Volatility-MCP-Server
If you are the rightful owner of Volatility-MCP-Server and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
A Model Context Protocol (MCP) server that integrates Volatility 3 memory forensics framework with Claude and other MCP-compatible LLMs.
This project bridges the powerful memory forensics capabilities of the Volatility 3 Framework with Large Language Models (LLMs) through the Model Context Protocol (MCP). It allows you to perform memory forensics analysis using natural language by exposing Volatility plugins as MCP tools that can be invoked directly by Claude or other MCP-compatible LLMs.
Features
- Natural Language Memory Forensics: Ask Claude to analyze memory dumps using natural language
- Process Analysis: Examine running processes, parent-child relationships, and hidden processes
- Network Forensics: Identify network connections in memory dumps
- Malware Detection: Find potential code injection and other malicious artifacts
- DLL Analysis: Examine loaded DLLs and modules
Tools
list_available_plugins
Shows all Volatility plugins you can use
get_image_info
Provides information about a memory dump file
run_pstree
Shows the process hierarchy
run_pslist
Lists processes from the process list
run_psscan
Scans for processes including ones that might be hidden
run_netscan
Shows network connections in the memory dump
run_malfind
Detects potential code injection
run_cmdline
Shows command line arguments for processes
run_dlllist
Lists loaded DLLs for processes
run_handles
Shows file handles and other system handles
run_filescan
Scans for file objects in memory
run_memmap
Shows the memory map for a specific process
run_custom_plugin
Run any Volatility plugin with custom arguments
list_memory_dumps
Find memory dumps in a directory
