Binalyze AIR MCP Server

A Node.js server implementing Model Context Protocol (MCP) for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities.

✨ Features

Asset Management - List assets in your organization.
Asset Details - Get detailed information about a specific asset by its ID.
Asset Tasks - Get all tasks associated with a specific asset by its ID.
Acquisition Profiles - List acquisition profiles.
Acquisition Tasks - Assign evidence acquisition tasks to endpoints.
Image Acquisition Tasks - Assign disk image acquisition tasks to endpoints.
Baseline Acquisition - Acquire baseline data from specific endpoints to establish a reference point.
Compare Baseline - Compare multiple baseline acquisition tasks for a specific endpoint to identify changes.
Get Comparison Report - Retrieve comparison result report for a specific endpoint and task.
Create Acquisition Profiles - Create new acquisition profiles with specific evidence/artifact/network settings.
Acquisition Artifacts - List available artifacts for evidence collection.
Acquisition Evidences - List available evidence items for forensic data collection.
Reboot Tasks - Assign reboot tasks to specific endpoints.
Shutdown Tasks - Assign shutdown tasks to specific endpoints.
Isolation Tasks - Isolate or unisolate specific endpoints.
Log Retrieval Tasks - Retrieve logs from specific endpoints.
Version Update Tasks - Assign version update tasks to specific endpoints.
Organization Management - List organizations.
Case Management - List cases in your organization.
Policy Management - See security policies across your organization.
Task Management - Track forensic collection tasks and their statuses.
Triage Rules - View YARA, Osquery and Sigma rules for threat detection.
User Management - List users in your organization.
User Details - Get detailed information about a specific user by their ID.
Drone Analyzers - View available drone analyzers with supported operating systems.
Audit Log Export - Initiate an export of audit logs.
List Audit Logs - View audit logs from the system.
Uninstall Assets - Uninstall specific assets based on filters without purging data.
Purge and Uninstall Assets - Purge data and uninstall specific assets based on filters.
Add Tags to Assets - Add tags to specific assets based on filters.
Remove Tags from Assets - Remove tags from specific assets based on filters.
Auto Asset Tagging - Create and update rules to automatically tag assets based on specific conditions.
List Auto Asset Tags - List all existing auto asset tag rules.
Get Auto Asset Tag Details - Get detailed information about a specific auto asset tag rule by its ID.
Delete Auto Asset Tag - Delete a specific auto asset tag rule by its ID.
Start Auto Tagging - Initiate the auto tagging process for assets that match specific filter criteria.
E-Discovery Patterns - List available e-discovery patterns for detecting different file types.
Policy Management - List, create, update, and delete policies in your organization.
Policy Match Statistics - See which policies apply to your assets based on various criteria.
Task Assignment Management - View and manage task assignments.
Triage Rules Management - List, create, update, and delete triage rules for threat detection.
Triage Tags Management - List and create triage tags for threat detection.
Validate Triage Rule - Validate a triage rule syntax without creating it.
Assign Triage Task - Assign a triage task to endpoints based on filter criteria.
Add Note to Case - Add a note to a specific case by its ID.
Update Note in Case - Update an existing note in a specific case.
Delete Note from Case - Delete a note from a case by its ID.
Export Cases - Export cases data from the system.
Export Case Notes - Export notes for a specific case by its ID.
Export Case Endpoints - Export endpoints for a specific case by its ID.
Export Case Activities - Export activities for a specific case by its ID.
Create Case - Create a new case in the system.
Update Case - Update an existing case by ID.
Get Case by ID - Get detailed information about a specific case by its ID.
Close Case by ID - Close a specific case by its ID.
Open Case by ID - Open a specific case by its ID.
Archive Case by ID - Archive a specific case by its ID.
Check Case Name - Check if a case name is already in use.
Get Case Activities - Get activity history for a specific case by its ID.
Get Case Endpoints - Get all endpoints associated with a specific case by its ID.
Get Case Tasks by ID - Get all tasks associated with a specific case by its ID.
Get Case Users - Get all users associated with a specific case by its ID.
Remove Endpoints from Case - Remove endpoints from a case based on specified filters.
Remove Task Assignment from Case - Remove a specific task assignment from a case.
Import Task Assignments to Case - Import task assignments to a specific case.
List Repositories - List all evidence repositories in the organization.
Create SMB Repository - Create a new SMB evidence repository.
Update SMB Repository - Update an existing SMB evidence repository.
Create SFTP Repository - Create a new SFTP evidence repository.
Update SFTP Repository - Update an existing SFTP evidence repository.
Create FTPS Repository - Create a new FTPS evidence repository.
Update FTPS Repository - Update an existing FTPS evidence repository.
Validate FTPS Repository - Validate FTPS repository configuration without creating it.
Create Azure Storage Repository - Create a new Azure Storage evidence repository.
Update Azure Storage Repository - Update an existing Azure Storage evidence repository.
Validate Azure Storage Repository - Validate Azure Storage repository configuration without creating it.
Create Amazon S3 Repository - Create a new Amazon S3 evidence repository.
Update Amazon S3 Repository - Update an existing Amazon S3 evidence repository.
Validate Amazon S3 Repository - Validate Amazon S3 repository configuration without creating it.
Get Repository by ID - Get detailed information about a specific evidence repository by its ID.
Delete Repository - Delete an evidence repository by its ID.
Download Case PPC - Download a PPC file for a specific endpoint and task.
Download Task Report - Download a task report for a specific endpoint and task.
Get Report File Info - Get information about a PPC file for a specific endpoint and task.
Get Organization Users - Get users for a specific organization by its ID.
Assign Users to Organization - Assign users to a specific organization.
Remove User from Organization - Remove a user from a specific organization.
Create Organization - Create a new organization.
Update Organization - Update an existing organization.
Get Organization by ID - Get detailed information about a specific organization by its ID.
Check Organization Name Exists - Check if an organization name already exists in the system.
Get Shareable Deployment Info - Get information about a shareable deployment using a deployment token.
Update Organization Shareable Deployment - Update an organization's shareable deployment settings.
Update Organization Deployment Token - Update the deployment token for a specific organization.
Delete Organization - Delete an organization by its ID.
Add Tags to Organization - Add tags to an organization.
Delete Tags from Organization - Delete tags from an organization.
Call Webhook - Call a webhook with the specified parameters.
Post Webhook - Post data to a webhook.
Get Task Assignments - Get all assignments for a specific task by its ID.
Update Banner Message - Update the system banner message settings.

