Three-tier engine automatically routes each tool to the fastest backend:
Three-tier engine automatically routes each tool to the fastest backend:
## Recorded tools
- `winforensics-mcp` — Windows disk forensics (EVTX, Registry, MFT, Prefetch, YARA, PCAP)
- `mac_forensics-mcp` — macOS DFIR (Unified Logs, FSEvents, Spotlight, Plists)
- `memory_analyze_image` — 1->2
- `memory_run_plugin` — 1->3
- `memory_list_plugins` — -
- `memory_list_sessions` — -
- `memory_get_status` — -
- `memory_full_triage` — 1+2
- `memory_hunt_process_anomalies` — 2
- `memory_get_process_tree` — 2
- `memory_find_injected_code` — 1->2
- `memory_find_c2_connections` — 1+2
- `memory_get_command_history` — 1+2
## More MCP options
Compare [MCP servers by category](/mcp-servers/categories), or browse [hosted MCP servers](/mcp-servers/remote) if you prefer an endpoint over a local process.
[Maintainer setup documentation](https://github.com/x746b/mem_forensics-mcp).
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| memory_analyze_image | 1->2 |
| memory_run_plugin | 1->3 |
| memory_list_plugins | - |
| memory_list_sessions | - |
| memory_get_status | - |
| memory_full_triage | 1+2 |
| memory_hunt_process_anomalies | 2 |
| memory_get_process_tree | 2 |
| memory_find_injected_code | 1->2 |
| memory_find_c2_connections | 1+2 |
| memory_get_command_history | 1+2 |
| memory_extract_credentials | 2 |
| memory_dump_process | 2 |
| memory_dump_vad | 2 |
| memory_list_dumpable_files | 3 |
| vt_lookup_hash | VirusTotal hash lookup |
| vt_lookup_ip | VirusTotal IP reputation |
| vt_lookup_domain | VirusTotal domain reputation |
| vt_lookup_file | Hash file + VT lookup |
{
"mcpServers": {
"mem-forensics-mcp": {
"command": "/absolute/path/to/.venv/bin/python3",
"args": [
"-m",
"mem_forensics_mcp.server"
]
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
Errors with full context — stack traces, issue triage and AI-powered root-cause analysis from Sentry's server.
Connect Flutter applications with AI coding assistants via the Model Context Protocol.
Enables natural language interaction with Splunk Enterprise and Cloud for searching data and managing resources.