Memory Forensics MCP Server

What it is

A Python MCP server for memory forensics that routes each tool across three engines — a Rust child process (memoxide), Python analyzers, and Volatility3 — picking the fastest backend that covers the request.

What you get

• A memory image loaded and analysed, with session state tracked and listed across an investigation
• A full triage pass over an image, for when you need the shape of it before the detail
• Process work: the process tree, command history, and hunting for process anomalies
• Threat hunting: injected code found, C2 connections identified, and credentials extracted, with YARA and VirusTotal integration on the Python tier
• Artifacts recovered — a process dumped, a VAD region dumped, and dumpable files listed
• Any Volatility3 plugin run directly, with the available plugins listed, covering filescan, handles, svcscan, driverscan and the rest
• Server status reported, so you can see which engines are actually available before relying on one

Requirements

A recent Python with uv, and a memory image on disk. Prebuilt Rust binaries ship for aarch64-linux and x86_64-linux and are auto-detected; Volatility3 is auto-detected at /opt/volatility3, or you point the server at wherever yours lives. The full install brings YARA and VirusTotal support; the minimal one is Volatility3 only.

Setup effort

One command — uv pip install mem-forensics-mcp

Tools you get

19 tools named in the project's documentation.