Your AI Assistant in Memory Forensics

1![](https://img.shields.io/badge/License-Apache%202.0-blue?style=plastic&logo=adobefonts)
2<p align="center">
3<img src="assets/logo.png" height="300">
4</p>
5<h1 align="center">
6Your AI Assistant in Memory Forensics
7</h1>
8 
9## Overview
10Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like `pslist` and `netscan` become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications
11 
12## Features
13* **Volatility 3 Integration:** Leverages the Volatility 3 framework for memory image analysis.
14* **FastAPI Backend:** Provides RESTful APIs to interact with Volatility plugins.
15* **Web Front End Support (future feature):** Designed to connect with a web-based front end for interactive analysis.
16* **Model Context Protocol (MCP):** Enables standardized communication with MCP clients like Claude Desktop.
17* **Plugin Support:** Supports various Volatility plugins, including `pslist` for process listing and `netscan` for network connection analysis.
18 
19 
20## Architecture
21 
22The project architecture consists of the following components:
23 
24* **MCP Client:** MCP client like Claude Desktop that interacts with the FastAPI backend.
25* **FastAPI Server:** A Python-based server that exposes Volatility plugins as API endpoints.
26* **Volatility 3:** The memory forensics framework performing the analysis.
27 
28This architecture allows users to analyze memory images through MCP clients like Claude Desktop. Users can use natural language prompts to perform memory forensics analysis such as
29show me the list of the processes in memory image x, or show me all the external connections made
30 
31## Getting Started
32 
33### Prerequisites
34 
35* Python 3.7+ installed on your system
36* Volatility 3 binary installed (see [Volatility 3 Installation Guide](https://github.com/volatilityfoundation/volatility3?tab=readme-ov-file#installing)) and added to your env path called **VOLATILITY_BIN**
37 
38### Installation
39 
401. Clone the repository:
41 
42    ```
43    git clone <repository_url>
44    cd <repository_directory>
45    ```
46 
472. Install the required Python dependencies:
48 
49    ```
50    pip install -r requirements.txt
51    ```
52 
533. Start the FastAPI server to expose Volatility 3 APIs:
54 
55    ```
56    uvicorn volatility_fastapi_server:app 
57    ```
584. Install Claude Desktop (see [Claude Desktop](https://claude.ai/download)
595. To configure Claude Desktop as a volatility MCP client, navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the following configuration details
606. Please note that the `-i` option in the config.json file specifies the directory path of your memory image file.
61 
62   ```
63       {
64        "mcpServers": {
65          "vol": {
66            "command": "python",
67            "args": [
68              "/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py", "-i",     
69              "/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
70            ]
71          }
72        }
73    }
74   ```
75Alternatively, update this file directly:
76 
77`/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json`
78 
79### Usage
80 
811. Start the FastAPI server as described above.
822. Connect an MCP client (e.g., Claude Desktop) to the FastAPI server.
833. Start the prompt by asking questions regarding the memory image in scope, such as showing me the running processes, creating a tree relationship graph for process x, or showing me all external RFC1918 connections.
84 
85![image](https://github.com/user-attachments/assets/23f6fd4f-76b4-4255-a0a6-534ed3459bb3)
86![image](https://github.com/user-attachments/assets/e5cd74ae-72ff-4c5b-8bd8-fbeb13488a70)
87![image](https://github.com/user-attachments/assets/779707ef-4910-4503-b6b0-43f6c37075ef)
88![image](https://github.com/user-attachments/assets/668e9b91-463a-424f-a3ef-ee2baf44308d)
89 
90## Future Features and Enhancements
91 
92*  **Native Volatility Python Integration:** Incorporate Volatility Python SDK directly in the code base as opposed to subprocess volatility binary
93*   **Yara Integration:** Implement functionality to dump a process from memory and scan it with Yara rules for malware analysis.
94*   **Multi-Image Analysis:** Enable the analysis of multiple memory images simultaneously to correlate events and identify patterns across different systems.
95*   **Adding more Volatility Plugins:** add more volatility plugins to expand the scope of memory analysis
96*   **GUI Enhancements:** Develop a user-friendly web interface for interactive memory analysis and visualization.
97*   **Automated Report Generation:** Automate the generation of detailed reports summarizing the findings of memory analysis.
98*   **Advanced Threat Detection:** Incorporate advanced techniques for detecting sophisticated threats and anomalies in memory.
99 
100## Contributing
101 
102Contributions are welcome! Please follow these steps to contribute:
103 
1041. Fork this repository.
1052. Create a new branch (`git checkout -b feature/my-feature`).
1063. Commit your changes (`git commit -m 'Add some feature'`).
1074. Push to your branch (`git push origin feature/my-feature`).
1085. Open a pull request.
109 
110[![MseeP.ai Security Assessment Badge](https://mseep.net/pr/gaffx-volatility-mcp-badge.png)](https://mseep.ai/app/gaffx-volatility-mcp)
111 
112 
113