概览
What is Binalyze AIR MCP Server?
A Node.js server implementing the Model Context Protocol (MCP) for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities. It bridges Large Language Models (LLMs) with the Binalyze AIR platform, allowing users to manage assets, cases, tasks, and more without writing code or learning complex APIs.
How to use Binalyze AIR MCP Server?
Install via npm (npm install @binalyze/air-mcp) or use npx -y @binalyze/air-mcp in an MCP client like Claude Desktop or Cursor. Configure AIR_HOST (your API host) and AIR_API_TOKEN environment variables, then issue natural language commands such as "List all assets in the system" or "Assign an acquisition task to endpoint 123abc."
Key features of Binalyze AIR MCP Server
- Asset management with details and tasks
- Evidence acquisition and baseline comparison
- Case creation, notes, and lifecycle management
- Policy and triage rule management
- Evidence repository configuration (SMB, SFTP, FTPS, Azure, S3)
- User and organization administration
Use cases of Binalyze AIR MCP Server
- Security analysts querying asset inventory and task statuses via chat
- Incident responders assigning forensics collection tasks by voice or text
- SOC teams managing cases, evidence repositories, and isolation actions
- Administrators automating user, organization, and policy updates
- Threat hunters validating triage rules and reviewing audit logs
FAQ from Binalyze AIR MCP Server
What authentication is required?
An API token set via the AIR_API_TOKEN environment variable. The server uses this for all Binalyze AIR API calls.
Which runtime does it require?
Node.js 18 or later (as indicated by the badge).
Can I use it with Claude Desktop or Cursor?
Yes, configuration examples for both are provided in the README, using npx and environment variables.
What does this server do that direct API usage does not?
It translates natural language commands into API calls, removing the need to manually construct HTTP requests or parse JSON responses.
Is there any limitation on the number of assets or tasks?
The README does not mention any built-in limits; these would depend on the Binalyze AIR instance and API token permissions.
