Unified Memory Forensics MCP Server
@x746b
About Unified Memory Forensics MCP Server
Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"mem-forensics-mcp": {
"command": "uv",
"args": [
"run",
"--directory",
"/opt/mem_forensics-mcp",
"python",
"-m",
"mem_forensics_mcp.server"
],
"env": {
"VOLATILITY3_PATH": "/opt/volatility3"
}
}
}
}Tools
No tools detected
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Unified Memory Forensics MCP Server?
A three-tier memory forensics engine that combines the speed of a Rust-based backend (memoxide) with the coverage of the Volatility3 framework. It is designed for digital forensics and incident response (DFIR) professionals analyzing memory dumps.
How to use Unified Memory Forensics MCP Server?
Install via uv pip install mem-forensics-mcp or from source with uv sync --extra full. Add to Claude CLI using claude mcp add mem-forensics-mcp. Invoke tools like memory_analyze_image, memory_full_triage, or memory_run_plugin with an image path.
Key features of Unified Memory Forensics MCP Server
- Three-tier automatic routing: Rust, Python, Volatility3
- Fast pslist, psscan, cmdline, dlllist, malfind, netscan, and more
- Automated anomaly detection (DKOM, C2, injected code)
- Credential extraction and YARA scanning
- VirusTotal threat intelligence integration
- Prebuilt Rust binaries for Linux aarch64 and x86_64
Use cases of Unified Memory Forensics MCP Server
- Analyze a Windows memory dump for suspicious processes and injected code
- Run full triage with risk scoring and correlation of findings
- Drill down into specific processes or plugins (e.g., malfind, filescan)
- Extract credentials, network connections, and command history
- Integrate with VirusTotal to enrich indicators of compromise
FAQ from Unified Memory Forensics MCP Server
What runtime does it require?
Python 3.10+ and the uv package manager. Rust is optional (prebuilt binaries provided for Linux aarch64 and x86_64).
How does it handle Volatility3?
If Volatility3 is installed at /opt/volatility3 it is auto-detected; otherwise set VOLATILITY3_PATH environment variable.
Where do the memory analysis results live?
Results are returned as JSON during tool calls; no persistent storage is mentioned.
What are the known limitations?
The README does not mention explicit limitations. The tiered architecture routes slow Vol3 plugins to Tier 3 automatically.
What transports or authentication does it use?
The server uses the Model Context Protocol (MCP) over stdio. No authentication mechanism is described.
Frequently asked questions
What runtime does it require?
Python 3.10+ and the `uv` package manager. Rust is optional (prebuilt binaries provided for Linux aarch64 and x86_64).
How does it handle Volatility3?
If Volatility3 is installed at `/opt/volatility3` it is auto-detected; otherwise set `VOLATILITY3_PATH` environment variable.
Where do the memory analysis results live?
Results are returned as JSON during tool calls; no persistent storage is mentioned.
What are the known limitations?
The README does not mention explicit limitations. The tiered architecture routes slow Vol3 plugins to Tier 3 automatically.
What transports or authentication does it use?
The server uses the Model Context Protocol (MCP) over stdio. No authentication mechanism is described.
Basic information
More Memory & Knowledge MCP servers
minutes
silversteinEvery meeting, every idea, every voice note — searchable by your AI. Open-source, privacy-first conversation memory layer.
PLUR
plur-aiAI agents start every session with amnesia — you re-explain the project, repeat your preferences, and correct the same mistakes over and over. PLUR gives them a memory that persists. Your agent's corrections, preference
Mcp Knowledge Graph
shanehollomanMCP server enabling persistent memory for Claude through a local knowledge graph - fork focused on local development
📓 GistPad MCP
lostintangent📓 An MCP server for managing your personal knowledge, daily notes, and re-usable prompts via GitHub Gists
Anytype MCP Server
anyprotoAn MCP server enabling AI assistants to interact with Anytype - your encrypted, local and collaborative wiki - to organize objects, lists, and more through natural language.
Comments