MCP server intelligence profile

Binalyze AIR MCP Server

A Node.js server implementing Model Context Protocol (MCP) that enables natural language interaction with Binalyze AIR's digital forensics and incident response capabilities

Local OnlyOfficial distributionbinalyze

1Distribution channel

116Independently observed tools

0Linked remote endpoints

AvailableVersion intelligence

Install and connect

Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.

Install @binalyze/air-mcp from npm

Version 12.4.1 declares 1 executable entrypoint.

npm install --save-exact @binalyze/air-mcp@12.4.1

npx -y -p @binalyze/air-mcp@12.4.1 @binalyze/air-mcp

MCP client configuration example

{
  "mcpServers": {
    "@binalyze/air-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "@binalyze/air-mcp@12.4.1",
        "@binalyze/air-mcp"
      ]
    }
  }
}

Identity

Canonical slug	`binalyze-air-mcp-server-c1437cd2`	Deployment	Local Only
Canonical package	npm:@binalyze/air-mcp	Repository	binalyze/air-mcp
First published	—	Latest release	—
Last security verification	—	Classification confidence	90%
Publication	Published	Official distribution	Yes

Distributions

Channel	Identifier	Current version	Versions	Source
npm	@binalyze/air-mcp	`12.4.1`	1	Repository

Current release

Package	Version	Published / observed	Inventory	Security scan
npm@binalyze/air-mcp	`12.4.1`Current	Sep 5, 2026	116 toolsSucceeded · 0 resources · 0 prompts	Failed

Enterprise protection

Continuously monitor this MCP for security risk

Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.

Independent exact-version security scans
Continuous release and vulnerability monitoring
Risk-change alerts with capability context
Historical evidence and API exports

Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.

Current version evidence

Provenance	artifact_hash_verified	Signature	—
MCP SDK	@modelcontextprotocol/sdk	Artifact SHA-256	`cea5d9004f28dbb0fd46f5c304c1bd0995b48ca920f43d1281c07d9761cf0d7b`
Scanner	mcp-proof-engine 0.1.0	Scan completed	Aug 24, 2026
Security rating	41 / 100	Methodology	version-rating-1.0

Executable entrypoints

[
  "@binalyze/air-mcp"
]

Rating reasons

[
  "security_policy_not_observed"
]

