list_available_pluginsLABSCO SUMMARY
Memory forensics asked as questions.
The analysis is still Volatility 3 — same plugins, same output. What changes is the interface: the investigator describes what they are looking for instead of recalling plugin syntax, which is the part that keeps occasional users out.
What it is
A bridge between the Volatility 3 memory forensics framework and an MCP client. Volatility plugins are exposed as tools, so a dump is questioned in natural language and answered by the framework itself.
What you get
- Running processes listed, drawn as a parent-child tree, or scanned for the ones that unlinked themselves
- Network connections recovered from the dump
- Potential code injection and other malicious artifacts surfaced
- The full command line each process was started with
- Metadata about the image you are working on, before you commit to a long plugin run
- The plugin catalogue your Volatility installation actually offers, so a custom plugin can be run with your own arguments
Requirements
Python 3.10 or higher, a working Volatility 3 Framework install, and the mcp and httpx packages. The path to Volatility 3 is set in a variable inside the server script before the first run.
Setup effort
Build from source — git clone https://github.com/bornpresident/Volatility-MCP-Server.git
USE CASES
01
Getting oriented in a dump you have just been handed
Image metadata first, then the process tree — enough to know what you are looking at before spending time on a heavy plugin.
02
Finding a process that hid itself
The live list and the scan disagree when something has been unlinked; running both is how the gap becomes visible.
03
Tracing what the machine was talking to
Network connections recovered from memory, read next to the processes that held them.
04
Hunting injected code
The injection hits first, then the command line of whatever owns them.
05
Reaching a plugin the tools do not name
List what your Volatility install actually provides, then run it with your own arguments.
14 tools
Listed in project docs. Your client may show a different list.
get_image_inforun_pstreerun_pslistrun_psscanrun_netscanrun_malfindrun_cmdlinerun_dlllistrun_handlesrun_filescanrun_memmaprun_custom_pluginlist_memory_dumpsBEFORE YOU INSTALL
What to know first
Tools you get
14 tools named in the project's documentation.
Requires
Python 3.10 or later
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
Clone the repository.
TERMINAL
git clone https://github.com/bornpresident/Volatility-MCP-Server.git
cd Volatility-MCP-ServerInstall the required Python packages:
TERMINAL
pip install mcp httpxOpen volatility_mcp_server.py and set the VOLATILITY_DIR variable to your Volatility 3 installation path.
Add the Claude Desktop configuration to your claude_desktop_config.json, which is at %APPDATA%\Claude\claude_desktop_config.json on Windows and at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS.
Restart Claude Desktop to apply the changes.
MCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"<YOUR_PATH_TO_VOLATILITY_MCP_SERVER>"
],
"env": {
"PYTHONPATH": "<YOUR_PATH_TO_VOLATILITY3>"
}
}
}
}
