Ez Tools Mcp Server

Name: Ez Tools Mcp Server
Author: heejung0

@heejung0

Ez Tools Mcp Server について

EZ Tools MCP Server는 Eric Zimmerman's Tools에서 제공되는 도구들을 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 Windows Artifact(Prefetch, EventLog, Registry) 를 분석할 수 있습니다. (Eric Zimmerman's Tool의 특성상 Windows 환경에서만 사용 가능합니다.)

#windows #forensic

基本情報

カテゴリ

その他

トランスポート

stdio

公開者

heejung0

投稿者

Heejung Kim

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "ez-tools-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/EZ_tools_mcp_server.py"
      ],
      "env": {
        "PECMD_EXE": "/path/to/PECmd.exe",
        "EVTX_EXE": "/path/to/EvtxECmd.exe",
        "RECMD_EXE": "/path/to/RECmd.exe"
      }
    }
  }
}

ツール

Eric Zimmerman's Tools 바이너리 설치 상태 점검

Prefetch 파일이 들어있는 폴더 분석

Prefetch 파일 분석

Windows Eventlog 파일이 들어있는 폴더 분석

Windows Eventlog 파일 분석

DFIRBatch.reb 배치 파일을 사용하여 Registy 하이브 전체 분석

특정 Batch 파일 또는 하이브 파일 개별 분석

RECmd BatchExamples 폴더 내에 있는 배치 파일 목록 조회

概要

What is Ez Tools Mcp Server?

Ez Tools Mcp Server is an MCP server that exposes Eric Zimmerman’s forensic tools as MCP tools. It allows MCP clients like Cursor and Claude Desktop to analyze Windows artifacts including Prefetch, EventLog, and Registry. Due to the nature of Eric Zimmerman’s Tools, this server works only on Windows.

How to use Ez Tools Mcp Server?

Clone the repository, create a Python virtual environment, and install dependencies. Download the required Eric Zimmerman executables (PECmd, EvtxECmd, RECmd). Then configure your MCP client with a command pointing to the Python interpreter and the server script, and set environment variables (PECMD_EXE, EVTX_EXE, RECMD_EXE) to the executable paths.

Key features of Ez Tools Mcp Server

Exposes eight forensic analysis tools as MCP tools
Parse Prefetch files individually or by folder
Parse Windows Event Log files individually or by folder
Perform full Registry hive analysis using DFIRBatch
Run specific Registry batch or hive file analysis
List available RECmd batch examples
Includes a health check tool to verify binary installation
Works exclusively on Windows

Use cases of Ez Tools Mcp Server

Analyze Prefetch files to identify executed programs in a forensic investigation
Parse Windows Event Logs to find security or system events
Perform comprehensive Registry hive analysis with DFIRBatch recipes
List and select available batch recipes for targeted Registry analysis

FAQ from Ez Tools Mcp Server

Can I use this server on macOS or Linux?

No. Eric Zimmerman’s Tools are Windows‑only executables, so the server works only on Windows.

What binaries do I need to install?

You must download and install PECmd, EvtxECmd, and RECmd from the Eric Zimmerman Tools website. Their paths are set via the PECMD_EXE, EVTX_EXE, and RECMD_EXE environment variables.

How do I connect the server to an MCP client?

Add a JSON configuration entry to your MCP client’s settings. Specify the Python interpreter path as the command, the server script path as an argument, and the three environment variables for the tool executables.

Is there a way to check if the tools are installed correctly?

Yes, the server provides an ez_tools_healthcheck tool that verifies the presence and availability of the Eric Zimmerman binaries.

What types of artifacts can I analyze?

The server supports parsing Prefetch files, Windows Event Log files, and Registry hives (full analysis or specific batch/plugin runs). It also lists available RECmd batch files.