For AI-assisted forensic analysis, include [`CLAUDE.md`](CLAUDE.md) in your case directory. It provides:
For AI-assisted forensic analysis, include CLAUDE.md in your case directory. It provides:
## More MCP options
Compare [MCP servers by category](/mcp-servers/categories), or browse [hosted MCP servers](/mcp-servers/remote) if you prefer an endpoint over a local process.
[Maintainer setup documentation](https://github.com/x746b/winforensics-mcp).
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| investigate_execution | Correlate Prefetch/Amcache/SRUM to prove binary execution |
| investigate_user_activity | Correlate Browser/ShellBags/LNK/RecentDocs for user activity |
| hunt_ioc | Hunt IOC (hash/filename/IP/domain) across all artifacts; yara_scan=True adds YARA threat intel |
| build_timeline | Build unified timeline from multiple artifact sources |
| file_analyze_pe | Static PE analysis - hashes, imports, exports, Authenticode program name, packer detection |
| disk_parse_prefetch | Parse Prefetch for execution evidence |
| disk_parse_amcache | Parse Amcache.hve for SHA1 hashes and timestamps |
| disk_parse_srum | Parse SRUDB.dat with exact/regex app filters, UTC ranges, derived network units, and optional aggregation |
| yara_scan_file | Scan file with 718 YARA rules (Mimikatz, CobaltStrike, webshells, APT, ransomware) |
| yara_scan_directory | Batch scan directory for malware |
| yara_list_rules | List available/bundled YARA rules |
| ioc_pack_list | List bundled and external IoC packs with license metadata |
| hunt_ioc_pack | Hunt behavioral IoCs across text exports, filenames, and PCAP payloads |
| vt_lookup_hash | Look up file hash (MD5/SHA1/SHA256) on VirusTotal |
| vt_lookup_behavior | Bounded sandbox domains, URLs, commands, registry/file writes; optional full-result persistence |
| vt_lookup_ip | Get IP address reputation and geolocation |
| vt_lookup_domain | Get domain reputation and categorization |
| vt_lookup_file | Calculate file hashes and look up on VirusTotal |
| pcap_get_stats | Get PCAP statistics - packet counts, protocols, top talkers |
| pcap_get_conversations | Extract TCP/UDP conversations with byte counts |
| pcap_get_dns | Extract DNS queries and responses |
| pcap_get_http | Extract HTTP requests with URLs, methods, user-agents |
| pcap_search | Search packet payloads for strings or regex patterns |
| pcap_find_suspicious | Detect C2 indicators, beaconing, DNS tunneling |
| apmx_parse | Parse .apmx64/.apmx86 capture - process info, modules, call counts |
| apmx_get_calls | Extract API calls with filtering, pagination, and time range support |
| apmx_get_call_details | Detailed records with parameter values, return values, timestamps |
| apmx_detect_patterns | Detect attack patterns (injection, hollowing, credential dumping) with MITRE ATT&CK IDs |
| apmx_correlate_handles | Track handle producer/consumer chains across API calls |
| apmx_get_injection_info | Enriched injection chain extraction (target PID, shellcode size, technique) |
| apmx_get_calls_around | Context window of calls around a specific record |
| apmx_search_params | Search all records for a specific parameter value |
| api_analyze_imports | Full PE import analysis with pattern detection and MITRE ATT&CK mapping |
| api_detect_patterns | Detect attack patterns from PE import tables |
| api_lookup | Look up Windows API signature (26,944 APIs with params, DLL, category) |
| api_search_category | Browse APIs by category (e.g., "Process Injection", "File Management") |
| die_analyze_file | Analyze file for packers, compilers, protectors, .NET |
| die_scan_directory | Batch scan directory for packed executables |
| die_get_packer_info | Get info about packer (difficulty, unpack tools) |
| disk_parse_mft | Parse $MFT with ADS metadata and timestomping detection |
| disk_parse_usn_journal | Parse $J for file operations and deleted files |
| browser_get_history | Parse Edge/Chrome/Firefox history and downloads |
| user_parse_lnk_files | Parse Windows shortcuts for target paths |
| user_parse_shellbags | Parse ShellBags (UsrClass.dat + NTUSER.DAT) for folder navigation, network shares and archive browsing |
| windows_search_parse | Parse an explicit Windows.edb with SIDR; filter and paginate file, internet, activity, and indexed-content records |
| ntds_get_object_by_sam | Read allowlisted metadata for an exact offline SAM account selector |
| ntds_get_object_sid | Return SID metadata with explicit ambiguity/completeness status |
| ntds_get_domain_info | Read domain metadata and evidence-backed forest-root attribution |
| ntds_get_trusts | Read paginated trust metadata without authentication secrets |
| evtx_list_files | List EVTX files in a directory |
| evtx_get_stats | Get event counts, time range, Event ID distribution |
| evtx_search | Search with filters, compact field projection, response budgets, and stable continuation |
| evtx_get_event | Retrieve a full normalized event using its source-bound reference |
| evtx_correlate_logon_id | Join subject/target LUID occurrences within an explicit time window |
| evtx_export | Persist filtered JSONL with a hash, completion diagnostics, and bounded preview |
| evtx_ntlm_operational_summary | Group NTLM 4021/4022/4023 events and surface rare process/user combinations |
| security_descriptor_decode | Decode bounded self-relative descriptor bytes from explicit hex/base64 |
| evtx_describe_security_descriptor | Describe an EVTX attribute descriptor or report its source placeholder |
| evtx_security_search | Pre-built security event searches (logon, process creation, etc.) |
| evtx_attack_summary | Compact TSV summary for rapid triage - one line per event, attack-relevant columns only |
| evtx_explain_event_id | Get Event ID description |
| registry_get_key | Get specific key and values |
| registry_search | Search values by pattern |
| registry_query | Paginated exact/substring/regex registry query with subtree scope, field projection, and diagnostics |
| registry_get_persistence | Get Run keys and services |
| registry_get_users | Get user accounts from SAM |
| registry_get_usb_history | Correlate USBSTOR identity, physical serial, WPD device names, and secondary volume labels |
| registry_get_system_info | Get OS version, hostname, timezone |
| registry_get_network | Get network configuration |
| ingest_parsed_csv | Import Eric Zimmerman CSV output (MFTECmd, PECmd, AmcacheParser, SrumECmd) |
| forensics_list_important_events | List important Event IDs by channel |
| forensics_list_registry_keys | List forensic registry keys by category |
| remote_collect_artifacts | Collect artifacts via WinRM (password or pass-the-hash) |
| remote_get_system_info | Get remote system info |
{
"mcpServers": {
"winforensics-mcp": {
"command": "winforensics-mcp"
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Read, search and edit files inside allowed directories with the Model Context Protocol reference Filesystem server.
Search and read your Drive — Docs, Sheets and files become context your assistant can actually use.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Chat with your second brain — search, read and write vault notes through the Local REST API.
Manage Proxmox hypervisors through a Model Context Protocol server, providing a clean interface for nodes, VMs, and containers.