Forensic Analyzer MCP

What it does

Enables AI agents to perform read-only, bounded inspection of forensic evidence files. It interfaces directly with industry-standard binaries to extract metadata, identify strings/indicators, and analyze Windows memory dumps without simulating output.

Key features

• Metadata Extraction: Uses file and ExifTool to detect MIME types, calculate SHA-256 hashes, and find extension mismatches.
• String Analysis: Runs strings -n 6 to identify IP addresses, URLs, and suspicious keywords within binary files.
• Memory Forensics: Integrates Volatility 3 to analyze Windows memory dumps, reporting status for plugins like pslist and malfind.
• Chain of Custody: Maintains a local append-only JSONL log of all analysis actions.
• Threat Intel: Supports hash-only reputation lookups via VirusTotal API.

Installation

• Claude Desktop:

{
  "mcpServers": {
    "forensic-analyzer": {
      "command": "node",
      "args": ["/absolute/path/to/forensic-analyzer-mcp/dist/index.js"],
      "env": {
        "EVIDENCE_ROOT": "/absolute/path/to/evidence",
        "ANALYSIS_LOG_PATH": "/absolute/path/to/logs/analysis-log.jsonl"
      }
    }
  }
}

• Codex: Add to ~/.codex/config.toml under [mcp_servers.forensic-analyzer].
• Claude Code: Use claude mcp add with the specified env vars.

Supported hosts

Claude Desktop, Codex, Claude Code