广告合作
MCP.so
登录

macOS Forensics MCP Server

@x746b

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

x746b

提交者

xtk

关于 macOS Forensics MCP Server

MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).

#forensics#macos#dfir

macOS Forensics MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mac-forensics": {
      "command": "/opt/mac_forensics-mcp/.venv/bin/python",
      "args": [
        "-m",
        "mac_forensics_mcp.server"
      ],
      "env": {}
    }
  }
}

macOS Forensics MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is macOS Forensics Mcp Server?

A Model Context Protocol (MCP) server that provides structured forensic analysis tools for macOS Digital Forensics and Incident Response (DFIR). It reduces context overhead when investigating incidents with LLMs by offering 23 tools covering Unified Logs, FSEvents, Spotlight, Plists, SQLite databases, Extended Attributes, System Logs, and more.

How to use macOS Forensics Mcp Server?

Clone the repository to /opt/macOS/mac_forensics-mcp, create a virtual environment with uv, and install the package. Then configure it with Claude Code using the claude mcp add command or by manually adding a JSON entry to mcpServers, specifying the command to run python -m mac_forensics_mcp.server. Tools are invoked by calling their function names (e.g., mac_unified_logs_search) from an MCP client.

Key features of macOS Forensics Mcp Server

  • Structured queries instead of raw text searches
  • Automatic timestamp normalization (Mac Absolute Time → UTC)
  • Pre-built security event detection patterns
  • Cross-artifact correlation and timeline building
  • Pagination to prevent context overflow
  • Artifact discovery to determine available data

Use cases of macOS Forensics Mcp Server

  • Investigate user account creation, deletion, or modification
  • Analyze file downloads via quarantine events and extended attributes
  • Detect security events such as SSH sessions, sudo usage, or auth failures
  • Build a unified timeline from multiple macOS artifacts
  • Identify external device activity using fsck_apfs.log

常见问题

1

What are the runtime dependencies?

Python 3.10+, the `uv` package manager, and `mcp >= 1.0.0`. The `biplist` package is optional for malformed plists.

2

Does it require external forensic tools?

External tools are optional: `unifiedlog_iterator` for `.logarchive` bundles, `FSEParser` for FSEvents, and `spotlight_parser` for Spotlight indexes. If not installed, corresponding tools will not be available.

3

How do I configure custom paths for external tools?

Set environment variables `MAC_FORENSICS_UNIFIEDLOG_ITERATOR_PATH`, `MAC_FORENSICS_FSEPARSER_PATH`, and `MAC_FORENSICS_SPOTLIGHT_PARSER_PATH`. Defaults are `/opt/macOS/` paths.

4

What macOS artifacts are supported?

Unified Logs, FSEvents, Spotlight index, Plist files, SQLite databases (KnowledgeC, Safari, TCC, quarantine), Extended Attributes, and system logs (fsck_apfs). Supports user account details, browsing history, download history, and TCC permissions.

5

Is transport or authentication supported?

The server communicates via the MCP stdio transport (command/args configuration). No authentication is documented; it reads local triage directories specified by the user.

评论

其他 分类下的更多 MCP 服务器

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K

ICSS

chokcoco

不止于 CSS

20.7K

FastMCP v2 🚀

jlowin

🚀 The fast, Pythonic way to build MCP servers and clients.

26.0K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

广告合作