The Sleuth Kit Mcp Server
@heejung0
The Sleuth Kit MCP Server는 Sleuth Kit CLI 도구(mmstat, mmls, fls, ifind, icat)를 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 파일시스템 이미지(E01, RAW, VMDK 등) 를 분석하고 파일을 추출할 수 있습니다.
Overview
What is The Sleuth Kit MCP Server?
The Sleuth Kit MCP Server exposes Sleuth Kit CLI tools (mmstat, mmls, fls, ifind, icat) as a Model Context Protocol (MCP) server. It allows MCP clients (e.g., Cursor, Claude Desktop) to analyze filesystem images (E01, RAW, VMDK) and extract files.
How to use The Sleuth Kit MCP Server?
Clone the repository, create a Python virtual environment, install dependencies, and install Sleuth Kit separately. Then configure your MCP client with a JSON entry specifying the Python interpreter path and the server script path, plus necessary environment variables (e.g., PATH). The server provides tools such as sleuthkit_healthcheck, disk_info, disk_partition_info, search_inode_by_path, files_in_directory, extract_files_by_inode, extract_directory_tree_by_inode, and istat_metadata.
Key features of The Sleuth Kit MCP Server
- Exposes multiple Sleuth Kit tools as MCP tools.
- Supports E01, RAW, VMDK disk image formats.
- Allows inode‑based file and directory extraction.
- Provides health check for Sleuth Kit installation.
- Works with any MCP‑compatible client.
Use cases of The Sleuth Kit MCP Server
- Analyze disk partitions and file system metadata.
- List files and directories inside a disk image.
- Extract specific files using inode numbers.
- Recover files while preserving original directory structure.
- Verify Sleuth Kit installation status.
FAQ from The Sleuth Kit MCP Server
What is the Sleuth Kit?
The Sleuth Kit is a collection of command‑line forensic tools for analyzing disk images and recovering files.
What are the runtime requirements?
Python 3, a virtual environment, Sleuth Kit binaries installed on the system, and (on Windows) the python-magic-bin package.
Where does the data reside?
All analysis is performed on locally provided disk image files; no remote data is accessed.
How is the server transported?
The server communicates via standard input/output (stdio) as defined by the MCP protocol.
Are there any authentication or configuration limits?
No authentication is required. The server depends on a local Sleuth Kit installation and correct PATH environment variable setup.
