The three-tier routing is the design: pslist, malfind, netscan and similar go to the Rust engine, the analysis tools sit in Python, and anything else falls through to Volatility3 so nothing is lost. Check the status call first — which tiers are available depends on what your install picked up.
A Python MCP server for memory forensics that routes each tool across three engines — a Rust child process (memoxide), Python analyzers, and Volatility3 — picking the fastest backend that covers the request.
- A memory image loaded and analysed, with session state tracked and listed across an investigation
- A full triage pass over an image, for when you need the shape of it before the detail
- Process work: the process tree, command history, and hunting for process anomalies
- Threat hunting: injected code found, C2 connections identified, and credentials extracted, with YARA and VirusTotal integration on the Python tier
- Artifacts recovered — a process dumped, a VAD region dumped, and dumpable files listed
- Any Volatility3 plugin run directly, with the available plugins listed, covering filescan, handles, svcscan, driverscan and the rest
- Server status reported, so you can see which engines are actually available before relying on one
A recent Python with uv, and a memory image on disk. Prebuilt Rust binaries ship for aarch64-linux and x86_64-linux and are auto-detected; Volatility3 is auto-detected at /opt/volatility3, or you point the server at wherever yours lives. The full install brings YARA and VirusTotal support; the minimal one is Volatility3 only.
One command — uv pip install mem-forensics-mcp