Velociraptor MCP
A proof-of-concept Model Context Protocol bridge that lets an LLM query a Velociraptor digital-forensics deployment in natural language, such as checking a named machine for suspicious processes.
This bridge exposes an initial set of Windows-oriented triage tools to an LLM through MCP, so a query such as asking for all network connections on a named machine and any suspicious processes can be answered directly against a live Velociraptor server. It connects using a Velociraptor API client configuration file, with settings for choosing an organization context in multi-tenant deployments and for logging raw VQL requests when debugging.
A set of more dangerous tools, including raw VQL execution, quarantine and remote process kill, stays disabled unless explicitly turned on through an environment variable. The bundled agent proof of concept defaults to summarizing results with a local Ollama model, with optional configuration to use Azure OpenAI instead.