Ez Tools Mcp Server
@heejung0
EZ Tools MCP Server는 Eric Zimmerman's Tools에서 제공되는 도구들을 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 Windows Artifact(Prefetch, EventLog, Registry) 를 분석할 수 있습니다. (Eric Zimmerman's Tool의 특성상 Windows 환경에서만 사용 가능합니다.)
Overview
What is Ez Tools Mcp Server?
Ez Tools Mcp Server is an MCP server that exposes Eric Zimmerman’s forensic tools as MCP tools. It allows MCP clients like Cursor and Claude Desktop to analyze Windows artifacts including Prefetch, EventLog, and Registry. Due to the nature of Eric Zimmerman’s Tools, this server works only on Windows.
How to use Ez Tools Mcp Server?
Clone the repository, create a Python virtual environment, and install dependencies. Download the required Eric Zimmerman executables (PECmd, EvtxECmd, RECmd). Then configure your MCP client with a command pointing to the Python interpreter and the server script, and set environment variables (PECMD_EXE, EVTX_EXE, RECMD_EXE) to the executable paths.
Key features of Ez Tools Mcp Server
- Exposes eight forensic analysis tools as MCP tools
- Parse Prefetch files individually or by folder
- Parse Windows Event Log files individually or by folder
- Perform full Registry hive analysis using DFIRBatch
- Run specific Registry batch or hive file analysis
- List available RECmd batch examples
- Includes a health check tool to verify binary installation
- Works exclusively on Windows
Use cases of Ez Tools Mcp Server
- Analyze Prefetch files to identify executed programs in a forensic investigation
- Parse Windows Event Logs to find security or system events
- Perform comprehensive Registry hive analysis with DFIRBatch recipes
- List and select available batch recipes for targeted Registry analysis
FAQ from Ez Tools Mcp Server
Can I use this server on macOS or Linux?
No. Eric Zimmerman’s Tools are Windows‑only executables, so the server works only on Windows.
What binaries do I need to install?
You must download and install PECmd, EvtxECmd, and RECmd from the Eric Zimmerman Tools website. Their paths are set via the PECMD_EXE, EVTX_EXE, and RECMD_EXE environment variables.
How do I connect the server to an MCP client?
Add a JSON configuration entry to your MCP client’s settings. Specify the Python interpreter path as the command, the server script path as an argument, and the three environment variables for the tool executables.
Is there a way to check if the tools are installed correctly?
Yes, the server provides an ez_tools_healthcheck tool that verifies the presence and availability of the Eric Zimmerman binaries.
What types of artifacts can I analyze?
The server supports parsing Prefetch files, Windows Event Log files, and Registry hives (full analysis or specific batch/plugin runs). It also lists available RECmd batch files.
