Integration

Binalyze AIR integration

Drive a Binalyze AIR digital forensics and incident response console: list organizations, assets (endpoints) and their task history; create, update, close, reopen and archive investigation cases, add notes and read their activity, assets and tasks; follow tasks and their per-asset assignments, cancel them; isolate listed assets from the network or lift their isolation (this cuts real machines off the network); and browse acquisition profiles and triage rules. Every call acts with the permissions of the API token. Not returned: asset IP addresses, network interfaces and responder security tokens, organization deployment tokens and contacts, user emails and names of who performed case activities, task configurations and results. Not exposed: evidence acquisition, image acquisition and triage task assignment (their bodies take evidence repository credentials and archive passwords), reboot, shutdown, uninstall and purge, InterACT remote shell, Investigation Hub findings and evidence, users, API tokens, audit logs, settings, policies, webhooks, cloud forensics, relay servers and backups. Authentication: an AIR API token (Integrations, API Tokens) sent as a Bearer token, plus the host name of your AIR console.

Connect Binalyze AIR How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Binalyze AIR.Built from the 25 Binalyze AIR tools below, on the connection you add once.

What you can do with Binalyze AIR

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Case, 7 operations

archive_caseArchive casePOSTArchives a case. Acts on the real AIR console.
close_caseClose casePOSTCloses a case. Acts on the real AIR console.
create_caseCreate casePOSTCreates an investigation case in an organization, owned by ownerUserId, visible to the organization or to assigned users only. Acts on the real AIR console.
get_caseGet caseGETReturns one case: name, status, owner, visibility, assigned users, start and close dates, days open and number of endpoints.
list_casesList casesGETLists the cases of an organization, optionally by status (open, closed, archived) or search text. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.
reopen_caseReopen casePOSTReopens a closed or archived case. Acts on the real AIR console.
update_caseUpdate casePATCHRenames a case or changes its visibility and assigned users. name and visibility are required: read the case with get_case first and send its current values with the change. Acts on the real AIR console.

Asset, 4 operations

get_assetGet assetGETReturns one asset: name, OS, platform, online and isolation status, group, responder version and issues. IP and network details are not returned.
isolate_assetsIsolate assetsPOSTCreates a task, for real, that cuts the listed assets off the network (enabled true) or lifts their isolation (enabled false). Isolated machines lose normal network access until isolation is lifted.
list_assetsList assetsGETLists an organization's assets (endpoints), filtered by name, platform, status, group or tag. IP and network details are not returned. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.
list_case_assetsList case assetsGETLists the assets (endpoints) attached to a case, with platform, online and isolation status. IP and network details are not returned. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Task assignment, 4 operations

cancel_task_assignmentCancel task assignmentPOSTCancels a task on one asset (one assignment) for real. Acts on the real AIR console.
list_asset_task_assignmentsList asset task assignmentsGETLists the task assignments that ran or run on one asset. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.
list_case_task_assignmentsList case task assignmentsGETLists the task assignments (one task on one asset) of a case, with status and progress. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.
list_task_assignmentsList task assignmentsGETLists the per-asset assignments of a task with status and progress. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Task, 3 operations

cancel_taskCancel taskPOSTCancels a task for real, for the assets it is assigned to (a running acquisition, triage or isolation task stops being carried out). Acts on the real AIR console.
get_taskGet taskGETReturns one task: type, status, schedule and how many assets completed, failed or cancelled it. The task configuration is not returned.
list_tasksList tasksGETLists the tasks of an organization (acquisitions, triages, isolations, reboots and others) with per-asset completion counts, by status, type or name. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Organization, 2 operations

get_organizationGet organizationGETReturns one organization with its asset counts (total, managed) and case counts (open, closed, archived).
list_organizationsList organizationsGETLists the organizations of the AIR console (0 is the default organization); most other tools need an organization ID from here. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Acquisition profile, 1 operation

list_acquisition_profilesList acquisition profilesGETLists the evidence acquisition profiles (built-in ones such as full, quick, event-logs, and custom ones). Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

App info, 1 operation

get_app_infoGet app infoGETReturns the AIR console version and the responder version; a quick check that the host and API token work.

Case activity, 1 operation

list_case_activitiesList case activitiesGETLists the activity log of a case: event type, when it happened and the organizations concerned. Who performed each event is not returned. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Case note, 1 operation

add_case_noteAdd case notePOSTAdds a text note to a case. Acts on the real AIR console.

Triage rule, 1 operation

list_triage_rulesList triage rulesGETLists the triage rules (YARA, Sigma, osquery) available to an organization, optionally by engine or search text. Paged with pageNumber and pageSize; stop when result.currentPage reaches result.totalPageCount.

Use Binalyze AIR from Claude Code, Cursor or Codex

Connect Binalyze AIR in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Binalyze AIR operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Binalyze AIR

Create your workspace
Sign up free. Nothing to install.
Connect Binalyze AIR once
Add your Binalyze AIR connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.