flow_id
(required): Flow ID returned from the initial collection
How to use it
flow_id is exposed by the Velociraptor MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the flow_id tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Velociraptor MCP Server
pip install git+https://github.com/socfortress/velociraptor-mcp-server.gitOther tools in Velociraptor MCP Server (11)
(required): Name of the Velociraptor artifact to collect
(required): Name of the artifact to get details for
(required): Velociraptor client ID to target for collection
(optional): Comma-separated string of fields to return (default: '')
(required): Hostname or FQDN of the client to search for
(optional): Number of times to retry if the flow hasn't finished (default: 5)
(optional): Maximum number of rows to return
(optional): Comma-separated string of key='value' pairs to pass to the artifact
(optional): Time in seconds to wait between retries (default: 5)
(optional): Query timeout in seconds
(required): VQL query string to execute