Overview

This MCP server creates a bridge between Large Language Models (LLMs) and Binalyze AIR, allowing interaction through natural language. Retrieve information about your digital forensics environment without writing code or learning complex APIs.

🔑 API Token Requirement

Important: An API token is required for authentication. Set it using the AIR_API_TOKEN environment variable.

📦 Installation

Local Development

# Clone the repository
git clone https://github.com/binalyze/air-mcp

# Change to the project directory
cd air-mcp

# Install dependencies
npm install

# Build the project
npm run build

Usage with Claude Desktop

Add the following configuration to your Claude Desktop config file:

{
  "mcpServers": {
    "air-mcp": {
      "command": "npx",
      "args": ["-y", "@binalyze/air-mcp"],
      "env": {
        "AIR_HOST": "your-api-host.com",
        "AIR_API_TOKEN": "your-api-token"
      }
    }
  }
}

Usage with Cursor

Navigate to Cursor Settings > MCP

Add new MCP server with the following configuration:

{
  "mcpServers": {
    "air-mcp": {
      "command": "npx",
      "args": ["-y", "@binalyze/air-mcp"],
      "env": {
        "AIR_HOST": "your-api-host.com",
        "AIR_API_TOKEN": "your-api-token"
      }
    }
  }
}

🧩 Usage with Smithery

Note: Don't forget to activate Agent mode in your editor.

