MCP 0.1.4 — masked CryptoMem formats and local-only extraction

volatility-mcp 0.1.4

Pins CryptoMem 0.5.0 with independently opt-in English BIP-39 checksum validation,
Bitcoin WIF and BIP-32 xprv/tprv validation, and ambiguous transaction-ID candidates.
Existing Windows/Linux/legacy Intel64 Mac commands, address defaults and renderer
columns remain. New richer artifacts are versioned separately. No MCP tool,
framework, Workbench code or runtime dependency is added. Manual selection,
forced offline execution and XP-independent discovery remain.

Secret values stay masked in ordinary output. Explicit extraction requires an
enabled secret detector and private output root. All MCP saved-output routes block
full extraction and unclassified/temporary extraction output; masked findings are
readable. Process output files use umask 077. No recovered secrets, endpoints,
balances, wallet software or transactions are contacted or used during validation.

Synthetic/public-vector validation only; captured-kernel Linux/macOS testing,
modern Mac/Apple-silicon support and nested-submap handling remain outstanding.
Linux symbols must match the captured kernel exactly. A running symbol index is
independent of this release; only its final exit status and complete receipt can
establish readiness.

Workbench 0.1.2 pins core 0.1.3 and embeds the earlier inventory. Adopting this
release requires a tested backend source/wheel pin update, analyzer add-on update,
native rebuild and repackage; it does not inherit these changes automatically.
No UI redesign or Linux desktop packaging is part of this increment. Existing
Developer ID signing/notarization remains outstanding.

Published source: 2887c77283da4a45860d8ac2f3042027401257a0 (PR #31).
The full volatility_mcp-0.1.4-py3-none-any.whl is 929,336,323 bytes
(886.284183 MiB), SHA-256
339dd2bb671893c9a3c5606486c4b9e7cbb824b86fd125d9980a4c86ae329975.
The guarded publisher and local download verification checked the wheel, manifest
and all four embedded pack digests. Python 3.12/3.13 main CI, add-on installation,
real MCP transport checks, code quality/secrets and CodeQL passed for that source.
This release remains independent of the active Linux community index.

The full wheel includes four pinned official starter packs and the Linux catalog;
the additional community Linux tables are installed separately. GitHub source
archives do not contain the packs. Verify SHA256SUMS before installation.

MCP 0.1.3 — experimental Intel64 Mac CryptoMem

volatility-mcp 0.1.3

Pins CryptoMem 0.4.0 and adds experimental legacy Intel64 mac.cryptomem.CryptoMem
to the established add-on installation, discovery and manual/offline execution
policy. Ten MCP tools, Windows/Linux behavior, XP-independent discovery and the
client-neutral architecture are preserved. No Workbench implementation or runtime
dependency is added. Reviewed 0.3.0 hashes permit upgrading the installed adapter.

Use the existing Mac symbol pack only for an exactly matching captured Darwin
kernel. Nested submaps fail explicitly as incomplete; this can affect ordinary
shared-region processes. Apple silicon, Intel32 Mac and modern macOS are
unsupported. No real-memory macOS or Linux validation is claimed.

Workbench must update its backend source/wheel pins and repackage to embed this
inventory. Source users can install this core version and run plugins-install
with clients idle. The existing full Linux symbol download/index is independent.

The full volatility_mcp-0.1.3-py3-none-any.whl is 929,334,231 bytes and includes all four pinned official starter symbol packs plus the Linux catalog. Verify SHA256SUMS, then install the wheel with Python 3.12+ and configure an isolated Volatility 3 2.28.2 analyzer. GitHub source archives do not contain the starter packs. The additional 19.53 GiB Linux community tables are installed separately with symbols-install --linux-all; they are not embedded in this wheel or Git. Exact captured-kernel symbols are always required.

Validation: 181 isolated core tests (one optional skip), 18 installed adapter checks, actual MCP invocation/error paths, timeout/cancellation simulations, and successful Python 3.12/3.13 main CI. Source: 5b66bc42d8e349f162fb005107d12c94061b7073. CryptoMem source: f462c79dd249f2251698620485e1241a3b35d5cc. No private evidence uploaded.

MCP 0.1.2 — symbols included

volatility-mcp 0.1.2

Adds the pinned CryptoMem 0.3.0 Linux x86-64 adapter to existing discovery and
execution. Windows command/output schema, ten MCP tools, manual selection,
forced offline analysis, evidence handling and timeout/cancellation remain intact.
Linux symbols must match the captured kernel; other Linux architectures remain
unsupported until tested. Synthetic validation is documented in VALIDATION.md;
real-memory Linux validation remains outstanding.

The full release wheel contains the same four verified official starter symbol
packs, plus a pinned catalog/installer for 10,255 community Linux x86-64 tables
(20,974,550,776 compressed bytes). Explicit symbols-install --linux-all or
--linux-banner provisions the shared symbol store with SHA-256, size, ISF and
banner verification, resumable installation, and offline indexing. Analysis
never downloads these tables. The 19.53 GiB community data is not embedded in
the wheel. No universal kernel coverage or real-memory validation is claimed.

Workbench must adopt this release's source commit and full-wheel digest in its
backend and distribution pins, then pass its package/native validation and rebuild.
No UI redesign or Linux desktop package is included.

Published full wheel: volatility_mcp-0.1.2-py3-none-any.whl, 929,333,670 bytes
(886.281652 MiB). Verify it against the attached SHA256SUMS before installation:
python -m pip install /path/to/volatility_mcp-0.1.2-py3-none-any.whl.
The attached symbol-bundle.json records exact source and pack provenance.
Python 3.12+, Python dependencies and a configured Volatility analyzer are still
required. GitHub source archives contain the catalog/installer, not symbol packs.

Workbench adoption and native macOS repackaging are complete in
Workbench 0.1.1.
That artifact is an ad-hoc signed prerelease, not Apple-notarized. Linux real-memory
validation remains outstanding.

MCP 0.1.1 — symbols included

Full MCP wheel with all four pinned official symbol packs included. Normal setup installs symbols from the package; no separate symbol download is needed.

Download volatility_mcp-0.1.1-py3-none-any.whl (928,541,140 bytes; 885.53 MiB), verify against SHA256SUMS, then install with python -m pip install /path/to/volatility_mcp-0.1.1-py3-none-any.whl. Python 3.12+, Python dependencies and a configured Volatility analyzer are still required. GitHub's Source code archives do not contain the symbol packs.

Pack hashes, upstream URLs and source revision are in symbol-bundle.json. The unchanged symbol packs retain their Volatility Software License notices. These are snapshots, not symbols for every kernel; unmatched images may need additional symbols. Existing packaged Workbench apps are not replaced by installing this standalone server.

Source: 0fb6fbce5d5e8b12814718f0538f4969e72b20ec. Each embedded pack and each uploaded asset is SHA-256 verified. The bundle integration was tested with actual offline symbol installation/indexing and synthetic tests; no real-memory recovery validation is claimed.

Core 0.1.0 — independent Workbench integration

Standalone core release for the Workbench repository separation.

• Keeps the ten MCP tools, forensic execution, saved-result reuse, and existing evidence/report contracts.
• Provides public integration API revision 1 and a packaged authoritative report specification.
• Moves the application to volatility-workbench; legacy module launchers give migration guidance or delegate when installed.

Verified with 91 core tests (one optional skip), an isolated wheel installation, and both supported MCP protocol modes. No real memory investigation was repeated.