Current protocol inventory

2025-06-18Negotiated protocol

air-mcpServer-reported name

1Capability groups

Aug 24, 2026Observed

Tools 116

Tool	Category	Risk
acquire_baselineAssign a baseline acquisition task to specific endpoints Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The case ID to associate the baseline acquisition with" }, "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term" }, "name": { "type": "string", "description": "Filter by asset name" }, "ipAddress": { "type": "string", "description": "Filter by IP address" }, "groupId": { "type": "string", "description": "Filter by group ID" }, "groupFullPath": { "type": "string", "description": "Filter by full group path" }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])" }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])" }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])" }, "issue": { "type": "string", "description": "Filter by issue" }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Filter by tags" }, "version": { "type": "string", "description": "Filter by agent version" }, "policy": { "type": "string", "description": "Filter by policy" }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to include for baseline acquisition" }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs filter. Defaults to [0]" } }, "description": "Filter object to specify which assets to acquire baseline from" } }, "required": [ "caseId", "filter" ] }	—	—
add_note_to_caseAdd a note to a specific case by its ID Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case to add a note to (e.g., \"C-2022-0002\")" }, "note": { "type": "string", "description": "The content of the note to add to the case" } }, "required": [ "caseId", "note" ] }	—	—
add_tags_to_assetsAdd tags to specific assets based on filters. Requires specifying `filter.includedEndpointIds` and `tags`. Input schema { "type": "object", "properties": { "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term." }, "name": { "type": "string", "description": "Filter by asset name." }, "ipAddress": { "type": "string", "description": "Filter by IP address." }, "groupId": { "type": "string", "description": "Filter by group ID." }, "groupFullPath": { "type": "string", "description": "Filter by full group path." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])." }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])." }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])." }, "issue": { "type": "string", "description": "Filter by issue." }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])." }, "tagId": { "type": "string", "description": "Filter by existing tag ID." }, "version": { "type": "string", "description": "Filter by agent version." }, "policy": { "type": "string", "description": "Filter by policy." }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "REQUIRED: Array of endpoint IDs to add tags to." }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude." }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter. Defaults to [0]." } }, "required": [ "includedEndpointIds" ], "description": "Filter object to specify which assets to add tags to." }, "tags": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "REQUIRED: Array of tags to add to the selected assets." } }, "required": [ "filter", "tags" ] }	—	—
add_tags_to_organizationAdd tags to an organization Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "ID of the organization to add tags to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Array of tags to add to the organization" } }, "required": [ "id", "tags" ] }	—	—
archive_case_by_idArchive a case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to archive" } }, "required": [ "id" ] }	—	—
assign_acquisition_taskAssign an evidence acquisition task to specific endpoints Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The case ID to associate the acquisition with" }, "acquisitionProfileId": { "type": "string", "description": "The acquisition profile ID to use for the task" }, "endpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to collect evidence from" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Array of organization IDs to filter by. Defaults to [0]" }, "analyzers": { "type": "array", "items": { "type": "string" }, "description": "Array of analyzer IDs to use (e.g. [\"bha\", \"wsa\"])" }, "keywords": { "type": "array", "items": { "type": "string" }, "description": "Array of keywords to search for" }, "cpuLimit": { "type": "number", "description": "CPU usage limit percentage (1-100). Defaults to 80" }, "enableCompression": { "type": "boolean", "description": "Whether to enable compression. Defaults to true" }, "enableEncryption": { "type": "boolean", "description": "Whether to enable encryption. Defaults to false" }, "encryptionPassword": { "type": "string", "description": "Password for encryption if enabled" } }, "required": [ "caseId", "acquisitionProfileId", "endpointIds" ] }	—	—
assign_image_acquisition_taskAssign a disk image acquisition task to specific endpoints and volumes Input schema { "type": "object", "properties": { "caseId": { "type": [ "string", "null" ], "description": "The case ID to associate the acquisition with (optional)" }, "repositoryId": { "type": "string", "description": "The repository ID where the image will be saved" }, "endpoints": { "type": "array", "items": { "type": "object", "properties": { "endpointId": { "type": "string" }, "volumes": { "type": "array", "items": { "type": "string" } } }, "required": [ "endpointId", "volumes" ] }, "description": "Array of endpoints and volumes to image (e.g., [{\"endpointId\": \"uuid\", \"volumes\": [\"/dev/sda1\"]}]). At least one endpoint and one volume per endpoint required." }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Array of organization IDs. Defaults to [0]" }, "bandwidthLimit": { "type": "number", "description": "Bandwidth limit in KB/s. Defaults to 100000" }, "enableCompression": { "type": "boolean", "description": "Whether to enable compression. Defaults to true" }, "enableEncryption": { "type": "boolean", "description": "Whether to enable encryption. Defaults to false" }, "encryptionPassword": { "type": "string", "description": "Password for encryption if enabled" }, "chunkSize": { "type": "number", "description": "Chunk size in bytes. Defaults to 1048576" }, "chunkCount": { "type": "number", "description": "Number of chunks to acquire. Defaults to 0 (acquire until end)." }, "startOffset": { "type": "number", "description": "Offset in bytes to start acquisition from. Defaults to 0." } }, "required": [ "repositoryId", "endpoints" ] }	—	—
assign_isolation_taskAssign an isolation task to specific endpoints Input schema { "type": "object", "properties": { "endpointIds": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Endpoint ID(s) to isolate or unisolate. Can be a single ID or an array of IDs." }, "enabled": { "type": "boolean", "description": "Whether to enable (isolate) or disable (unisolate) isolation. Defaults to true." }, "organizationIds": { "oneOf": [ { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] } } ], "description": "Organization ID(s) to filter endpoints by. Defaults to 0." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter endpoints by managed status. Default is [\"managed\"]." } }, "required": [ "endpointIds" ] }	—	—
assign_log_retrieval_taskAssign a log retrieval task to specific endpoints Input schema { "type": "object", "properties": { "endpointIds": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Endpoint ID(s) to retrieve logs from. Can be a single ID or an array of IDs." }, "organizationIds": { "oneOf": [ { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] } } ], "description": "Organization ID(s) to filter endpoints by. This is REQUIRED to identify the correct endpoints. Examples: 0, \"123\", [0], [\"123\", \"456\"]" }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter endpoints by managed status. Default is [\"managed\"]." } }, "required": [ "endpointIds", "organizationIds" ] }	—	—
assign_reboot_taskAssign a reboot task to specific endpoints Input schema { "type": "object", "properties": { "endpointIds": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Endpoint ID(s) to reboot. Can be a single ID or an array of IDs." }, "organizationIds": { "oneOf": [ { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] } } ], "description": "Organization ID(s) to filter endpoints by. Defaults to 0." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter endpoints by managed status. Default is [\"managed\"]." } }, "required": [ "endpointIds" ] }	—	—
assign_shutdown_taskAssign a shutdown task to specific endpoints Input schema { "type": "object", "properties": { "endpointIds": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Endpoint ID(s) to shutdown. Can be a single ID or an array of IDs." }, "organizationIds": { "oneOf": [ { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] } } ], "description": "Organization ID(s) to filter endpoints by. Defaults to 0." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter endpoints by managed status. Default is [\"managed\"]." } }, "required": [ "endpointIds" ] }	—	—
