artifact
(required): Name of the Velociraptor artifact to collect
How to use it
artifact is exposed by the Velociraptor MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the artifact tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Velociraptor MCP Server
pip install git+https://github.com/socfortress/velociraptor-mcp-server.gitOther tools in Velociraptor MCP Server (11)
(required): Name of the artifact to get details for
(required): Velociraptor client ID to target for collection
(optional): Comma-separated string of fields to return (default: '')
(required): Flow ID returned from the initial collection
(required): Hostname or FQDN of the client to search for
(optional): Number of times to retry if the flow hasn't finished (default: 5)
(optional): Maximum number of rows to return
(optional): Comma-separated string of key='value' pairs to pass to the artifact
(optional): Time in seconds to wait between retries (default: 5)
(optional): Query timeout in seconds
(required): VQL query string to execute