volatility-mcpThis repo hosts an MCP server for volatility3.x

Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). It enables users to analyze memory images through MCP clients like Claude Desktop, using natural language prompts such as 'show me the list of processes in memory image x.' This tool provides Volatility 3 Integration, leveraging the Volatility 3 framework for memory image analysis. It also offers a FastAPI Backend, providing RESTful APIs to interact with Volatility plugins, along with plugin support for various Volatility plugins, including pslist and netscan. The project architecture includes a FastAPI Server, which exposes Volatility plugins as API endpoints, and a Volatility 3 framework, performing the analysis. The tool allows users to use natural language prompts to perform memory forensics analysis. It also plans to support a web front end and features such as Yara integration, native Volatility Python integration, and multi-image analysis in the future. To use Volatility MCP, users must first install the required Python dependencies and start the FastAPI server with UVicorn. They must then configure Claude Desktop as a volatility MCP client by modifying the claude_desktop_config.json file with the absolute path to the MCP server and the memory image file. Finally, they can interact with the memory image by using natural language prompts with the MCP client.