FastMCP server that exposes Velociraptor APIs.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"velociraptor-mcp-server","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Velociraptor MCP Server ## Quickstart - Install the published package: `python3 -m venv .venv && . .venv/bin/activate && pip install velociraptor-mcp-server` - Run (needs mTLS config): `velociraptor-mcp --config /absolute/path/to/velociraptor_lab/volumes/api/api.config.yaml` - Codex one-liner (installed package): ```sh codex mcp add velociraptor \ --env VELOCIRAPTOR_API_CONFIG=/absolute/path/to/velociraptor_lab/volumes/api/api.config.yaml \ -- velociraptor-mcp --config /absolute/path/to/velociraptor_lab/volumes/api/api.config.yaml \ --log-level INFO --server-name velociraptor-mcp ``` A FastMCP-based server that exposes Velociraptor capabilities (VQL queries, hunts, artifacts, VFS/file ops, monitoring, alerts) over the MCP protocol for use with Codex/ChatGPT-style agents. ## Prerequisites - Python 3.10+ - Podman (or Docker) if you want to use the included `velociraptor_lab` for local testing. - Generated Velociraptor mTLS API config (`api.config.yaml`) – the lab can generate this for you. ## Install / Develop - From PyPI: `pip install velociraptor-mcp-server` - Runtime (source): `pip install .` - Dev/editable: `pip install -e .[dev]` - Legacy: `pip install -r requirements.txt` - Pre-commit: `pre-commit install` then `pre-commit run --all-files` Make targets (see `Makefile`): `make dev`, `make test`, `make build`, `make health`, `make release VERSION=0.1.6`. ## Running the MCP server After installing, you can either call the module directly or use the installed console script: ```sh # installed entry point velociraptor-mcp --config velociraptor_lab/volumes/api/api.config.yaml \ --log-level INFO --server-name velociraptor-mcp # or, from source python3 main.py --config velociraptor_lab/volumes/api/api.config.yaml \ --log-level INFO --server-name velociraptor-mcp ``` Options: - `--config` or env `VELOCIRAPTOR_API_CONFIG`: path to `api.config.yaml` (default `volumes/api/api.config.yaml`) - `--log-level` or env `MCP_LOG_LEVEL` (default `INFO…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.