Volatility-MCP-Server
If you are the rightful owner of Volatility-MCP-Server and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
A Model Context Protocol (MCP) server that integrates Volatility 3 memory forensics framework with Claude and other MCP-compatible LLMs.
list_available_plugins
Shows all Volatility plugins you can use
get_image_info
Provides information about a memory dump file
run_pstree
Shows the process hierarchy
run_pslist
Lists processes from the process list
run_psscan
Scans for processes including ones that might be hidden
run_netscan
Shows network connections in the memory dump
run_malfind
Detects potential code injection
run_cmdline
Shows command line arguments for processes
run_dlllist
Lists loaded DLLs for processes
run_handles
Shows file handles and other system handles
run_filescan
Scans for file objects in memory
run_memmap
Shows the memory map for a specific process
run_custom_plugin
Run any Volatility plugin with custom arguments
list_memory_dumps
Find memory dumps in a directory