Get File

Description

This tool can be used to get the metadata and binary content of an AttackForge File by supplying its id. This is useful for retrieving evidence files attached to vulnerabilities or files attached to writeups.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool get_file and click Add

Example Prompts

Prompt 1

Get all the AttackForge vulnerabilities for project "ACME Corp. Web App Pentest". For every vulnerability, do the following:

• show me all of the evidence files on the vulnerability. For every evidence file, do the following:

  • show file name, file type and file size.

  • retrieve and display the file if it is an image

Prompt 2

Download the evidence file with ID 699ff11c529fc71046260673. Show me the metadata for the file attached to this vulnerability. What is the file name and size of evidence file ID 699ff11c529fc71046260673? Get the hash and mime type for a specific file. Retrieve the evidence image from this vulnerability. Show me when this evidence file was last modified.

Supported Query Fields

id: {
  description: 'This relates to the "id" field of evidence and files present in tools find_vulnerabilities and find_writeups respectively.',
  type: 'string',
  pattern: '^[0-9a-fA-F]{24}$',
}

Supported Response Fields

id
created
modified
name
mimeType
hash
size
storage_name
storage_location
caption
data

Example Response

{
    "id": "699ff11c529fc71046260673",
    "created": "2026-02-26T07:07:08.366Z",
    "modified": "2026-02-26T07:07:10.175Z",
    "name": "evidence 1.png",
    "mimeType": "image/png",
    "hash": "b30689526a550266da762212c58ba5860af94ac6563cae65cfe6f9f24c2b62e3",
    "size": 309447,
    "storage_name": "h1nn93hfdy1bdpdxrmsbfbnhdiq9ckdzy3rqmxvhatcgofwd0ii6fpyfxlcdwkgzh7bo2zdxoydh17l4gopsxzzzryg4intnvhmx6ctoorthv7uqias3prs3qwr3doys",
    "storage_location": "test-attackforge-dev/issues/2026-2-26/6972b31b8e7d46a8089d9b53",
    "caption": "Screenshot of the vulnerability",
    "data": "<base64 encoded binary content>"
}