assign_triage_taskAssign a triage task to endpoints based on filter criteria Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "Case ID for the triage task" }, "triageRuleIds": { "type": "array", "items": { "type": "string" }, "description": "Array of triage rule IDs to apply" }, "taskConfig": { "type": "object", "properties": { "choice": { "type": "string", "description": "Configuration choice, e.g., \"use-custom-options\"" } }, "required": [ "choice" ], "description": "Task configuration options" }, "mitreAttack": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable MITRE ATT&CK framework" } }, "required": [ "enabled" ], "description": "MITRE ATT&CK configuration" }, "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term" }, "name": { "type": "string", "description": "Filter by asset name" }, "ipAddress": { "type": "string", "description": "Filter by IP address" }, "groupId": { "type": "string", "description": "Filter by group ID" }, "groupFullPath": { "type": "string", "description": "Filter by full group path" }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])" }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status" }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])" }, "issue": { "type": "string", "description": "Filter by issue" }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Filter by tags" }, "version": { "type": "string", "description": "Filter by agent version" }, "policy": { "type": "string", "description": "Filter by policy" }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to include" }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude" }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter" } }, "description": "Filter criteria for selecting endpoints" } }, "required": [ "caseId", "triageRuleIds", "taskConfig", "mitreAttack", "filter" ] }	—	—
assign_users_to_organizationAssign users to a specific organization Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the organization to assign users to" }, "userIds": { "type": "array", "items": { "type": "string" }, "description": "Array of user IDs to assign to the organization" } }, "required": [ "id", "userIds" ] }	—	—
assign_version_update_taskAssign a version update task to specific endpoints Input schema { "type": "object", "properties": { "endpointIds": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Endpoint ID(s) to update version. Can be a single ID or an array of IDs." }, "organizationIds": { "oneOf": [ { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] } } ], "description": "Organization ID(s) to filter endpoints by. Defaults to 0." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter endpoints by managed status. Default is [\"managed\"]." } }, "required": [ "endpointIds" ] }	—	—
call_webhookCall a webhook with the specified parameters Input schema { "type": "object", "properties": { "slug": { "type": "string", "description": "The webhook slug (e.g., \"air-generic-url-webhook\")" }, "data": { "type": "string", "description": "The data parameter for the webhook (e.g., IP address like \"192.168.1.100\")" }, "token": { "type": "string", "description": "The webhook token for authentication" } }, "required": [ "slug", "data", "token" ] }	—	—
cancel_task_assignmentCancel a task assignment by its ID Input schema { "type": "object", "properties": { "assignmentId": { "type": "string", "description": "The ID of the task assignment to cancel" } }, "required": [ "assignmentId" ] }	—	—
cancel_task_by_idCancel a specific task by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the task to cancel" } }, "required": [ "id" ] }	—	—
change_case_ownerChange the owner of a case Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the case to change owner for" }, "newOwnerId": { "type": "string", "description": "User ID of the new owner" } }, "required": [ "id", "newOwnerId" ] }	—	—
check_case_nameCheck if a case name is already in use Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "The case name to check for availability" } }, "required": [ "name" ] }	—	—
check_organization_name_existsCheck if an organization name already exists in the system Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the organization to check" } }, "required": [ "name" ] }	—	—
close_case_by_idClose a case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to close" } }, "required": [ "id" ] }	—	—
compare_baselineCompare baseline acquisition tasks for a specific endpoint Input schema { "type": "object", "properties": { "endpointId": { "type": "string", "description": "The endpoint ID to compare baselines for" }, "taskIds": { "type": "array", "items": { "type": "string" }, "description": "Array of baseline task IDs to compare (minimum 2)" } }, "required": [ "endpointId", "taskIds" ] }	—	—
create_acquisition_profileCreate a new acquisition profile Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the new acquisition profile" }, "organizationIds": { "type": "array", "items": { "type": "string" }, "description": "Organization IDs to associate the profile with. Defaults to empty array." }, "windows": { "type": "object", "description": "Windows specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"evt\"], \"artifactList\": [], \"customContentProfiles\": [], \"networkCapture\": { \"enabled\": false, \"duration\": 600, \"pcap\": { \"enabled\": false }, \"networkFlow\": { \"enabled\": false } } }" }, "linux": { "type": "object", "description": "Linux specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"logs\"], ... }" }, "macos": { "type": "object", "description": "macOS specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"logs\"], ... }" }, "aix": { "type": "object", "description": "AIX specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), and `customContentProfiles` (array). Example: { \"evidenceList\": [\"logs\"], ... }" }, "eDiscovery": { "type": "object", "description": "eDiscovery configuration. Must include the key `patterns` (array of objects with `pattern` and `category` strings). Example: { \"patterns\": [] }" } }, "required": [ "name", "windows", "linux", "macos", "aix", "eDiscovery" ] }	—	—
create_amazon_s3_repositoryCreate a new Amazon S3 repository for evidence storage Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the Amazon S3 repository" }, "region": { "type": "string", "description": "AWS region (e.g. eu-west-1)" }, "bucket": { "type": "string", "description": "S3 bucket name" }, "accessKeyId": { "type": "string", "description": "AWS access key ID" }, "secretAccessKey": { "type": "string", "description": "AWS secret access key" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "name", "region", "bucket", "accessKeyId", "secretAccessKey" ] }	—	—
create_auto_asset_tagCreate a new rule to automatically tag assets based on specified conditions for Linux, Windows, and macOS. Input schema { "type": "object", "properties": { "tag": { "type": "string", "description": "The tag name to be applied automatically." }, "linuxConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for Linux assets." }, "windowsConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for Windows assets." }, "macosConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for macOS assets." } }, "required": [ "tag", "linuxConditions", "windowsConditions", "macosConditions" ], "definitions": { "ConditionGroup": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "or" ], "description": "Logical operator for combining conditions." }, "conditions": { "type": "array", "items": { "oneOf": [ { "$ref": "#/definitions/Condition" }, { "$ref": "#/definitions/ConditionGroup" } ] }, "minItems": 1, "description": "Array of conditions or nested groups." } }, "required": [ "operator", "conditions" ] }, "Condition": { "type": "object", "properties": { "field": { "type": "string", "description": "Field to check (e.g., \"process\")" }, "operator": { "type": "string", "description": "Comparison operator (e.g., \"running\")" }, "value": { "type": "string", "description": "Value to compare against" } }, "required": [ "field", "operator", "value" ] } } }	—	—
create_azure_storage_repositoryCreate a new Azure Storage repository Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the Azure Storage repository" }, "SASUrl": { "type": "string", "description": "SAS URL for Azure Storage access" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "name", "SASUrl" ] }	—	—
create_caseCreate a new case in the system Input schema { "type": "object", "properties": { "organizationId": { "type": "number", "description": "Organization ID to create the case in. Defaults to 0." }, "name": { "type": "string", "description": "Name of the case" }, "ownerUserId": { "type": "string", "description": "User ID of the case owner" }, "visibility": { "type": "string", "description": "Visibility of the case. Defaults to \"public-to-organization\"" }, "assignedUserIds": { "type": "array", "items": { "type": "string" }, "description": "Array of user IDs to assign to the case. Defaults to empty array." } }, "required": [ "name", "ownerUserId" ] }	—	—
