MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).
macOS Forensics Mcp Server is an MCP project maintained in the x746b/mac_forensics-mcp repository. The maintainer describes its purpose as “MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR)”. Read the project documentation for the complete scope.
The project provides a local client configuration using /absolute/path/to/mac_forensics-mcp/.venv/bin/python3. Follow the repository’s build and installation steps before copying it, and replace example paths with the paths on your own computer.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| mac_list_artifacts | Discover available artifacts in a triage collection |
| mac_unified_logs_search | Search logs with regex, filters, time range |
| mac_unified_logs_security_events | Get pre-defined security events (user_created, ssh_session, etc.) |
| mac_unified_logs_stats | Get log statistics: time range, top subsystems |
| mac_plist_read | Read and parse plist, optionally extract key path |
| mac_plist_search | Search for keys matching pattern |
| mac_plist_timestamps | Extract all timestamp values with UTC conversion |
| mac_knowledgec_app_usage | App usage from KnowledgeC.db |
| mac_safari_history | Safari browsing history |
| mac_safari_searches | Extract search queries from Safari |
| mac_tcc_permissions | TCC permissions (camera, mic, screen recording) |
| mac_quarantine_events | File download history |
| mac_get_user_accounts | List users including deleted accounts |
| mac_get_user_timeline | Build timeline for specific user account |
| mac_fsevents_search | Search file system events (create, delete, modify, rename) |
| mac_fsevents_stats | Get FSEvents statistics |
| mac_get_extended_attributes | Get xattr for file (quarantine, download URL, etc.) |
| mac_spotlight_search | Search Spotlight index for file metadata |
| mac_spotlight_stats | Get Spotlight index statistics |
| mac_parse_fsck_apfs_log | Parse fsck_apfs.log for volume creation, external devices, anti-forensics |
| mac_fsck_apfs_stats | Get fsck_apfs.log statistics: devices, volumes, time range |
| mac_build_timeline | Build unified timeline from multiple artifacts |
| mac_investigate_event | Deep investigation with evidence correlation |
{
"mcpServers": {
"mac-forensics": {
"command": "/absolute/path/to/mac_forensics-mcp/.venv/bin/python3",
"args": [
"-m",
"mac_forensics_mcp.server"
]
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
Errors with full context — stack traces, issue triage and AI-powered root-cause analysis from Sentry's server.
Connect Flutter applications with AI coding assistants via the Model Context Protocol.
Enables natural language interaction with Splunk Enterprise and Cloud for searching data and managing resources.