Binalyze AIR MCP Server

What is Binalyze AIR MCP Server?

A Node.js server implementing the Model Context Protocol (MCP) for Binalyze AIR, enabling natural language interaction with AIR's digital forensics and incident response capabilities. It bridges Large Language Models (LLMs) with the Binalyze AIR platform, allowing users to manage assets, cases, tasks, and more without writing code or learning complex APIs.

How to use Binalyze AIR MCP Server?

Install via npm (npm install @binalyze/air-mcp) or use npx -y @binalyze/air-mcp in an MCP client like Claude Desktop or Cursor. Configure AIR_HOST (your API host) and AIR_API_TOKEN environment variables, then issue natural language commands such as "List all assets in the system" or "Assign an acquisition task to endpoint 123abc."

Key features of Binalyze AIR MCP Server

• Asset management with details and tasks
• Evidence acquisition and baseline comparison
• Case creation, notes, and lifecycle management
• Policy and triage rule management
• Evidence repository configuration (SMB, SFTP, FTPS, Azure, S3)
• User and organization administration

Use cases of Binalyze AIR MCP Server

• Security analysts querying asset inventory and task statuses via chat
• Incident responders assigning forensics collection tasks by voice or text
• SOC teams managing cases, evidence repositories, and isolation actions
• Administrators automating user, organization, and policy updates
• Threat hunters validating triage rules and reviewing audit logs