広告掲載
MCP.so
ログイン
E

Ez Tools MCP Server

@heejung0

リポジトリ

基本情報

カテゴリ

その他

トランスポート

stdio

作者

heejung0

投稿者

Heejung Kim

Ez Tools MCP Server について

EZ Tools MCP Server는 Eric Zimmerman's Tools에서 제공되는 도구들을 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 Windows Artifact(Prefetch, EventLog, Registry) 를 분석할 수 있습니다. (Eric Zimmerman's Tool의 특성상 Windows 환경에서만 사용 가능합니다.)

#windows#forensic

Ez Tools MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "ez-tools-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/EZ_tools_mcp_server.py"
      ],
      "env": {
        "PECMD_EXE": "/path/to/PECmd.exe",
        "EVTX_EXE": "/path/to/EvtxECmd.exe",
        "RECMD_EXE": "/path/to/RECmd.exe"
      }
    }
  }
}

Ez Tools MCP Server のツール

8

Eric Zimmerman's Tools 바이너리 설치 상태 점검

Prefetch 파일이 들어있는 폴더 분석

Prefetch 파일 분석

Windows Eventlog 파일이 들어있는 폴더 분석

Windows Eventlog 파일 분석

DFIRBatch.reb 배치 파일을 사용하여 Registy 하이브 전체 분석

특정 Batch 파일 또는 하이브 파일 개별 분석

RECmd BatchExamples 폴더 내에 있는 배치 파일 목록 조회

概要

What is Ez Tools Mcp Server?

Ez Tools Mcp Server is an MCP server that exposes Eric Zimmerman’s forensic tools as MCP tools. It allows MCP clients like Cursor and Claude Desktop to analyze Windows artifacts including Prefetch, EventLog, and Registry. Due to the nature of Eric Zimmerman’s Tools, this server works only on Windows.

How to use Ez Tools Mcp Server?

Clone the repository, create a Python virtual environment, and install dependencies. Download the required Eric Zimmerman executables (PECmd, EvtxECmd, RECmd). Then configure your MCP client with a command pointing to the Python interpreter and the server script, and set environment variables (PECMD_EXE, EVTX_EXE, RECMD_EXE) to the executable paths.

Key features of Ez Tools Mcp Server

  • Exposes eight forensic analysis tools as MCP tools
  • Parse Prefetch files individually or by folder
  • Parse Windows Event Log files individually or by folder
  • Perform full Registry hive analysis using DFIRBatch
  • Run specific Registry batch or hive file analysis
  • List available RECmd batch examples
  • Includes a health check tool to verify binary installation
  • Works exclusively on Windows

Use cases of Ez Tools Mcp Server

  • Analyze Prefetch files to identify executed programs in a forensic investigation
  • Parse Windows Event Logs to find security or system events
  • Perform comprehensive Registry hive analysis with DFIRBatch recipes
  • List and select available batch recipes for targeted Registry analysis

よくある質問

1

Can I use this server on macOS or Linux?

No. Eric Zimmerman’s Tools are Windows‑only executables, so the server works only on Windows.

2

What binaries do I need to install?

You must download and install PECmd, EvtxECmd, and RECmd from the Eric Zimmerman Tools website. Their paths are set via the `PECMD_EXE`, `EVTX_EXE`, and `RECMD_EXE` environment variables.

3

How do I connect the server to an MCP client?

Add a JSON configuration entry to your MCP client’s settings. Specify the Python interpreter path as the command, the server script path as an argument, and the three environment variables for the tool executables.

4

Is there a way to check if the tools are installed correctly?

Yes, the server provides an `ez_tools_healthcheck` tool that verifies the presence and availability of the Eric Zimmerman binaries.

5

What types of artifacts can I analyze?

The server supports parsing Prefetch files, Windows Event Log files, and Registry hives (full analysis or specific batch/plugin runs). It also lists available RECmd batch files.

コメント

「その他」の他のコンテンツ

N

Next Generation Movers: free moving quotes (remote MCP)

Next Generation Movers

Free moving quotes for AI agents from Next Generation Movers, a licensed interstate mover (USDOT 3764697). US long-distance nationwide and local DC/MD/VA. Indicative ballpark price and booking options; optional $0.01 x40

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

Senso MCP for Joomla

sensomedia

Senso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K
広告掲載