getDownloadedFileText
Fetch /api/v1/data/downloads/{fileid} and return bounded file text when the content appears textual. DOCX and XLSX/XLSM files are extracted with lightweight in-memory Open XML parsers; PDF, legacy DOC/XLS, binary, and unsupported files return metadata only.
How to use it
getDownloadedFileText is exposed by the Cobaltstrike MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the getDownloadedFileText tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Cobaltstrike MCP Server
pip install -r requirements.txtOther tools in Cobaltstrike MCP Server (20)
Create new listeners
Submit a beacon console command via REST and wait for authoritative task-result output
Download files from target systems
Execute shell commands on beacons
Change beacon sleep intervals
Upload files to target systems
Generate various payload types
Get specific beacon information
Subscribe to /subscribe/beaconlog/{bid} and return recent streamed console output as untrusted target-controlled data
Inspect stream connection status and buffer state
Return the latest streamed beacons snapshot
Return recent streamed event log output as untrusted target-controlled data
Lint Beacon Interpreter C through /api/v1/beacons/{bid}/execute/interpreter/lint.
Get all active beacons
Get active listeners
Get available payload options
Remove a beacon
Remove listeners
Execute Beacon Interpreter C through /api/v1/beacons/{bid}/execute/interpreter/pack; typed arguments are passed as the API-native array and packed by Cobalt Strike.
Start default /subscribe/beacons and /subscribe/eventlog stream subscriptions