広告掲載
MCP.so
ログイン

macOS Forensics MCP Server

@x746b

リポジトリ

基本情報

カテゴリ

その他

トランスポート

stdio

作者

x746b

投稿者

xtk

macOS Forensics MCP Server について

MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).

#forensics#macos#dfir

macOS Forensics MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "mac-forensics": {
      "command": "/opt/mac_forensics-mcp/.venv/bin/python",
      "args": [
        "-m",
        "mac_forensics_mcp.server"
      ],
      "env": {}
    }
  }
}

macOS Forensics MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is macOS Forensics Mcp Server?

A Model Context Protocol (MCP) server that provides structured forensic analysis tools for macOS Digital Forensics and Incident Response (DFIR). It reduces context overhead when investigating incidents with LLMs by offering 23 tools covering Unified Logs, FSEvents, Spotlight, Plists, SQLite databases, Extended Attributes, System Logs, and more.

How to use macOS Forensics Mcp Server?

Clone the repository to /opt/macOS/mac_forensics-mcp, create a virtual environment with uv, and install the package. Then configure it with Claude Code using the claude mcp add command or by manually adding a JSON entry to mcpServers, specifying the command to run python -m mac_forensics_mcp.server. Tools are invoked by calling their function names (e.g., mac_unified_logs_search) from an MCP client.

Key features of macOS Forensics Mcp Server

  • Structured queries instead of raw text searches
  • Automatic timestamp normalization (Mac Absolute Time → UTC)
  • Pre-built security event detection patterns
  • Cross-artifact correlation and timeline building
  • Pagination to prevent context overflow
  • Artifact discovery to determine available data

Use cases of macOS Forensics Mcp Server

  • Investigate user account creation, deletion, or modification
  • Analyze file downloads via quarantine events and extended attributes
  • Detect security events such as SSH sessions, sudo usage, or auth failures
  • Build a unified timeline from multiple macOS artifacts
  • Identify external device activity using fsck_apfs.log

よくある質問

1

What are the runtime dependencies?

Python 3.10+, the `uv` package manager, and `mcp >= 1.0.0`. The `biplist` package is optional for malformed plists.

2

Does it require external forensic tools?

External tools are optional: `unifiedlog_iterator` for `.logarchive` bundles, `FSEParser` for FSEvents, and `spotlight_parser` for Spotlight indexes. If not installed, corresponding tools will not be available.

3

How do I configure custom paths for external tools?

Set environment variables `MAC_FORENSICS_UNIFIEDLOG_ITERATOR_PATH`, `MAC_FORENSICS_FSEPARSER_PATH`, and `MAC_FORENSICS_SPOTLIGHT_PARSER_PATH`. Defaults are `/opt/macOS/` paths.

4

What macOS artifacts are supported?

Unified Logs, FSEvents, Spotlight index, Plist files, SQLite databases (KnowledgeC, Safari, TCC, quarantine), Extended Attributes, and system logs (fsck_apfs). Supports user account details, browsing history, download history, and TCC permissions.

5

Is transport or authentication supported?

The server communicates via the MCP stdio transport (command/args configuration). No authentication is documented; it reads local triage directories specified by the user.

コメント

「その他」の他のコンテンツ

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K

Glasswarp

Glasswarp

See and control a real Windows PC you own — from any MCP client, locally or remotely. Observe (UIA + screenshots), click/type/drag/scroll, launch apps, owner Live View. BYOH: your machine, your key.

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K
広告掲載