Gaffx/volatility-mcp
FreeVolatility 3.x 的 MCP 服务器，允许使用 AI 助手执行内存取证分析。通过 REST API 和 LLM 使 pslist 和 netscan 等插件易于访问。
FreeFree tier
About Gaffx/volatility-mcp
Volatility MCP is an open-source MCP server that integrates Volatility 3's memory forensics capabilities with FastAPI and the Model Context Protocol (MCP). It allows AI assistants like Claude Desktop to perform memory analysis through natural language prompts. The server exposes Volatility plugins such as pslist and netscan as clean REST APIs, enabling users to analyze memory images, list processes, detect network connections, and more. The architecture consists of an MCP client, a FastAPI backend, and Volatility 3, making memory forensics accessible without deep command-line expertise.
Key Features
Volatility 3 Integration: Leverages the Volatility 3 framework for memory image analysis.
FastAPI Backend: Provides RESTful APIs to interact with Volatility plugins.
Model Context Protocol (MCP): Enables standardized communication with MCP clients like Claude Desktop.
Plugin Support: Supports various Volatility plugins including pslist (process listing) and netscan (network connection analysis).
Natural Language Interface: Users can issue prompts such as 'show me the list of the processes' or 'show me all the external connections made'.
Future Web Front End Support: Designed to connect with a web-based front end for interactive analysis.
Pros & Cons
Pros
- Seamlessly connects Volatility 3 with AI assistants via MCP.
- Enables natural language interaction for memory forensics.
- Open-source and free to use.
- REST API design allows integration with web applications.
- Supports common Volatility plugins out of the box.
Cons
- Requires Python 3.7+ and manual installation of Volatility 3 binary.
- Configuration of Claude Desktop MCP client requires editing JSON config with absolute paths.
- Web front end is a future feature and not yet available.
- Limited to plugins that are explicitly supported; custom plugins may need additional work.
Best For
Memory forensics analysis using AI assistants (e.g., Claude Desktop).Listing running processes from a memory image.Detecting external network connections and RFC1918 addresses.Creating process tree relationship graphs.Educational and research purposes in digital forensics.
FAQ
What is Volatility MCP?
Volatility MCP is an MCP server for Volatility 3.x that allows AI assistants to perform memory forensics analysis through natural language prompts and REST APIs.
How do I configure Claude Desktop to use Volatility MCP?
Navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the configuration details pointing to the vol_mcp_server.py script with the memory image path.
Which Volatility plugins are supported?
Currently supports pslist for process listing and netscan for network connection analysis, with more plugins being added.
What are the prerequisites?
Python 3.7+, Volatility 3 binary installed with environment variable VOLATILITY_BIN set, and the required Python dependencies installed from requirements.txt.