletes a specific evidence repository |\n| `Download PPC file for endpoint \"ep-1\" and task \"task-1\"` | Downloads a PPC file for the specified endpoint and task |\n| `Download task report for endpoint \"123\" and task \"456\"` | Downloads a task report for the specified endpoint and task |\n| `Get report file information for endpoint \"123\" and task \"456\"` | Retrieves information about a PPC file for a specific endpoint and task |\n| `Get users for organization with ID \"2\"` | Displays all users belonging to the specified organization |\n| `Assign users with IDs [\"user1\", \"user2\"] to organization \"123\"` | Assigns users to the specified organization |\n| `Remove user with ID \"user1\" from organization \"123\"` | Removes a user from the specified organization |\n| `Create organization with name \"My Organization\" and contact information` | Creates a new organization with the specified name and contact information |\n| `Update organization with ID \"123\"` | Updates an existing organization with new settings |\n| `Get details about organization with ID 2` | Displays detailed information about a specific organization |\n| `Check if organization name \"My Organization\" already exists` | Checks if an organization name is already in use |\n| `Get shareable deployment information using deployment token \"token123\"` | Retrieves information about a shareable deployment using a deployment token |\n| `Update organization shareable deployment with ID \"123\" to be enabled` | Updates an organization's shareable deployment settings |\n| `Update deployment token for organization with ID 2` | Updates the deployment token for a specific organization |\n| `Delete organization with ID \"123\"` | Permanently removes an organization from the system |\n| `Add tags to organization with ID \"123\"` | Adds tags to an organization |\n| `Delete tags [\"tag1\", \"tag2\" ] from organization with ID \"123\"` | Removes tags from an organization |\n| `Call webhook with slug \"air-generic-url-webhook\" and data \"192.168.1.100\" and token \"token123\"` | Calls a webhook with the specified parameters |\n| `Post data to webhook with slug \"air-generic-url-webhook\"` | Sends a POST request to a webhook with provided data |\n| `Get task assignments for task with ID \"task123\"` | Retrieves all assignments for a specific task by its ID |\n| `Update banner message` | Updates the system banner message settings |\n\n","readmeFilename":"README.md"}
![\"AIR](\"./src/assets/bi-logo.png\"){kind=logo}
\n