广告合作
MCP.so
登录

Unified Memory Forensics MCP Server

@x746b

代码仓库

基本信息

分类

记忆与知识

许可证

MIT

传输方式

stdio

作者

x746b

提交者

xtk

关于 Unified Memory Forensics MCP Server

Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.

#forensics

Unified Memory Forensics MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mem-forensics-mcp": {
      "command": "uv",
      "args": [
        "run",
        "--directory",
        "/opt/mem_forensics-mcp",
        "python",
        "-m",
        "mem_forensics_mcp.server"
      ],
      "env": {
        "VOLATILITY3_PATH": "/opt/volatility3"
      }
    }
  }
}

Unified Memory Forensics MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Unified Memory Forensics MCP Server?

A three-tier memory forensics engine that combines the speed of a Rust-based backend (memoxide) with the coverage of the Volatility3 framework. It is designed for digital forensics and incident response (DFIR) professionals analyzing memory dumps.

How to use Unified Memory Forensics MCP Server?

Install via uv pip install mem-forensics-mcp or from source with uv sync --extra full. Add to Claude CLI using claude mcp add mem-forensics-mcp. Invoke tools like memory_analyze_image, memory_full_triage, or memory_run_plugin with an image path.

Key features of Unified Memory Forensics MCP Server

  • Three-tier automatic routing: Rust, Python, Volatility3
  • Fast pslist, psscan, cmdline, dlllist, malfind, netscan, and more
  • Automated anomaly detection (DKOM, C2, injected code)
  • Credential extraction and YARA scanning
  • VirusTotal threat intelligence integration
  • Prebuilt Rust binaries for Linux aarch64 and x86_64

Use cases of Unified Memory Forensics MCP Server

  • Analyze a Windows memory dump for suspicious processes and injected code
  • Run full triage with risk scoring and correlation of findings
  • Drill down into specific processes or plugins (e.g., malfind, filescan)
  • Extract credentials, network connections, and command history
  • Integrate with VirusTotal to enrich indicators of compromise

常见问题

1

What runtime does it require?

Python 3.10+ and the `uv` package manager. Rust is optional (prebuilt binaries provided for Linux aarch64 and x86_64).

2

How does it handle Volatility3?

If Volatility3 is installed at `/opt/volatility3` it is auto-detected; otherwise set `VOLATILITY3_PATH` environment variable.

3

Where do the memory analysis results live?

Results are returned as JSON during tool calls; no persistent storage is mentioned.

4

What are the known limitations?

The README does not mention explicit limitations. The tiered architecture routes slow Vol3 plugins to Tier 3 automatically.

5

What transports or authentication does it use?

The server uses the Model Context Protocol (MCP) over stdio. No authentication mechanism is described.

评论

记忆与知识 分类下的更多 MCP 服务器

Stele

Stele-Dev

Shared memory for AI coding agents. Claude Code, Cursor and Codex read your project's decisions, lessons and tasks before they act.

server-noonien - shared memory MCP

sequico

Shared, serverless, conflict-free memory for AI agents: a multi-machine drop-in for the MCP memory knowledge graph.

Sooveryn

PANDAPROG

Sooveryn gives Claude Code a team of AI personas that remembers your project. Soov, the partner and team lead, keeps your decisions and how you work in a lasting memory, and finds them again by words and by meaning, from

Neither MCP

stonianua

Project context your AI can query through MCP — with source evidence.

Memlord

MyrikLD

Memlord is a remote MCP server available at https://app.memlord.com.

广告合作