create_ftps_repositoryCreate a new FTPS evidence repository Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the FTPS repository" }, "host": { "type": "string", "description": "FTPS server hostname or IP address" }, "port": { "type": "number", "description": "FTPS server port (default: 22)" }, "path": { "type": "string", "description": "Path on the FTPS server (e.g. /)" }, "username": { "type": "string", "description": "Username for FTPS authentication" }, "password": { "type": "string", "description": "Password for FTPS authentication" }, "allowSelfSignedSSL": { "type": "boolean", "description": "Whether to allow self-signed SSL certificates" }, "publicKey": { "type": "string", "description": "Public key for FTPS authentication (optional)" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with" } }, "required": [ "name", "host", "path", "username", "password" ] }	—	—
create_organizationCreate a new organization Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the organization" }, "shareableDeploymentEnabled": { "type": "boolean", "description": "Whether shareable deployment is enabled. Defaults to false." }, "contact": { "type": "object", "properties": { "name": { "type": "string", "description": "Contact name" }, "title": { "type": "string", "description": "Contact title (optional)" }, "phone": { "type": "string", "description": "Contact phone number (optional)" }, "mobile": { "type": "string", "description": "Contact mobile number (optional)" }, "email": { "type": "string", "description": "Contact email address" } }, "required": [ "name", "email" ], "description": "Contact information for the organization" }, "note": { "type": "string", "description": "Additional notes about the organization (optional)" } }, "required": [ "name", "contact" ] }	—	—
create_policyCreate a new policy with specific storage and compression settings Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the new policy" }, "organizationIds": { "oneOf": [ { "type": "array", "items": { "type": "number" } }, { "type": "array", "items": { "type": "string" } }, { "type": "number" }, { "type": "string" } ], "description": "Organization IDs to associate with policy. Defaults to [0]." }, "saveTo": { "type": "object", "properties": { "windows": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for Windows (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on Windows" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for Windows (e.g., \"C:\")" }, "tmp": { "type": "string", "description": "Temporary folder path for Windows" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] }, "linux": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for Linux (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on Linux" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for Linux (e.g., \"/\")" }, "tmp": { "type": "string", "description": "Temporary folder path for Linux" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] }, "macos": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for macOS (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on macOS" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for macOS (e.g., \"/\")" }, "tmp": { "type": "string", "description": "Temporary folder path for macOS" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] } }, "required": [ "windows", "linux", "macos" ], "description": "Configuration for where to save evidence" }, "compression": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether compression is enabled" }, "encryption": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether encryption is enabled" }, "password": { "type": "string", "description": "Password for encryption when enabled" } }, "required": [ "enabled" ] } }, "required": [ "enabled", "encryption" ], "description": "Compression and encryption settings" }, "sendTo": { "type": "object", "properties": { "location": { "type": "string", "description": "Location to send evidence to (e.g., \"user-local\")" } }, "required": [ "location" ], "description": "Configuration for where to send evidence" }, "cpu": { "type": "object", "properties": { "limit": { "type": "number", "description": "CPU usage limit percentage (1-100)" } }, "description": "CPU usage limits" } }, "required": [ "name", "saveTo", "compression", "sendTo" ] }	—	—
create_sftp_repositoryCreate a new SFTP evidence repository Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the SFTP repository" }, "host": { "type": "string", "description": "SFTP server hostname or IP address" }, "port": { "type": "number", "description": "SFTP server port (default: 22)" }, "path": { "type": "string", "description": "Path on the SFTP server (e.g. /)" }, "username": { "type": "string", "description": "Username for SFTP authentication" }, "password": { "type": "string", "description": "Password for SFTP authentication" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with" } }, "required": [ "name", "host", "path", "username", "password" ] }	—	—
create_smb_repositoryCreate a new SMB evidence repository Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the SMB repository" }, "path": { "type": "string", "description": "Network share path (e.g. \\\\Network\\Share)" }, "username": { "type": "string", "description": "Username for SMB authentication" }, "password": { "type": "string", "description": "Password for SMB authentication" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "name", "path", "username", "password" ] }	—	—
create_triage_ruleCreate a new triage rule Input schema { "type": "object", "properties": { "description": { "type": "string", "description": "A descriptive name for the triage rule" }, "rule": { "type": "string", "description": "The YARA rule content" }, "searchIn": { "type": "string", "description": "Where to search, e.g., \"filesystem\"" }, "engine": { "type": "string", "description": "Rule engine to use, e.g., \"yara\"" }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "string" }, { "type": "number" } ] }, "description": "Organization IDs to associate with this rule. Defaults to [0]" } }, "required": [ "description", "rule", "searchIn", "engine" ] }	—	—
create_triage_tagCreate a new triage rule tag Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the tag to create" }, "organizationId": { "oneOf": [ { "type": "string" }, { "type": "number" } ], "description": "Organization ID to associate the tag with. Defaults to 0." } }, "required": [ "name" ] }	—	—
delete_auto_asset_tag_by_idDelete a specific auto asset tag rule by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the auto asset tag to delete" } }, "required": [ "id" ] }	—	—
delete_note_from_caseDelete a note from a case by its ID Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case containing the note (e.g., \"C-2022-0002\")" }, "noteId": { "type": "string", "description": "The ID of the note to delete (e.g., \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\")" } }, "required": [ "caseId", "noteId" ] }	—	—
delete_organizationDelete an organization by its ID Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "The ID of the organization to delete" } }, "required": [ "id" ] }	—	—
delete_policy_by_idDelete a specific policy by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the policy to delete" } }, "required": [ "id" ] }	—	—
delete_repositoryDelete an evidence repository by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the repository to delete" } }, "required": [ "id" ] }	—	—
delete_tags_from_organizationDelete specific tags from an organization Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "ID of the organization to delete tags from" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Array of tags to delete from the organization" } }, "required": [ "id", "tags" ] }	—	—
delete_task_assignmentDelete a specific task assignment by its ID Input schema { "type": "object", "properties": { "assignmentId": { "type": "string", "description": "The ID of the task assignment to delete" } }, "required": [ "assignmentId" ] }	—	—
delete_task_by_idDelete a specific task by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the task to delete" } }, "required": [ "id" ] }	—	—
delete_triage_ruleDelete an existing triage rule by ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the triage rule to delete" } }, "required": [ "id" ] }	—	—
download_case_ppcDownload a PPC file for a specific endpoint and task Input schema { "type": "object", "properties": { "endpointId": { "type": "string", "description": "The ID of the endpoint to download the PPC file for" }, "taskId": { "type": "string", "description": "The ID of the task to download the PPC file for" } }, "required": [ "endpointId", "taskId" ] }	—	—
