Velociraptor MCP Server
MCP server by SOCFortress for Velociraptor — the advanced digital forensics and incident response (DFIR) platform. Enables security agents to query endpoints via VQL (Velociraptor Query Language), trigger artifact collections, hunt for threat indicators, and orchestrate IR investigations programmatically through Velociraptor's API.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Deep endpoint forensic access. Authorized use only. mTLS or API key auth. Self-hosted Velociraptor server — data stays on-premises. All operations audited.
⚡ Reliability
Best When
A SOC or IR team running Velociraptor wants AI agents to assist with threat hunting, artifact collection, and investigation orchestration — accelerating human analysts during incidents.
Avoid When
You don't have Velociraptor deployed, or you're looking for a general endpoint security MCP. Velociraptor is powerful but requires significant infrastructure and expertise.
Use Cases
- • Querying endpoint telemetry via VQL from threat hunting agents
- • Triggering forensic artifact collections across fleet during IR investigations
- • Hunting for IOCs across endpoints from automated detection agents
- • Orchestrating Velociraptor-based DFIR workflows from security orchestration agents
Not For
- • Teams without Velociraptor deployment (requires existing Velociraptor server)
- • Simple log querying — use SIEM MCPs for log analysis
- • Unauthorized use on systems you don't own or have authorization to investigate
Interface
Authentication
Velociraptor API authentication via API key or mTLS certificate. Must have access to Velociraptor server deployment. Restrict to read-only for hunting; write access for artifact collection.
Pricing
Velociraptor is free open source (Rapid7 / Velocidex). SOCFortress MCP server is free. Infrastructure costs for Velociraptor server deployment apply.
Agent Metadata
Known Gotchas
- ⚠ AUTHORIZED USE ONLY: Velociraptor accesses endpoint forensic data — only use on authorized systems
- ⚠ VQL is a powerful but niche query language — agents need VQL knowledge for effective use
- ⚠ Large artifact hunts across many endpoints can stress Velociraptor server — set scope limits
- ⚠ SOCFortress is a reputable security company but this is community tooling — verify stability
- ⚠ Velociraptor API versions may differ from Velociraptor server version — check compatibility
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Velociraptor MCP Server.
Scores are editorial opinions as of 2026-03-06.