For AI-assisted forensic analysis, include [`CLAUDE.md`](CLAUDE.md) in your case directory. It provides:
Most file and storage access work still happens through a UI a human drives. Winforensics MCP MCP server moves it into the conversation instead. For AI-assisted forensic analysis, include CLAUDE.md in your case directory. It provides:.
The server publishes 14 tools. What each one is for:
Category — Capabilitiesapmx_parse — Parse .apmx64/.apmx86 capture - process info, modules, call countsapmx_get_calls — Extract API calls with filtering, pagination, and time range supportapmx_get_call_details — Detailed records with parameter values, return values, timestampsapmx_detect_patterns — Detect attack patterns (injection, hollowing, credential dumping) with MITRE ATT&CK IDsapmx_correlate_handles — Track handle producer/consumer chains across API callsapmx_get_injection_info — Enriched injection chain extraction (target PID, shellcode size, technique)apmx_get_calls_around — Context window of calls around a specific recordapmx_search_params — Search all records for a specific parameter valueapi_analyze_imports — Full PE import analysis with pattern detection and MITRE ATT&CK mappingapi_detect_patterns — Detect attack patterns from PE import tablesapi_lookup — Look up Windows API signature (26,944 APIs with params, DLL, category)Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.
Configuration is passed through the environment: VIRUSTOTAL_API_KEY. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
## How it compares
Among the file and storage access options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Winforensics MCP's toolset — `Category`, `apmx_parse`, `apmx_get_calls` and 11 more — is a fair guide to whether it matches your workflow. It is maintained by x746b; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Winforensics MCP's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
## Things to watch
- It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
- With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Winforensics MCP.
- Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
- Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.
| Tool | What it does |
|---|---|
| Category | Capabilities |
| apmx_parse | Parse .apmx64/.apmx86 capture - process info, modules, call counts |
| apmx_get_calls | Extract API calls with filtering, pagination, and time range support |
| apmx_get_call_details | Detailed records with parameter values, return values, timestamps |
| apmx_detect_patterns | Detect attack patterns (injection, hollowing, credential dumping) with MITRE ATT&CK IDs |
| apmx_correlate_handles | Track handle producer/consumer chains across API calls |
| apmx_get_injection_info | Enriched injection chain extraction (target PID, shellcode size, technique) |
| apmx_get_calls_around | Context window of calls around a specific record |
| apmx_search_params | Search all records for a specific parameter value |
| api_analyze_imports | Full PE import analysis with pattern detection and MITRE ATT&CK mapping |
| api_detect_patterns | Detect attack patterns from PE import tables |
| api_lookup | Look up Windows API signature (26,944 APIs with params, DLL, category) |
| api_search_category | Browse APIs by category (e.g., "Process Injection", "File Management") |
| Orchestrators | The Orchestrators tool exposed by this server. |
| Variable | Description | Required |
|---|---|---|
| VIRUSTOTAL_API_KEY | Credential the server authenticates with. | Yes |
Scoped local file access — read, write, search and reorganise files in directories you explicitly allow.
Search and read your Drive — Docs, Sheets and files become context your assistant can actually use.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Chat with your second brain — search, read and write vault notes through the Local REST API.
Connects AI models to an Obsidian knowledge base for direct access and manipulation of notes and folders.