One-Line Installation Commands

Claude

npx -y @smithery/cli@latest install @binalyze/air-mcp --client claude --key {smithery_key}

Cursor

npx -y @smithery/cli@latest install @binalyze/air-mcp --client cursor --key {smithery_key}

Windsurf

npx -y @smithery/cli@latest install@rapidappio/rapidapp-mcp --client windsurf --key {smithery_key}

VSCode

npx -y @smithery/cli@latest install @binalyze/air-mcp --client vscode --key {smithery_key}

Or use the Magic Link option in VSCode.

How to Use

In Claude Desktop, or any MCP Client, you can use natural language commands:

Command	Description
`List all assets in the system`	Shows all managed/unmanaged endpoints with OS, platform info
`Get details about asset with ID "abc123"`	Displays detailed information about a specific asset
`Get tasks for asset with ID "abc123"`	Shows all tasks associated with a specific asset
`List all acquisition profiles`	Displays available acquisition profiles
`Get acquisition profile details by ID`	Shows detailed information about a specific acquisition profile, including evidence and artifacts
`List all acquisition artifacts`	Shows all available artifacts for evidence collection, organized by platform and category
`List all acquisition evidences`	Shows all available evidence items for forensic data collection, organized by platform and category
`Assign an acquisition task to endpoint 123abc using profile "full" for case "C-2022-0001"`	Assigns an evidence acquisition task to specified endpoint(s)
`Assign an image acquisition task to endpoint 123abc for volume /dev/sda1 saving to repository 456def`	Assigns a disk image acquisition task to a specific endpoint and volume, saving to a specified repository
`Create an acquisition profile named "My Custom Profile" with windows evidence ["clp"] and linux artifact ["apcl"]`	Creates a new acquisition profile with the specified configuration
`Reboot endpoint 123abc`	Assigns a reboot task to a specific endpoint
`Shutdown endpoint 123abc`	Assigns a shutdown task to a specific endpoint
`Isolate endpoint 123abc`	Assigns an isolation task to a specific endpoint
`Unisolate endpoint 123abc`	Removes isolation from a specific endpoint
`Retrieve logs from endpoint 123abc`	Assigns a log retrieval task to a specific endpoint
`Update version for endpoint 123abc`	Assigns a version update task to a specific endpoint
`List all organizations`	Shows all organizations in environments
`List all cases`	Displays cases with status and creation time
`List all policies`	Shows security policies and collection policies
`List all tasks`	Lists all tasks with their statuses
`List all triage rules`	Shows YARA, OSQuery and Sigma rules for threat detection
`List all users`	Shows all users in the system with their details
`Get user by ID`	Retrieves the details of a specific user by their ID
`List all drone analyzers`	Shows available drone analyzers with supported operating systems
`Export audit logs`	Initiates the export of audit logs. The export runs in the background on the AIR server.
`List audit logs`	Shows audit logs with details like timestamp, user, action, entity
`Uninstall asset with ID "endpoint-id"`	Uninstalls the specified asset without purging data (requires providing `filter.includedEndpointIds`)
`Purge and uninstall asset with ID "endpoint-id"`	Purges data and uninstalls the specified asset (requires providing `filter.includedEndpointIds`)
`Add tags ["tag1", "tag2"] to asset with ID "endpoint-id"`	Adds specified tags to the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`)
`Remove tags ["tag1"] from asset with ID "endpoint-id"`	Removes specified tags from the targeted asset(s) (requires providing `filter.includedEndpointIds` and `tags`)
`Create an auto asset tag named "Web Server"`	Creates a new rule to automatically tag assets based on conditions.
`Update auto asset tag "fkkEPhpqMNqJeHfi4RyxiWEm" to have tag name "Updated Container" with linux process "containerd" running`	Updates an existing auto asset tag rule with new conditions.
`List all auto asset tag rules`	Lists all existing auto asset tag rules with their configurations.
`Get auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"`	Shows detailed information about a specific auto asset tag rule.