download_task_reportDownload a task report for a specific endpoint and task Input schema { "type": "object", "properties": { "endpointId": { "type": "string", "description": "The ID of the endpoint to download the task report for" }, "taskId": { "type": "string", "description": "The ID of the task to download the task report for" } }, "required": [ "endpointId", "taskId" ] }	—	—
export_audit_logsInitiate an export of audit logs from the AIR system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter audit logs by. Defaults to \"0\" or specific IDs like \"123\" or \"123,456\"." } }, "required": [] }	—	—
export_case_activitiesExport activities for a specific case by its ID Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case to export activities for" } }, "required": [ "caseId" ] }	—	—
export_case_endpointsExport endpoints for a specific case by its ID Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case to export endpoints for" }, "organizationIds": { "type": "string", "description": "Organization IDs to filter by. Defaults to \"0\"." } }, "required": [ "caseId" ] }	—	—
export_case_notesExport notes for a specific case by its ID Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case to export notes for" } }, "required": [ "caseId" ] }	—	—
export_casesExport cases data from the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter cases by. Leave empty to use default (0)." } }, "required": [] }	—	—
get_acquisition_profile_by_idGet details of a specific acquisition profile by its ID Input schema { "type": "object", "properties": { "profileId": { "type": "string", "description": "The ID of the acquisition profile to retrieve (e.g., \"full\")" } }, "required": [ "profileId" ] }	—	—
get_asset_by_idGet detailed information about a specific asset by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the asset to retrieve" } }, "required": [ "id" ] }	—	—
get_asset_tasks_by_idGet all tasks associated with a specific asset by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the asset to retrieve tasks for" } }, "required": [ "id" ] }	—	—
get_auto_asset_tag_by_idGet details of a specific auto asset tag rule by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the auto asset tag to retrieve" } }, "required": [ "id" ] }	—	—
get_case_activitiesGet activity history for a specific case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to retrieve activities for" } }, "required": [ "id" ] }	—	—
get_case_by_idGet detailed information about a specific case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to retrieve" } }, "required": [ "id" ] }	—	—
get_case_endpointsGet all endpoints associated with a specific case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to retrieve endpoints for" }, "organizationIds": { "type": "string", "description": "Organization IDs to filter endpoints by. Defaults to 0." } }, "required": [ "id" ] }	—	—
get_case_tasks_by_idGet all tasks associated with a specific case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to retrieve tasks for" }, "organizationIds": { "type": "string", "description": "Organization IDs to filter tasks by. Leave empty to use default (0)." } }, "required": [ "id" ] }	—	—
get_case_usersGet all users associated with a specific case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to retrieve users for (e.g., C-2022-0001)" }, "organizationIds": { "type": "string", "description": "Organization IDs to filter users by. Leave empty to use default (0)." } }, "required": [ "id" ] }	—	—
get_comparison_reportGet comparison result report for a specific endpoint and task Input schema { "type": "object", "properties": { "endpointId": { "type": "string", "description": "The endpoint ID associated with the comparison task" }, "taskId": { "type": "string", "description": "The ID of the comparison task to get the report for" } }, "required": [ "endpointId", "taskId" ] }	—	—
get_organization_by_idGet detailed information about a specific organization by its ID Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "The ID of the organization to retrieve" } }, "required": [ "id" ] }	—	—
get_organization_usersGet users for a specific organization by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the organization to retrieve users for" } }, "required": [ "id" ] }	—	—
get_policy_by_idGet detailed information about a specific policy by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the policy to retrieve" } }, "required": [ "id" ] }	—	—
get_policy_match_statsGet statistics on how many endpoints match each policy based on filter criteria Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Filter assets by name" }, "searchTerm": { "type": "string", "description": "General search term for filtering assets" }, "ipAddress": { "type": "string", "description": "Filter assets by IP address" }, "groupId": { "type": "string", "description": "Filter assets by group ID" }, "groupFullPath": { "type": "string", "description": "Filter assets by full group path" }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter assets by managed status (e.g., [\"managed\"])" }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter assets by isolation status (e.g., [\"isolated\"])" }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter assets by platform (e.g., [\"windows\"])" }, "issue": { "type": "string", "description": "Filter assets by issue" }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter assets by online status (e.g., [\"online\"])" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Filter assets by tags" }, "version": { "type": "string", "description": "Filter assets by agent version" }, "policy": { "type": "string", "description": "Filter assets by policy name" }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Include only these endpoint IDs" }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Exclude these endpoint IDs" }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs to filter by. Defaults to [0]." } }, "required": [] }	—	—
get_report_file_infoGet information about a PPC file for a specific endpoint and task Input schema { "type": "object", "properties": { "endpointId": { "type": "string", "description": "The ID of the endpoint to get report file information for" }, "taskId": { "type": "string", "description": "The ID of the task to get report file information for" } }, "required": [ "endpointId", "taskId" ] }	—	—
get_repository_by_idGet detailed information about a specific evidence repository by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the repository to retrieve" } }, "required": [ "id" ] }	—	—
get_shareable_deployment_infoGet shareable deployment information using a deployment token Input schema { "type": "object", "properties": { "deploymentToken": { "type": "string", "description": "The deployment token to retrieve information for" } }, "required": [ "deploymentToken" ] }	—	—
get_task_assignmentsGet all assignments for a specific task by its ID Input schema { "type": "object", "properties": { "slug": { "type": "string", "description": "The webhook slug (e.g., \"air-generic-url-webhook\")" }, "taskId": { "type": "string", "description": "The ID of the task to retrieve assignments for" }, "token": { "type": "string", "description": "The webhook token for authentication" } }, "required": [ "slug", "taskId", "token" ] }	—	—
get_task_assignments_by_idGet all assignments associated with a specific task by its ID Input schema { "type": "object", "properties": { "taskId": { "type": "string", "description": "The ID of the task to retrieve assignments for" } }, "required": [ "taskId" ] }	—	—
get_task_by_idGet detailed information about a specific task by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the task to retrieve" } }, "required": [ "id" ] }	—	—
get_triage_rule_by_idGet a specific triage rule by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the triage rule to retrieve" } }, "required": [ "id" ] }	—	—
get_user_by_idGet detailed information about a specific user by their ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the user to retrieve" } }, "required": [ "id" ] }	—	—
import_task_assignments_to_caseImport task assignments to a specific case Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "ID of the case to import task assignments to" }, "taskAssignmentIds": { "type": "array", "items": { "type": "string" }, "description": "Array of task assignment IDs to import to the case" } }, "required": [ "caseId", "taskAssignmentIds" ] }	—	—
list_acquisition_artifactsList all acquisition artifacts available for evidence collection Input schema { "type": "object", "properties": { "random_string": { "type": "string", "description": "Dummy parameter for no-parameter tools" } }, "required": [ "random_string" ] }	—	—
list_acquisition_profilesList all acquisition profiles in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter acquisition profiles by. Leave empty to use default (0)." }, "allOrganizations": { "type": "boolean", "description": "Whether to include profiles from all organizations. Defaults to true." } }, "required": [] }	—	—
