Three-tier engine automatically routes each tool to the fastest backend:
Most monitoring and observability work still happens through a UI a human drives. Mem Forensics MCP MCP server moves it into the conversation instead. Three-tier engine automatically routes each tool to the fastest backend:.
The server publishes 14 tools. What each one is for:
winforensics-mcp — Windows disk forensics (EVTX, Registry, MFT, Prefetch, YARA, PCAP)mac_forensics-mcp — macOS DFIR (Unified Logs, FSEvents, Spotlight, Plists)Tier — Enginememory_analyze_image — 1->2memory_run_plugin — 1->3memory_list_plugins — -memory_list_sessions — -memory_get_status — -memory_full_triage — 1+2memory_hunt_process_anomalies — 2memory_get_process_tree — 2memory_find_injected_code — 1->2Configuration is passed through the environment: VOLATILITY3_PATH. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
## Getting it running
The server ships on PyPI as `mem-forensics-mcp`, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.
## How it compares
This sits in the monitoring and observability group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Mem Forensics MCP's toolset — `winforensics-mcp`, `mac_forensics-mcp`, `Tier` and 11 more — is a fair guide to whether it matches your workflow. It is maintained by x746b; worth a glance at recent repository activity before you build anything load-bearing on it.
We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.
## Things to watch
- It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
- With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Mem Forensics MCP.
- Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.
| Tool | What it does |
|---|---|
| winforensics-mcp | Windows disk forensics (EVTX, Registry, MFT, Prefetch, YARA, PCAP) |
| mac_forensics-mcp | macOS DFIR (Unified Logs, FSEvents, Spotlight, Plists) |
| Tier | Engine |
| memory_analyze_image | 1->2 |
| memory_run_plugin | 1->3 |
| memory_list_plugins | - |
| memory_list_sessions | - |
| memory_get_status | - |
| memory_full_triage | 1+2 |
| memory_hunt_process_anomalies | 2 |
| memory_get_process_tree | 2 |
| memory_find_injected_code | 1->2 |
| memory_find_c2_connections | 1+2 |
| memory_get_command_history | 1+2 |
{
"mcpServers": {
"mem-forensics": {
"command": "uvx",
"args": ["mem-forensics-mcp"],
"env": {
"VOLATILITY3_PATH": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| VOLATILITY3_PATH | Filesystem location the server is allowed to use. | Optional |
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
Errors with full context — stack traces, issue triage and AI-powered root-cause analysis from Sentry's server.
Enables enhanced web research capabilities for large language models through intelligent search queuing and advanced content extraction.
Automates browser interactions and enables Large Language Models (LLMs) to interact with web pages through Playwright and Chrome DevTools Protocol
Guides tool usage by providing recommendations for MCP tools at each problem-solving stage.