Advertise
MCP.so
Sign In
E

Ez Tools MCP Server

@heejung0

Repository

Basic information

Category

Other

Transports

stdio

Author

heejung0

Submitted by

Heejung Kim

About Ez Tools MCP Server

EZ Tools MCP Server는 Eric Zimmerman's Tools에서 제공되는 도구들을 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 Windows Artifact(Prefetch, EventLog, Registry) 를 분석할 수 있습니다. (Eric Zimmerman's Tool의 특성상 Windows 환경에서만 사용 가능합니다.)

#windows#forensic

Ez Tools MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "ez-tools-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/EZ_tools_mcp_server.py"
      ],
      "env": {
        "PECMD_EXE": "/path/to/PECmd.exe",
        "EVTX_EXE": "/path/to/EvtxECmd.exe",
        "RECMD_EXE": "/path/to/RECmd.exe"
      }
    }
  }
}

Ez Tools MCP Server tools

8

Eric Zimmerman's Tools 바이너리 설치 상태 점검

Prefetch 파일이 들어있는 폴더 분석

Prefetch 파일 분석

Windows Eventlog 파일이 들어있는 폴더 분석

Windows Eventlog 파일 분석

DFIRBatch.reb 배치 파일을 사용하여 Registy 하이브 전체 분석

특정 Batch 파일 또는 하이브 파일 개별 분석

RECmd BatchExamples 폴더 내에 있는 배치 파일 목록 조회

Overview

What is Ez Tools Mcp Server?

Ez Tools Mcp Server is an MCP server that exposes Eric Zimmerman’s forensic tools as MCP tools. It allows MCP clients like Cursor and Claude Desktop to analyze Windows artifacts including Prefetch, EventLog, and Registry. Due to the nature of Eric Zimmerman’s Tools, this server works only on Windows.

How to use Ez Tools Mcp Server?

Clone the repository, create a Python virtual environment, and install dependencies. Download the required Eric Zimmerman executables (PECmd, EvtxECmd, RECmd). Then configure your MCP client with a command pointing to the Python interpreter and the server script, and set environment variables (PECMD_EXE, EVTX_EXE, RECMD_EXE) to the executable paths.

Key features of Ez Tools Mcp Server

  • Exposes eight forensic analysis tools as MCP tools
  • Parse Prefetch files individually or by folder
  • Parse Windows Event Log files individually or by folder
  • Perform full Registry hive analysis using DFIRBatch
  • Run specific Registry batch or hive file analysis
  • List available RECmd batch examples
  • Includes a health check tool to verify binary installation
  • Works exclusively on Windows

Use cases of Ez Tools Mcp Server

  • Analyze Prefetch files to identify executed programs in a forensic investigation
  • Parse Windows Event Logs to find security or system events
  • Perform comprehensive Registry hive analysis with DFIRBatch recipes
  • List and select available batch recipes for targeted Registry analysis

Frequently asked questions

1

Can I use this server on macOS or Linux?

No. Eric Zimmerman’s Tools are Windows‑only executables, so the server works only on Windows.

2

What binaries do I need to install?

You must download and install PECmd, EvtxECmd, and RECmd from the Eric Zimmerman Tools website. Their paths are set via the `PECMD_EXE`, `EVTX_EXE`, and `RECMD_EXE` environment variables.

3

How do I connect the server to an MCP client?

Add a JSON configuration entry to your MCP client’s settings. Specify the Python interpreter path as the command, the server script path as an argument, and the three environment variables for the tool executables.

4

Is there a way to check if the tools are installed correctly?

Yes, the server provides an `ez_tools_healthcheck` tool that verifies the presence and availability of the Eric Zimmerman binaries.

5

What types of artifacts can I analyze?

The server supports parsing Prefetch files, Windows Event Log files, and Registry hives (full analysis or specific batch/plugin runs). It also lists available RECmd batch files.

Comments

More Other MCP servers

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

Volley.sh

Volley

A good sequence diagram can solve almost any communication problem in engineering. Volley lets your agent write them as plain text, with the real request and response payloads on every arrow. It checks its own syntax wi

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

🚀 Model Context Protocol (MCP) Curriculum for Beginners

microsoft

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,

16.7K
Advertise