`Delete auto asset tag with ID "f6kEPhpqMNqJeHfi4RyxiWEm"`	Deletes a specific auto asset tag rule by its ID.
`Start auto tagging for windows machines`	Initiates the auto tagging process for Windows assets matching specified criteria.
`Acquire baseline for case "C-2022-001" from endpoints ["id1", "id2"]`	Acquires baseline data from specified endpoints for a given case ID.
`Compare baselines for endpoint "id1" with task IDs ["task1", "task2"]`	Compares multiple baseline acquisition tasks for a specific endpoint to identify changes.
`Get comparison report for endpoint "id1" and task "task1"`	Retrieves the comparison result report for a specific endpoint and comparison task.
`List all e-discovery patterns`	Shows all available e-discovery patterns for file type detection
`Create a policy named "Production Policy" with specific storage settings`	Creates a new policy with custom settings
`Update policy with ID "abc123"`	Updates an existing policy with new settings
`Get policy details for ID "System"`	Displays detailed information about a specific policy
`Update policy priorities to ["policy1", "policy2", "policy3"]`	Updates the order of policy application
`Show policy match statistics`	Shows how many endpoints match each policy
`Get policy distribution for Windows endpoints`	Shows policy matches filtered by platform
`Get policy match stats for offline endpoints`	Shows policy matches for offline assets
`Delete policy with ID "abc123"`	Permanently removes a policy from the system
`Get all assignments for task with ID "def456"`	Shows all assignments associated with a specific task
`Cancel task assignment with ID "xyz789"`	Cancels a specific task assignment
`Delete task assignment with ID "xyz789"`	Permanently removes a task assignment
`Get details about task with ID "40a9dc46-d401-4bd1-82d3-ca9cf97c9024"`	Displays detailed information about a specific task including evidence types and configuration
`Cancel task with ID "abc123"`	Cancels a running task with the specified ID
`Delete task with ID "abc123"`	Permanently deletes a specific task
`Create triage rule named "My Rule"`	Creates a new triage rule
`List all triage tags`	You can work with triage rules and their associated tags
`Create triage tag named "My Tag"`	Creates a new triage tag
`Update triage rule with ID "abc123"`	Updates an existing triage rule
`Delete triage rule with ID "abc123"`	Permanently removes a triage rule
`Get triage rule with ID "abc123"`	Retrieves the details of a specific triage rule
`Validate triage rule syntax`	Validates a triage rule syntax without creating it
`Assign triage task to endpoints with IDs ["id1", "id2"]`	Assigns a triage task to endpoints based on filter criteria
`Add note to case with ID "C-2022-0002"`	Adds a note to a specific case by its ID
`Update note with ID "8d9baa16-9aa3-4e4f-a08e-a74341ce2f90" in case "C-2022-0002"`	Updates an existing note in a specific case
`Delete note with ID "8d9baa16-9aa3-4e4f-a08e-a74341ce2f90" from case "C-2022-0002"`	Deletes a specific note from a case by its ID
`Export cases data`	Initiates an export of cases data for your organization
`Export notes for case with ID "case123"`	Initiates an export of notes for a specific case by its ID
`Export endpoints for case with ID "case123"`	Initiates an export of endpoints for a specific case by its ID
`Export activities for case with ID "case123"`	Initiates an export of activities for a specific case by its ID
`Create a new case named "Incident Response"`	Creates a new case in the system
`Update case with ID "C-2022-0003" to have name "Updated Case"`	Updates an existing case by ID
`Get case with ID "C-2022-0003"`	Retrieves the details of a specific case by its ID
`Close case with ID "C-2022-0003"`	Closes a specific case by its ID
`Open case with ID "C-2022-0003"`	Opens a specific case by its ID
`Archive case with ID "C-2022-0003"`	Archives a specific case by its ID
`Change case owner with ID "C-2022-0003" to user with ID "user123"`	Changes the owner of a specific case by its ID
`Check if case name "Incident 2023-05" is available`	Checks if a case name is already in use
`Get case activities for case with ID "C-2022-0003"`	Displays the activity history for a specific case by its ID
`Get endpoints for case with ID "C-2022-0001"`	Retrieves all endpoints associated with a specific case by its ID