list_assetsList all assets in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter assets by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_audit_logsList audit logs from the AIR system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter audit logs by. Defaults to \"0\" or specific IDs like \"123\" or \"123,456\"." } }, "required": [] }	—	—
list_auto_asset_tagsList all auto asset tag rules in the system. Input schema { "type": "object", "properties": {}, "required": [] }	—	—
list_casesList all cases in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter cases by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_drone_analyzersList all drone analyzers in the system Input schema { "type": "object", "properties": {}, "required": [] }	—	—
list_e_discovery_patternsList all e-discovery patterns for file type detection Input schema { "type": "object", "properties": { "random_string": { "type": "string", "description": "Dummy parameter for no-parameter tools" } }, "required": [ "random_string" ] }	—	—
list_organizationsList all organizations in the system Input schema { "type": "object", "properties": {}, "required": [] }	—	—
list_policiesList all policies in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter policies by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_repositoriesList all evidence repositories in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter repositories by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_tasksList all tasks in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter tasks by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_triage_rulesList all triage rules in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter triage rules by. Leave empty to use default (0)." } }, "required": [] }	—	—
list_triage_tagsList all triage rule tags in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter triage tags by. Leave empty to use default (0)." }, "withCount": { "type": "boolean", "description": "Whether to include count of rules for each tag. Defaults to true." } }, "required": [] }	—	—
list_usersList all users in the system Input schema { "type": "object", "properties": { "organizationIds": { "type": "string", "description": "Organization IDs to filter users by. Leave empty to use default (0)." } }, "required": [] }	—	—
open_case_by_idOpen a previously closed case by its ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the case to open" } }, "required": [ "id" ] }	—	—
post_webhookPost data to a webhook Input schema { "type": "object", "properties": { "slug": { "type": "string", "description": "The webhook slug (e.g., \"air-generic-url-webhook\")" }, "data": { "type": "object", "description": "The data to be sent in the request body" }, "token": { "type": "string", "description": "The webhook token for authentication" } }, "required": [ "slug", "data", "token" ] }	—	—
purge_and_uninstall_assetsPurge data and uninstall specific assets based on filters. Requires specifying `filter.includedEndpointIds`. Input schema { "type": "object", "properties": { "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term." }, "name": { "type": "string", "description": "Filter by asset name." }, "ipAddress": { "type": "string", "description": "Filter by IP address." }, "groupId": { "type": "string", "description": "Filter by group ID." }, "groupFullPath": { "type": "string", "description": "Filter by full group path." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])." }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])." }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])." }, "issue": { "type": "string", "description": "Filter by issue." }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])." }, "tagId": { "type": "string", "description": "Filter by tag ID." }, "version": { "type": "string", "description": "Filter by agent version." }, "policy": { "type": "string", "description": "Filter by policy." }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "REQUIRED: Array of endpoint IDs to purge and uninstall." }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude." }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter. Defaults to [0]." } }, "required": [ "includedEndpointIds" ], "description": "Filter object to specify which assets to purge and uninstall." } }, "required": [ "filter" ] }	—	—
remove_endpoints_from_caseRemove endpoints from a case based on specified filters Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the case to remove endpoints from" }, "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term" }, "name": { "type": "string", "description": "Filter by asset name" }, "ipAddress": { "type": "string", "description": "Filter by IP address" }, "groupId": { "type": "string", "description": "Filter by group ID" }, "groupFullPath": { "type": "string", "description": "Filter by full group path" }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])" }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])" }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])" }, "issue": { "type": "string", "description": "Filter by issue" }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Filter by tags" }, "version": { "type": "string", "description": "Filter by agent version" }, "policy": { "type": "string", "description": "Filter by policy" }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to remove" }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude" }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter. Defaults to [0]" } }, "required": [], "description": "Filter object to specify which endpoints to remove" } }, "required": [ "id" ] }	—	—
remove_tags_from_assetsRemove tags from specific assets based on filters. Requires specifying `filter.includedEndpointIds` and `tags`. Input schema { "type": "object", "properties": { "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term." }, "name": { "type": "string", "description": "Filter by asset name." }, "ipAddress": { "type": "string", "description": "Filter by IP address." }, "groupId": { "type": "string", "description": "Filter by group ID." }, "groupFullPath": { "type": "string", "description": "Filter by full group path." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])." }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])." }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])." }, "issue": { "type": "string", "description": "Filter by issue." }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])." }, "tagId": { "type": "string", "description": "Filter by existing tag ID." }, "version": { "type": "string", "description": "Filter by agent version." }, "policy": { "type": "string", "description": "Filter by policy." }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "REQUIRED: Array of endpoint IDs to remove tags from." }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude." }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter. Defaults to [0]." } }, "required": [ "includedEndpointIds" ], "description": "Filter object to specify which assets to remove tags from." }, "tags": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "REQUIRED: Array of tags to remove from the selected assets." } }, "required": [ "filter", "tags" ] }	—	—
remove_task_assignment_from_caseRemove a specific task assignment from a case Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case to remove the task assignment from" }, "taskAssignmentId": { "type": "string", "description": "The ID of the task assignment to remove" } }, "required": [ "caseId", "taskAssignmentId" ] }	—	—
remove_user_from_organizationRemove a user from an organization Input schema { "type": "object", "properties": { "organizationId": { "type": "string", "description": "The ID of the organization to remove the user from" }, "userId": { "type": "string", "description": "The ID of the user to remove from the organization" } }, "required": [ "organizationId", "userId" ] }	—	—
start_taggingStart the auto asset tagging process for assets matching filter criteria. Input schema { "type": "object", "properties": { "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term." }, "name": { "type": "string", "description": "Filter by asset name." }, "ipAddress": { "type": "string", "description": "Filter by IP address." }, "groupId": { "type": "string", "description": "Filter by group ID." }, "groupFullPath": { "type": "string", "description": "Filter by full group path." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])." }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])." }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])." }, "issue": { "type": "string", "description": "Filter by issue." }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Filter by tags." }, "version": { "type": "string", "description": "Filter by agent version." }, "policy": { "type": "string", "description": "Filter by policy." }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to include." }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude." }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs filter. Defaults to [0]." } }, "description": "Filter object to specify which assets to apply auto tagging to." } }, "required": [ "filter" ] }	—	—
