Volatility-MCP-Server

Volatility-MCP-Server

3.4

If you are the rightful owner of Volatility-MCP-Server and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.

A Model Context Protocol (MCP) server that integrates Volatility 3 memory forensics framework with Claude and other MCP-compatible LLMs.

list_available_plugins

Shows all Volatility plugins you can use

get_image_info

Provides information about a memory dump file

run_pstree

Shows the process hierarchy

run_pslist

Lists processes from the process list

run_psscan

Scans for processes including ones that might be hidden

run_netscan

Shows network connections in the memory dump

run_malfind

Detects potential code injection

run_cmdline

Shows command line arguments for processes

run_dlllist

Lists loaded DLLs for processes

run_handles

Shows file handles and other system handles

run_filescan

Scans for file objects in memory

run_memmap

Shows the memory map for a specific process

run_custom_plugin

Run any Volatility plugin with custom arguments

list_memory_dumps

Find memory dumps in a directory