MCP DFIR

MCP DFIR (Digital Forensics Incident Response) is an MCP server that gives AI agents the tools to perform memory, disk, and artifact forensics. It runs forensics tools inside an isolated Docker container and exposes them over the MCP stdio transport.

Example report based on the TryHackMe Volatility Essentials room.

Features

• Memory forensics via Volatility3
• Disk forensics via The Sleuth Kit
• File search with strings, grep, and find
• Archive extraction with unzip and tar
• Automatic Windows symbol downloading and conversion
• Linux symbol search and downloading from Abyss-W4tcher/volatility3-symbols
• Persistent command history — the agent never re-runs commands already completed
• Analyst notes — the agent records findings in structured markdown notes

Requirements

• Docker must be installed and running

Installation

pip install mcp-dfir

Setup

Claude Desktop config

Add the following to your Claude Desktop claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-dfir": {
      "command": "python -m mcp_dfir"
    }
  }
}

Case directory layout

The MCP server expects evidence and artifacts to be organized under a case directory:

my_case/
├── evidence/    # Place memory dumps, disk images, etc. here (read-only)
├── artifacts/   # Output location for extracted files (read-write)
├── symbols/     # Volatility symbol files (auto-populated on download)
└── analysis/    # Command history and analyst notes (auto-generated)

Place all evidence files (.mem, .img, .e01, etc.) inside the evidence/ directory before starting a session.

Args

usage: mcp-dfir [-h] [--version] [-d CASE_DIR]

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  -d, --case-dir CASE_DIR
                        Working directory for the case, default: current directory

MCP Tools

Tool	Description
run_volatility_command	Runs Volatility3 (vol) for memory forensics
download_windows_symbol	Downloads and converts Windows PDB symbols for Volatility3
download_linux_symbol	Downloads a Linux symbol file from Abyss-W4tcher/volatility3-symbols
search_linux_symbols	Searches the Linux symbol map by regex to find matching symbol files
run_sleuthkit_command	Runs any Sleuth Kit tool for disk forensics
run_strings	Runs strings on a file
run_grep	Runs grep on files
run_find	Runs find to search for files
list_files	Lists files in evidence, artifacts, or symbols
unzip_file	Extracts a zip archive into /artifacts
untar_file	Extracts a tar archive into /artifacts
get_hash	Computes a hash of a file
get_command_history	Returns all previously run commands
get_command_result	Returns the output of a specific past command
show_analyst_notes_summary	Lists all analyst notes
show_analyst_note	Retrieves the content of a specific analyst note
add_analyst_note	Creates a new analyst note
update_analyst_note	Updates an existing analyst note

Build from source

# Create virtual environment
python3 -m venv .venv

# Activate (Linux/macOS)
source .venv/bin/activate
# Activate (Windows)
.venv/Scripts/activate.ps1

# Install dependencies
pip install .[dev]

# Run
mcp-dfir --case-dir /path/to/your/case
# or
python3 -m mcp_dfir --case-dir /path/to/your/case