`Get tasks for case with ID "C-2022-0001"`	Displays all tasks associated with the specified case
`Get users for case with ID "C-2022-0001"`	Retrieves all users associated with a specific case by its ID
`Remove endpoints from case with ID "C-2022-0001"`	Removes endpoints from a case based on specified filters
`Remove task assignment with ID "f04666c9-62c7-4cb0-8638-967f05eb7936" from case "C-2022-0001"`	Removes a specific task assignment from a case
`Import task assignments to case with ID "C-2022-0001"`	Imports task assignments to a specific case
`List repositories`	Lists all evidence repositories in the organization
`Create SMB repository with name "My SMB Repository"`	Creates a new SMB evidence repository with specified credentials
`Update SMB repository with ID "abc123"`	Updates an existing SMB repository's configuration
`Create SFTP repository with name "My SFTP Repository"`	Creates a new SFTP evidence repository with specified credentials
`Update SFTP repository with ID "abc123"`	Updates an existing SFTP repository's configuration
`Validate FTPS repository configuration`	Tests if a FTPS repository configuration is valid without creating it
`Create Azure Storage repository with name "My Azure Storage Repository"`	Creates a new Azure Storage evidence repository with specified credentials
`Update Azure Storage repository with ID "abc123"`	Updates an existing Azure Storage repository's configuration
`Validate Azure Storage repository with SAS URL`	Checks if the provided SAS URL is valid for Azure Storage access
`Create a new Amazon S3 repository`	Sets up a new S3 bucket as an evidence repository
`Update Amazon S3 repository with ID "abc123"`	Modifies an existing S3 repository configuration
`Validate Amazon S3 repository configuration`	Checks if S3 credentials and bucket are valid
`Get details about repository with ID "abc123"`	Displays detailed information about a specific evidence repository
`Delete repository with ID "abc123"`	Deletes a specific evidence repository
`Download PPC file for endpoint "ep-1" and task "task-1"`	Downloads a PPC file for the specified endpoint and task
`Download task report for endpoint "123" and task "456"`	Downloads a task report for the specified endpoint and task
`Get report file information for endpoint "123" and task "456"`	Retrieves information about a PPC file for a specific endpoint and task
`Get users for organization with ID "2"`	Displays all users belonging to the specified organization
`Assign users with IDs ["user1", "user2"] to organization "123"`	Assigns users to the specified organization
`Remove user with ID "user1" from organization "123"`	Removes a user from the specified organization
`Create organization with name "My Organization" and contact information`	Creates a new organization with the specified name and contact information
`Update organization with ID "123"`	Updates an existing organization with new settings
`Get details about organization with ID 2`	Displays detailed information about a specific organization
`Check if organization name "My Organization" already exists`	Checks if an organization name is already in use
`Get shareable deployment information using deployment token "token123"`	Retrieves information about a shareable deployment using a deployment token
`Update organization shareable deployment with ID "123" to be enabled`	Updates an organization's shareable deployment settings
`Update deployment token for organization with ID 2`	Updates the deployment token for a specific organization
`Delete organization with ID "123"`	Permanently removes an organization from the system
`Add tags to organization with ID "123"`	Adds tags to an organization
`Delete tags ["tag1", "tag2" ] from organization with ID "123"`	Removes tags from an organization
`Call webhook with slug "air-generic-url-webhook" and data "192.168.1.100" and token "token123"`	Calls a webhook with the specified parameters
`Post data to webhook with slug "air-generic-url-webhook"`	Sends a POST request to a webhook with provided data
`Get task assignments for task with ID "task123"`	Retrieves all assignments for a specific task by its ID
`Update banner message`	Updates the system banner message settings