// SCAN REPORT

Velociraptor MCP Server

78 tools. 12 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 30 Jun 2026

12 can modify or destroy data

66 read-only

78 tools total

Community server · catalogue entry verified 30/06/2026

How to control Velociraptor MCP Server ↓

TOOL MAP

What Velociraptor MCP Server exposes to your agents

Read (66) Write / Execute (11) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Velociraptor MCP Server tools

Destructive · Critical quarantine_host Quarantining a host is a severe, potentially irreversible network isolation action that cuts off a machine from the network. Execute · High macos_launch_agents Launch agents on macOS are executable items that run at startup or on-demand. Execute · High run_vql VQL is Velociraptor's query language capable of running arbitrary forensic queries and operations on target systems. Execute · High collect_artifact In Velociraptor, collecting an artifact means remotely executing a VQL query or forensic collection task on one or more endpoints.

12 of Velociraptor MCP Server's 78 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Velociraptor MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Velociraptor MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "quarantine_host": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "unquarantine_host": {
    "limits": [
      {
        "counter": "unquarantine_host_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "client_info": {
    "limits": [
      {
        "counter": "client_info_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Velociraptor MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON VELOCIRAPTOR →

Instant setup, no code required.

FULL CATALOGUE

All 78 Velociraptor MCP Server tools

DESTRUCTIVE 1 tools

Destructive quarantine_host quarantine_host

EXECUTE 10 tools

Execute collect_artifact collect_artifact Execute collect_forensic_triage collect_forensic_triage Execute hunt_across_fleet hunt_across_fleet Execute linux_yara_scan linux_yara_scan Execute macos_launch_agents macos_launch_agents Execute run_vql run_vql Execute windows_malfind windows_malfind Execute windows_powershell_scriptblock windows_powershell_scriptblock Execute yara_scan_files yara_scan_files Execute yara_scan_process yara_scan_process

WRITE 1 tools

Write unquarantine_host Remove quarantine (network isolation) from a Windows host.

READ 66 tools

Read client_info Retrieve client information from the Velociraptor server. Read collect_file collect_file Read get_collection_results get_collection_results Read get_hunt_results_tool get_hunt_results_tool Read kill_process kill_process Read linux_arp_cache linux_arp_cache Read linux_bash_history linux_bash_history Read linux_crontab linux_crontab Read linux_file_finder linux_file_finder Read linux_groups List groups on a Linux host. Read linux_journal_logs linux_journal_logs Read linux_last_user_login linux_last_user_login Read linux_mounts List mounts on a Linux host. Read linux_netstat_enriched linux_netstat_enriched Read linux_pslist linux_pslist Read linux_services linux_services Read linux_ssh_authorized_keys linux_ssh_authorized_keys Read linux_ssh_logins linux_ssh_logins Read linux_users List users on a Linux host. Read list_clients list_clients Read list_linux_artifacts Finds Availible Linux artifacts. Read list_macos_artifacts Finds available macOS artifacts on the Velociraptor server. Read list_windows_artifacts Finds Availible Windows artifacts. Read macos_bash_history macos_bash_history Read macos_browser_history macos_browser_history Read macos_file_finder macos_file_finder Read macos_login_items macos_login_items Read macos_netstat List network connections on a macOS host with process metadata. Read macos_pslist List running processes on a macOS host. Read macos_quarantine_events macos_quarantine_events Read macos_tcc_database macos_tcc_database Read macos_users List user accounts on a macOS host. Read windows_autoruns windows_autoruns Read windows_browser_history windows_browser_history Read windows_dns_cache windows_dns_cache Read windows_event_log_cleared windows_event_log_cleared Read windows_event_logs windows_event_logs Read windows_evidence_of_download Collect evidence of download from a Windows host. Read windows_execution_activitiesCache windows_execution_activitiesCache Read windows_execution_amcache Collect evidence of execution from Amcache on a Windows host. Read windows_execution_bam windows_execution_bam Read windows_execution_prefetch Parse Prefetch files on a Windows host to identify previously executed programs. Read windows_execution_shimcache windows_execution_shimcache Read windows_execution_userassist Extract evidence of execution from UserAssist registry keys. Read windows_hash_search windows_hash_search Read windows_logon_events windows_logon_events Read windows_mounted_mass_storage_usb Collect evidence of mounted mass storage from Registry on a Windows host. Read windows_mountpoints2 windows_mountpoints2 Read windows_mutants windows_mutants Read windows_netstat_enriched windows_netstat_enriched Read windows_ntfs_mft windows_ntfs_mft Read windows_ntfs_mft_search windows_ntfs_mft_search Read windows_powershell_history windows_powershell_history Read windows_process_memory_strings windows_process_memory_strings Read windows_pslist windows_pslist Read windows_rdp_sessions windows_rdp_sessions Read windows_recentdocs Collect RecentDocs from Registry on a Windows host. Read windows_recycle_bin windows_recycle_bin Read windows_scheduled_tasks List scheduled tasks (persistance) with metadata on a Windows host Read windows_services List services with metadata on a Windows host. Read windows_shadow_copies windows_shadow_copies Read windows_shellbags Collect Shellbags from Registry on a Windows host. Read windows_srum windows_srum Read windows_timestomp windows_timestomp Read windows_usn_journal windows_usn_journal Read windows_wmi_persistence windows_wmi_persistence

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Velociraptor MCP Server

Can an AI agent delete data through the Velociraptor MCP Server MCP server? +

Yes. The Velociraptor MCP Server server exposes 1 destructive tools including quarantine_host. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Velociraptor MCP Server? +

The Velociraptor MCP Server server has 1 write tools including unquarantine_host. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Velociraptor MCP Server.

How many tools does the Velociraptor MCP Server MCP server expose? +

78 tools across 4 categories: Destructive, Execute, Read, Write. 66 are read-only. 12 can modify, create, or delete data.

How do I enforce a policy on Velociraptor MCP Server? +

Register the Velociraptor MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Velociraptor MCP Server tool call.

Deterministic rules across all 78 Velociraptor MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON VELOCIRAPTOR →

Instant setup, no code required.

78 Velociraptor MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.