投稿ログイン

Unified Memory Forensics MCP Server

@x746b

リポジトリ

Unified Memory Forensics MCP Server について

Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.

基本情報

カテゴリ

メモリとナレッジ

ライセンス

MIT

ランタイム

rust

トランスポート

stdio

公開者

x746b

投稿者

xtk

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "mem-forensics-mcp": {
      "command": "uv",
      "args": [
        "run",
        "--directory",
        "/opt/mem_forensics-mcp",
        "python",
        "-m",
        "mem_forensics_mcp.server"
      ],
      "env": {
        "VOLATILITY3_PATH": "/opt/volatility3"
      }
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Unified Memory Forensics MCP Server?

A three-tier memory forensics engine that combines the speed of a Rust-based backend (memoxide) with the coverage of the Volatility3 framework. It is designed for digital forensics and incident response (DFIR) professionals analyzing memory dumps.

How to use Unified Memory Forensics MCP Server?

Install via uv pip install mem-forensics-mcp or from source with uv sync --extra full. Add to Claude CLI using claude mcp add mem-forensics-mcp. Invoke tools like memory_analyze_image, memory_full_triage, or memory_run_plugin with an image path.

Key features of Unified Memory Forensics MCP Server

Three-tier automatic routing: Rust, Python, Volatility3
Fast pslist, psscan, cmdline, dlllist, malfind, netscan, and more
Automated anomaly detection (DKOM, C2, injected code)
Credential extraction and YARA scanning
VirusTotal threat intelligence integration
Prebuilt Rust binaries for Linux aarch64 and x86_64

Use cases of Unified Memory Forensics MCP Server

Analyze a Windows memory dump for suspicious processes and injected code
Run full triage with risk scoring and correlation of findings
Drill down into specific processes or plugins (e.g., malfind, filescan)
Extract credentials, network connections, and command history
Integrate with VirusTotal to enrich indicators of compromise

FAQ from Unified Memory Forensics MCP Server

What runtime does it require?

Python 3.10+ and the uv package manager. Rust is optional (prebuilt binaries provided for Linux aarch64 and x86_64).

How does it handle Volatility3?

If Volatility3 is installed at /opt/volatility3 it is auto-detected; otherwise set VOLATILITY3_PATH environment variable.

Where do the memory analysis results live?

Results are returned as JSON during tool calls; no persistent storage is mentioned.

What are the known limitations?

The README does not mention explicit limitations. The tiered architecture routes slow Vol3 plugins to Tier 3 automatically.

What transports or authentication does it use?

The server uses the Model Context Protocol (MCP) over stdio. No authentication mechanism is described.

コメント

「メモリとナレッジ」の他のコンテンツ

Obsidian MCP Server

StevenStavrakis

A simple MCP server for Obsidian

Context7 MCP - Up-to-date Docs For Any Cursor Prompt

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

Notion MCP Server

A Model Context Protocol server for connecting Notion to MCP-compatible clients

JupyterMCP - Jupyter Notebook Model Context Protocol Integration

A Model Context Protocol (MCP) for Jupyter Notebook

Dash Api Docs Mcp Server

MCP server for Dash, the macOS API documentation browser