Advertise
MCP.so
Sign In
T

The Sleuth Kit MCP Server

@heejung0

Repository

Basic information

Category

Developer Tools

Transports

stdio

Author

heejung0

Submitted by

Heejung Kim

About The Sleuth Kit MCP Server

The Sleuth Kit MCP Server는 Sleuth Kit CLI 도구(mmstat, mmls, fls, ifind, icat)를 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 파일시스템 이미지(E01, RAW, VMDK 등) 를 분석하고 파일을 추출할 수 있습니다.

#forensic

The Sleuth Kit MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "sleuthkit-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/sleuthkit_mcp_server.py"
      ],
      "env": {
        "PATH": "/path/to/sleuthkit/bin"
      }
    }
  }
}

The Sleuth Kit MCP Server tools

8

Sleuth Kit 바이너리 설치 상태 점검

file 명령어와 mmstat으로 디스크 이미지 파일 정보 확인

mmls로 디스크 파티션 정보 분석

ifind로 메인 파티션 오프셋을 기준으로 직접 경로 탐색을 통해 해당 폴더의 inode 번호 확인

fls로 폴더의 내용 확인

icat으로 inode 번호를 활용한 파일 추출

icat으로 원본 경로 구조를 유지하며 inode 번호를 활용한 파일 추출

istat으로 디스크 이미지에서 inode를 기반으로 해당 파일들의 메타 정보 확인

Overview

What is The Sleuth Kit MCP Server?

The Sleuth Kit MCP Server exposes Sleuth Kit CLI tools (mmstat, mmls, fls, ifind, icat) as a Model Context Protocol (MCP) server. It allows MCP clients (e.g., Cursor, Claude Desktop) to analyze filesystem images (E01, RAW, VMDK) and extract files.

How to use The Sleuth Kit MCP Server?

Clone the repository, create a Python virtual environment, install dependencies, and install Sleuth Kit separately. Then configure your MCP client with a JSON entry specifying the Python interpreter path and the server script path, plus necessary environment variables (e.g., PATH). The server provides tools such as sleuthkit_healthcheck, disk_info, disk_partition_info, search_inode_by_path, files_in_directory, extract_files_by_inode, extract_directory_tree_by_inode, and istat_metadata.

Key features of The Sleuth Kit MCP Server

  • Exposes multiple Sleuth Kit tools as MCP tools.
  • Supports E01, RAW, VMDK disk image formats.
  • Allows inode‑based file and directory extraction.
  • Provides health check for Sleuth Kit installation.
  • Works with any MCP‑compatible client.

Use cases of The Sleuth Kit MCP Server

  • Analyze disk partitions and file system metadata.
  • List files and directories inside a disk image.
  • Extract specific files using inode numbers.
  • Recover files while preserving original directory structure.
  • Verify Sleuth Kit installation status.

Frequently asked questions

1

What is the Sleuth Kit?

The Sleuth Kit is a collection of command‑line forensic tools for analyzing disk images and recovering files.

2

What are the runtime requirements?

Python 3, a virtual environment, Sleuth Kit binaries installed on the system, and (on Windows) the `python-magic-bin` package.

3

Where does the data reside?

All analysis is performed on locally provided disk image files; no remote data is accessed.

4

How is the server transported?

The server communicates via standard input/output (stdio) as defined by the MCP protocol.

5

Are there any authentication or configuration limits?

No authentication is required. The server depends on a local Sleuth Kit installation and correct `PATH` environment variable setup.

Comments

More Developer Tools MCP servers

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R

9

ArtiBot Cloud MCP - Zhijiangyun 智匠云

bofob

ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation

1

Pugi

Pugi Inc.

Pugi is an AI product team in your chat. Describe a business in a few sentences and Pugi plans, designs, builds and checks a real website, shows a live preview, and puts it live on its own address. Ask for changes in pla

Reelier

Maxime Houle

Agents make claims. Reelier writes receipts — record an agent's tool-call workflow once, replay it deterministically at 0 tokens, and diff runs to catch drift.

GripForge

gripforgeai

The tools your AI needs to make your games. Turn prompts into production-ready game assets — animated characters with their weapons attached, seamless textures, terrain, VFX, HUDs — and playable game kits Unity, Godot, U

1
Advertise