What is a #dfir MCP server?
An MCP server tagged #dfir implements the Model Context Protocol so AI assistants like Claude, Cursor, and VS Code can access dfir-related tools, data, or APIs.
3 #dfir MCP Servers & Clients
Every MCP server and client below is tagged #dfir — install one to give Claude, Cursor, VS Code, or any other MCP-compatible client access to dfir tools.
All
macOS Forensics Mcp Server
x746b
MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).
Added 6 months ago
WM
Winforensics Mcp
x746b
Added 6 months ago
Mlab - IOC & Threat Intelligence
mlab-sh
Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C
Added 2 months ago
Frequently asked questions
Common questions about MCP servers and clients tagged #dfir
How many #dfir MCP servers and clients are there?
mcp.so currently lists 3 MCP servers and clients tagged #dfir.
How do I install a #dfir MCP server?
Open any server below and copy its install snippet into Claude Desktop, Cursor, VS Code, or another MCP client's configuration — remote servers need no separate download.