uninstall_assetsUninstall specific assets based on filters without purging data. Requires specifying `filter.includedEndpointIds`. Input schema { "type": "object", "properties": { "filter": { "type": "object", "properties": { "searchTerm": { "type": "string", "description": "Optional search term." }, "name": { "type": "string", "description": "Filter by asset name." }, "ipAddress": { "type": "string", "description": "Filter by IP address." }, "groupId": { "type": "string", "description": "Filter by group ID." }, "groupFullPath": { "type": "string", "description": "Filter by full group path." }, "managedStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by managed status (e.g., [\"managed\"])." }, "isolationStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by isolation status (e.g., [\"isolated\"])." }, "platform": { "type": "array", "items": { "type": "string" }, "description": "Filter by platform (e.g., [\"windows\"])." }, "issue": { "type": "string", "description": "Filter by issue." }, "onlineStatus": { "type": "array", "items": { "type": "string" }, "description": "Filter by online status (e.g., [\"online\"])." }, "tagId": { "type": "string", "description": "Filter by tag ID." }, "version": { "type": "string", "description": "Filter by agent version." }, "policy": { "type": "string", "description": "Filter by policy." }, "includedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "REQUIRED: Array of endpoint IDs to uninstall." }, "excludedEndpointIds": { "type": "array", "items": { "type": "string" }, "description": "Array of endpoint IDs to exclude." }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs filter. Defaults to [0]." } }, "required": [], "description": "Filter object to specify which assets to uninstall." } }, "required": [ "filter" ] }	—	—
update_amazon_s3_repositoryUpdate an existing Amazon S3 repository Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the Amazon S3 repository to update" }, "name": { "type": "string", "description": "Updated name for the Amazon S3 repository" }, "region": { "type": "string", "description": "Updated AWS region (e.g. eu-west-1)" }, "bucket": { "type": "string", "description": "Updated S3 bucket name" }, "accessKeyId": { "type": "string", "description": "Updated AWS access key ID" }, "secretAccessKey": { "type": "string", "description": "Updated AWS secret access key" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Updated organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "id", "name", "region", "bucket", "accessKeyId", "secretAccessKey" ] }	—	—
update_auto_asset_tagUpdate an existing auto asset tag rule. Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the auto asset tag to update." }, "tag": { "type": "string", "description": "The tag name to be applied automatically." }, "linuxConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for Linux assets." }, "windowsConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for Windows assets." }, "macosConditions": { "$ref": "#/definitions/ConditionGroup", "description": "Conditions for macOS assets." } }, "required": [ "id", "tag" ], "definitions": { "ConditionGroup": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "or" ], "description": "Logical operator for combining conditions." }, "conditions": { "type": "array", "items": { "oneOf": [ { "$ref": "#/definitions/Condition" }, { "$ref": "#/definitions/ConditionGroup" } ] }, "minItems": 1, "description": "Array of conditions or nested groups." } }, "required": [ "operator", "conditions" ] }, "Condition": { "type": "object", "properties": { "field": { "type": "string", "description": "Field to check (e.g., \"process\")" }, "operator": { "type": "string", "description": "Comparison operator (e.g., \"running\")" }, "value": { "type": "string", "description": "Value to compare against" } }, "required": [ "field", "operator", "value" ] } } }	—	—
update_azure_storage_repositoryUpdate an existing Azure Storage repository Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the Azure Storage repository to update" }, "name": { "type": "string", "description": "Updated name for the Azure Storage repository" }, "SASUrl": { "type": "string", "description": "Updated SAS URL for Azure Storage access" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Updated organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "id", "name", "SASUrl" ] }	—	—
update_banner_messageUpdate the system banner message settings Input schema { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the banner message is enabled or disabled" } }, "required": [ "enabled" ] }	—	—
update_caseUpdate an existing case by ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the case to update" }, "name": { "type": "string", "description": "New name for the case" }, "ownerUserId": { "type": "string", "description": "New owner user ID for the case" }, "visibility": { "type": "string", "description": "New visibility setting for the case" }, "assignedUserIds": { "type": "array", "items": { "type": "string" }, "description": "New array of user IDs to assign to the case" }, "status": { "type": "string", "enum": [ "open", "closed", "archived" ], "description": "New status for the case" }, "notes": { "type": "array", "items": { "type": "object" }, "description": "New notes for the case" } }, "required": [ "id" ] }	—	—
update_ftps_repositoryUpdate an existing FTPS evidence repository Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the FTPS repository to update" }, "name": { "type": "string", "description": "Updated name for the FTPS repository" }, "host": { "type": "string", "description": "Updated FTPS server hostname or IP address" }, "port": { "type": "number", "description": "Updated FTPS server port (default: 22)" }, "path": { "type": "string", "description": "Updated path on the FTPS server (e.g. /)" }, "username": { "type": "string", "description": "Updated username for FTPS authentication" }, "password": { "type": "string", "description": "Updated password for FTPS authentication" }, "allowSelfSignedSSL": { "type": "boolean", "description": "Whether to allow self-signed SSL certificates" }, "publicKey": { "type": "string", "description": "Public key for FTPS authentication (optional)" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Updated organization IDs to associate the repository with" } }, "required": [ "id", "name", "host", "path", "username", "password" ] }	—	—
update_note_in_caseUpdate an existing note in a specific case Input schema { "type": "object", "properties": { "caseId": { "type": "string", "description": "The ID of the case containing the note (e.g., \"C-2022-0002\")" }, "noteId": { "type": "string", "description": "The ID of the note to update (e.g., \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\")" }, "note": { "type": "string", "description": "The new content for the note" } }, "required": [ "caseId", "noteId", "note" ] }	—	—
update_organization_by_idUpdate an existing organization by ID Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "The ID of the organization to update" }, "name": { "type": "string", "description": "Updated name of the organization" }, "shareableDeploymentEnabled": { "type": "boolean", "description": "Whether shareable deployment is enabled" }, "contact": { "type": "object", "properties": { "name": { "type": "string", "description": "Contact name" }, "title": { "type": "string", "description": "Contact title" }, "phone": { "type": "string", "description": "Contact phone number" }, "mobile": { "type": "string", "description": "Contact mobile number" }, "email": { "type": "string", "description": "Contact email address" } }, "description": "Updated contact information for the organization" }, "note": { "type": "string", "description": "Additional notes about the organization" } }, "required": [ "id" ] }	—	—
update_organization_deployment_tokenUpdate the deployment token for a specific organization Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "The ID of the organization to update" }, "deploymentToken": { "type": "string", "description": "New deployment token for the organization" } }, "required": [ "id", "deploymentToken" ] }	—	—
update_organization_shareable_deploymentUpdate an organization's shareable deployment settings Input schema { "type": "object", "properties": { "id": { "type": "number", "description": "The ID of the organization to update" }, "status": { "type": "boolean", "description": "Whether shareable deployment should be enabled (true) or disabled (false)" } }, "required": [ "id", "status" ] }	—	—
