MCP 0.1.3 — experimental Intel64 Mac CryptoMem

volatility-mcp 0.1.3

Pins CryptoMem 0.4.0 and adds experimental legacy Intel64 mac.cryptomem.CryptoMem
to the established add-on installation, discovery and manual/offline execution
policy. Ten MCP tools, Windows/Linux behavior, XP-independent discovery and the
client-neutral architecture are preserved. No Workbench implementation or runtime
dependency is added. Reviewed 0.3.0 hashes permit upgrading the installed adapter.

Use the existing Mac symbol pack only for an exactly matching captured Darwin
kernel. Nested submaps fail explicitly as incomplete; this can affect ordinary
shared-region processes. Apple silicon, Intel32 Mac and modern macOS are
unsupported. No real-memory macOS or Linux validation is claimed.

Workbench must update its backend source/wheel pins and repackage to embed this
inventory. Source users can install this core version and run plugins-install
with clients idle. The existing full Linux symbol download/index is independent.

The full volatility_mcp-0.1.3-py3-none-any.whl is 929,334,231 bytes and includes all four pinned official starter symbol packs plus the Linux catalog. Verify SHA256SUMS, then install the wheel with Python 3.12+ and configure an isolated Volatility 3 2.28.2 analyzer. GitHub source archives do not contain the starter packs. The additional 19.53 GiB Linux community tables are installed separately with symbols-install --linux-all; they are not embedded in this wheel or Git. Exact captured-kernel symbols are always required.

Validation: 181 isolated core tests (one optional skip), 18 installed adapter checks, actual MCP invocation/error paths, timeout/cancellation simulations, and successful Python 3.12/3.13 main CI. Source: 5b66bc42d8e349f162fb005107d12c94061b7073. CryptoMem source: f462c79dd249f2251698620485e1241a3b35d5cc. No private evidence uploaded.