广告合作
MCP.so
登录
E

Ez Tools MCP Server

@heejung0

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

heejung0

提交者

Heejung Kim

关于 Ez Tools MCP Server

EZ Tools MCP Server는 Eric Zimmerman's Tools에서 제공되는 도구들을 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 Windows Artifact(Prefetch, EventLog, Registry) 를 분석할 수 있습니다. (Eric Zimmerman's Tool의 특성상 Windows 환경에서만 사용 가능합니다.)

#windows#forensic

Ez Tools MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "ez-tools-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/EZ_tools_mcp_server.py"
      ],
      "env": {
        "PECMD_EXE": "/path/to/PECmd.exe",
        "EVTX_EXE": "/path/to/EvtxECmd.exe",
        "RECMD_EXE": "/path/to/RECmd.exe"
      }
    }
  }
}

Ez Tools MCP Server 工具

8

Eric Zimmerman's Tools 바이너리 설치 상태 점검

Prefetch 파일이 들어있는 폴더 분석

Prefetch 파일 분석

Windows Eventlog 파일이 들어있는 폴더 분석

Windows Eventlog 파일 분석

DFIRBatch.reb 배치 파일을 사용하여 Registy 하이브 전체 분석

특정 Batch 파일 또는 하이브 파일 개별 분석

RECmd BatchExamples 폴더 내에 있는 배치 파일 목록 조회

概览

What is Ez Tools Mcp Server?

Ez Tools Mcp Server is an MCP server that exposes Eric Zimmerman’s forensic tools as MCP tools. It allows MCP clients like Cursor and Claude Desktop to analyze Windows artifacts including Prefetch, EventLog, and Registry. Due to the nature of Eric Zimmerman’s Tools, this server works only on Windows.

How to use Ez Tools Mcp Server?

Clone the repository, create a Python virtual environment, and install dependencies. Download the required Eric Zimmerman executables (PECmd, EvtxECmd, RECmd). Then configure your MCP client with a command pointing to the Python interpreter and the server script, and set environment variables (PECMD_EXE, EVTX_EXE, RECMD_EXE) to the executable paths.

Key features of Ez Tools Mcp Server

  • Exposes eight forensic analysis tools as MCP tools
  • Parse Prefetch files individually or by folder
  • Parse Windows Event Log files individually or by folder
  • Perform full Registry hive analysis using DFIRBatch
  • Run specific Registry batch or hive file analysis
  • List available RECmd batch examples
  • Includes a health check tool to verify binary installation
  • Works exclusively on Windows

Use cases of Ez Tools Mcp Server

  • Analyze Prefetch files to identify executed programs in a forensic investigation
  • Parse Windows Event Logs to find security or system events
  • Perform comprehensive Registry hive analysis with DFIRBatch recipes
  • List and select available batch recipes for targeted Registry analysis

常见问题

1

Can I use this server on macOS or Linux?

No. Eric Zimmerman’s Tools are Windows‑only executables, so the server works only on Windows.

2

What binaries do I need to install?

You must download and install PECmd, EvtxECmd, and RECmd from the Eric Zimmerman Tools website. Their paths are set via the `PECMD_EXE`, `EVTX_EXE`, and `RECMD_EXE` environment variables.

3

How do I connect the server to an MCP client?

Add a JSON configuration entry to your MCP client’s settings. Specify the Python interpreter path as the command, the server script path as an argument, and the three environment variables for the tool executables.

4

Is there a way to check if the tools are installed correctly?

Yes, the server provides an `ez_tools_healthcheck` tool that verifies the presence and availability of the Eric Zimmerman binaries.

5

What types of artifacts can I analyze?

The server supports parsing Prefetch files, Windows Event Log files, and Registry hives (full analysis or specific batch/plugin runs). It also lists available RECmd batch files.

评论

其他 分类下的更多 MCP 服务器

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

Health by Dr Brad

Dr Brad Stanfield

Health by Dr Brad works out a health plan from your own results: which screening is due at your age, and evidence-based suggestions, each with the reason and the published guideline or study behind it. Your record is one

P

PickFu MCP

PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K

YOUB

Connect your AI assistant to your own YOUB endurance training account. Read recorded activities with full analysis, planned sessions, race goals, wellness (HRV, sleep, resting HR) and your athletic profile. Create or mov

广告合作