update_policyUpdate an existing policy with specific storage and filter settings Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the policy to update" }, "name": { "type": "string", "description": "Name for the policy" }, "organizationIds": { "oneOf": [ { "type": "array", "items": { "type": "number" } }, { "type": "array", "items": { "type": "string" } }, { "type": "number" }, { "type": "string" } ], "description": "Organization IDs to associate with policy. Defaults to [0]." }, "filter": { "type": "object", "properties": { "operator": { "type": "string", "description": "Logical operator for combining conditions (e.g., \"and\", \"or\")" }, "conditions": { "type": "array", "items": { "type": "object" }, "description": "Array of conditions for policy filtering" } }, "description": "Filter conditions to determine which endpoints the policy applies to" }, "saveTo": { "type": "object", "properties": { "windows": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for Windows (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on Windows" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for Windows (e.g., \"C:\")" }, "tmp": { "type": "string", "description": "Temporary folder path for Windows" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] }, "linux": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for Linux (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on Linux" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for Linux (e.g., \"/\")" }, "tmp": { "type": "string", "description": "Temporary folder path for Linux" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] }, "macos": { "type": "object", "properties": { "location": { "type": "string", "description": "Storage location for macOS (e.g., \"local\")" }, "path": { "type": "string", "description": "Path for evidence storage on macOS" }, "useMostFreeVolume": { "type": "boolean", "description": "Whether to use volume with most free space" }, "volume": { "type": "string", "description": "Volume to use for macOS (e.g., \"/\")" }, "tmp": { "type": "string", "description": "Temporary folder path for macOS" } }, "required": [ "location", "path", "useMostFreeVolume", "volume" ] } }, "required": [ "windows", "linux", "macos" ], "description": "Configuration for where to save evidence" }, "compression": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether compression is enabled" }, "encryption": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether encryption is enabled" }, "password": { "type": "string", "description": "Password for encryption when enabled" } }, "required": [ "enabled" ] } }, "required": [ "enabled", "encryption" ], "description": "Compression and encryption settings" }, "sendTo": { "type": "object", "properties": { "location": { "type": "string", "description": "Location to send evidence to (e.g., \"user-local\")" } }, "required": [ "location" ], "description": "Configuration for where to send evidence" }, "cpu": { "type": "object", "properties": { "limit": { "type": "number", "description": "CPU usage limit percentage (1-100)" } }, "description": "CPU usage limits" } }, "required": [ "id", "name", "saveTo", "compression", "sendTo" ] }	—	—
update_policy_prioritiesUpdate the priority order of policies Input schema { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of policy IDs that defines their priority (first has highest priority)" }, "organizationIds": { "oneOf": [ { "type": "array", "items": { "type": "number" } }, { "type": "array", "items": { "type": "string" } }, { "type": "number" }, { "type": "string" } ], "description": "Organization IDs to associate with priority update. Defaults to [0]." } }, "required": [ "ids" ] }	—	—
update_sftp_repositoryUpdate an existing SFTP repository Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the SFTP repository to update" }, "name": { "type": "string", "description": "Updated name for the SFTP repository" }, "host": { "type": "string", "description": "Updated SFTP server hostname or IP address" }, "port": { "type": "number", "description": "Updated SFTP server port (default: 22)" }, "path": { "type": "string", "description": "Updated path on the SFTP server (e.g. /)" }, "username": { "type": "string", "description": "Updated username for SFTP authentication" }, "password": { "type": "string", "description": "Updated password for SFTP authentication" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Updated organization IDs to associate the repository with" } }, "required": [ "id", "name", "host", "path", "username", "password" ] }	—	—
update_smb_repositoryUpdate an existing SMB repository by ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the SMB repository to update" }, "name": { "type": "string", "description": "Updated name for the SMB repository" }, "path": { "type": "string", "description": "Updated network share path (e.g. \\\\Network\\Share)" }, "username": { "type": "string", "description": "Updated username for SMB authentication" }, "password": { "type": "string", "description": "Updated password for SMB authentication" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Updated organization IDs to associate the repository with" } }, "required": [ "id", "name", "path", "username", "password" ] }	—	—
update_triage_ruleUpdate an existing triage rule by ID Input schema { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the triage rule to update" }, "description": { "type": "string", "description": "A descriptive name for the triage rule" }, "rule": { "type": "string", "description": "The YARA rule content" }, "searchIn": { "type": "string", "description": "Where to search, e.g., \"filesystem\"" }, "organizationIds": { "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "description": "Organization IDs to associate with this rule. Defaults to [0]" } }, "required": [ "id", "description", "rule", "searchIn" ] }	—	—
validate_amazon_s3_repositoryValidate Amazon S3 repository configuration Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the Amazon S3 repository" }, "region": { "type": "string", "description": "AWS region (e.g. eu-west-1)" }, "bucket": { "type": "string", "description": "S3 bucket name" }, "accessKeyId": { "type": "string", "description": "AWS access key ID" }, "secretAccessKey": { "type": "string", "description": "AWS secret access key" }, "organizationIds": { "type": "array", "items": { "type": "number" }, "description": "Organization IDs to associate the repository with. Defaults to empty array." } }, "required": [ "name", "region", "bucket", "accessKeyId", "secretAccessKey" ] }	—	—
validate_azure_storage_repositoryValidate an Azure Storage repository configuration Input schema { "type": "object", "properties": { "SASUrl": { "type": "string", "description": "SAS URL for Azure Storage access" } }, "required": [ "SASUrl" ] }	—	—
validate_ftps_repositoryValidate FTPS repository configuration without creating it Input schema { "type": "object", "properties": { "name": { "type": "string", "description": "Name for the FTPS repository" }, "host": { "type": "string", "description": "FTPS server hostname or IP address" }, "port": { "type": "number", "description": "FTPS server port (default: 22)" }, "path": { "type": "string", "description": "Path on the FTPS server (e.g. /)" }, "username": { "type": "string", "description": "Username for FTPS authentication" }, "password": { "type": "string", "description": "Password for FTPS authentication" }, "allowSelfSignedSSL": { "type": "boolean", "description": "Whether to allow self-signed SSL certificates" }, "publicKey": { "type": "string", "description": "Public key for FTPS authentication (optional)" } }, "required": [ "name", "host", "path", "username", "password" ] }	—	—
validate_triage_ruleValidate a triage rule syntax without creating it Input schema { "type": "object", "properties": { "rule": { "type": "string", "description": "The YARA rule content to validate" } }, "required": [ "rule" ] }	—	—

Resources 0

None observed.

Resource templates 0

None observed.

Prompts 0

None observed.

Remote endpoints

Endpoint	Transport	Authentication	Health	Observed
No verified remote endpoint is linked.

Binalyze AIR MCP Server questions

How do I install Binalyze AIR MCP Server?

Install the selected package version with: npm install --save-exact @binalyze/air-mcp@12.4.1

What tools does Binalyze AIR MCP Server provide?

Binalyze AIR MCP Server exposed 116 tools during independent protocol observation, including acquire_baseline, add_note_to_case, add_tags_to_assets, add_tags_to_organization, archive_case_by_id, assign_acquisition_task, assign_image_acquisition_task, assign_isolation_task, and others.

Is Binalyze AIR MCP Server secure?

Our scanner tested version 12.4.1 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

Explore related MCP server guides

Curated product and capability guides containing this catalog record.

Official vs Community MCP Servers