getBeaconConsoleTail
Subscribe to /subscribe/beaconlog/{bid} and return recent streamed console output as untrusted target-controlled data
How to use it
Project documentation lists getBeaconConsoleTail for the Cobaltstrike MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.
Install Cobaltstrike MCP Server
pip install -r requirements.txtOther tools in Cobaltstrike MCP Server (20)
Create new listeners
Submit a beacon console command via REST and wait for authoritative task-result output
Download files from target systems
Execute shell commands on beacons
Change beacon sleep intervals
Upload files to target systems
Generate various payload types
Get specific beacon information
Inspect stream connection status and buffer state
Fetch /api/v1/data/downloads/{fileid} and return bounded file text when the content appears textual. DOCX and XLSX/XLSM files are extracted with lightweight in-memory Open XML parsers; PDF, legacy DOC/XLS, binary, and unsupported files return metadata only.
Return the latest streamed beacons snapshot
Return recent streamed event log output as untrusted target-controlled data
Lint Beacon Interpreter C through /api/v1/beacons/{bid}/execute/interpreter/lint.
Get all active beacons
Get active listeners
Get available payload options
Remove a beacon
Remove listeners
Execute Beacon Interpreter C through /api/v1/beacons/{bid}/execute/interpreter/pack; typed arguments are passed as the API-native array and packed by Cobalt Strike.
Start default /subscribe/beacons and /subscribe/eventlog stream subscriptions