Your AI Assistant in Memory Forensics Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like pslist and netscan become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications Volatility 3 Integration: Leverages
Add this skill
npx mdskills install Gaffx/volatility-mcpIntegrates Volatility 3 memory forensics with MCP for AI-driven memory analysis
Your AI Assistant in Memory Forensics
Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like pslist and netscan become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications
pslist for process listing and netscan for network connection analysis.The project architecture consists of the following components:
This architecture allows users to analyze memory images through MCP clients like Claude Desktop. Users can use natural language prompts to perform memory forensics analysis such as show me the list of the processes in memory image x, or show me all the external connections made
Clone the repository:
git clone
cd
Install the required Python dependencies:
pip install -r requirements.txt
Start the FastAPI server to expose Volatility 3 APIs:
uvicorn volatility_fastapi_server:app
Install Claude Desktop (see Claude Desktop
To configure Claude Desktop as a volatility MCP client, navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the following configuration details
Please note that the -i option in the config.json file specifies the directory path of your memory image file.
{
"mcpServers": {
"vol": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py", "-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/"
]
}
}
}
Alternatively, update this file directly:
/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json
Contributions are welcome! Please follow these steps to contribute:
git checkout -b feature/my-feature).git commit -m 'Add some feature').git push origin feature/my-feature).Install via CLI
npx mdskills install Gaffx/volatility-mcpYour AI Assistant in Memory Forensics is a free, open-source AI agent skill. Your AI Assistant in Memory Forensics Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like pslist and netscan become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications Volatility 3 Integration: Leverages
Install Your AI Assistant in Memory Forensics with a single command:
npx mdskills install Gaffx/volatility-mcpThis downloads the skill files into your project and your AI agent picks them up automatically.
Your AI Assistant in Memory Forensics works with Claude Code, Claude Desktop, Cursor, Vscode Copilot, Windsurf, Continue Dev, Gemini Cli, Amp, Roo Code, Goose. Skills use the open SKILL.md format which is compatible with any AI coding agent that reads markdown instructions.