官方说明10 个来源MCP 服务8 天前
Gaffx/volatility-mcp
Memory forensics with Volatility 3, exposing plugins such as pslist and netscan through REST APIs
在 GitHub 查看 ↗直链 · 无中转页
配置模板（请按你的客户端调整）
claude mcp add volatility-mcp -- npx -y volatility-mcp
这是根据仓库名生成的可粘贴骨架，命令行参数与包名请以该项目 README 为准。
- ★ 数取值
- 52 ★ · Gaffx/volatility-mcp · 取自 GitHub 搜索 API · （2026-10-16 20:00:20 核对）
- 来源明细
- 收录自 punkpeye/awesome-mcp-servers 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-10-09 · 最近见到 2026-10-16 · 共见到 32 次 · 被 10 个来源列出
- 评分构成
- 综合分 1,003 · 52 ★ · 10 个来源 · mcp
常见问题（答案都来自我们的记录）
怎么安装？
我们【没有】从该仓库取到安装命令（我们的 install 覆盖率只有约 4%）。请看它的 README 或 releases 页。
它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
仓库
Gaffx/volatility-mcp；我们收录于 2026-10-09；最近见到 2026-10-16。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。第三方质量标记
Your AI Assistant in Memory Forensics
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Overview
Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like pslist and netscan become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications
Features
* **Volatility 3 Integration:** Leverages the Volatility 3 framework for memory image analysis.
* **FastAPI Backend:** Provides RESTful APIs to interact with Volatility plugins.
* **Web Front End Support (future feature):** Designed to connect with a web-based front end for interactive analysis.
* **Model Context Protocol (MCP):** Enables standardized communication with MCP clients like Claude Desktop.
* **Plugin Support:** Supports various Volatility plugins, including pslist for process listing and netscan for network connection analysis.
Architecture
The project architecture consists of the following components:
* **MCP Client:** MCP client like Claude Desktop that interacts with the FastAPI backend.
* **FastAPI Server:** A Python-based server that exposes Volatility plugins as API endpoints.
* **Volatility 3:** The memory forensics framework performing the analysis.
This architecture allows users to analyze memory images through MCP clients like Claude Desktop. Users can use natural language prompts to perform memory forensics analysis such as
show me the list of the processes in memory image x, or show me all the external connections made
Getting Started
Prerequisites
* Python 3.7+ installed on your system
* Volatility 3 binary installed (see Volatility 3 Installation Guide) and added to your env path called **VOLATILITY_BIN**
Installation
1. Clone the repository:
2. Install the required Python dependencies:
3. Start the FastAPI server to expose Volatility 3 APIs:
4. Install Claude Desktop (see Claude Desktop
5. To configure Claude Desktop as a volatility MCP client, navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the following configuration details
6. Please note that the -i option in the config.json file specifies the directory path of your memory image file.
Alternatively, update this file directly:
/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json
Usage
1. Start the FastAPI server as described above.
2. Connect an MCP client (e.g., Claude Desktop) to the FastAPI server.
3. Start the prompt by asking questions regarding the memory image in scope, such as showing me the running processes, creating a tree relationship graph for process x, or showing me all external RFC1918 connections.
Future Features and Enhancements
* **Native Volatility Python Integration:** Incorporate Volatility Python SDK directly in the code base as opposed to subprocess volatility binary
Volatility MCP seamlessly integrates Volatility 3's powerful memory analysis with FastAPI and the Model Context Protocol (MCP). Experience memory forensics without barriers as plugins like pslist and netscan become accessible through clean REST APIs, connecting memory artifacts directly to AI assistants and web applications
Features
* **Volatility 3 Integration:** Leverages the Volatility 3 framework for memory image analysis.
* **FastAPI Backend:** Provides RESTful APIs to interact with Volatility plugins.
* **Web Front End Support (future feature):** Designed to connect with a web-based front end for interactive analysis.
* **Model Context Protocol (MCP):** Enables standardized communication with MCP clients like Claude Desktop.
* **Plugin Support:** Supports various Volatility plugins, including pslist for process listing and netscan for network connection analysis.
Architecture
The project architecture consists of the following components:
* **MCP Client:** MCP client like Claude Desktop that interacts with the FastAPI backend.
* **FastAPI Server:** A Python-based server that exposes Volatility plugins as API endpoints.
* **Volatility 3:** The memory forensics framework performing the analysis.
This architecture allows users to analyze memory images through MCP clients like Claude Desktop. Users can use natural language prompts to perform memory forensics analysis such as
show me the list of the processes in memory image x, or show me all the external connections made
Getting Started
Prerequisites
* Python 3.7+ installed on your system
* Volatility 3 binary installed (see Volatility 3 Installation Guide) and added to your env path called **VOLATILITY_BIN**
Installation
1. Clone the repository:
2. Install the required Python dependencies:
3. Start the FastAPI server to expose Volatility 3 APIs:
4. Install Claude Desktop (see Claude Desktop
5. To configure Claude Desktop as a volatility MCP client, navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the following configuration details
6. Please note that the -i option in the config.json file specifies the directory path of your memory image file.
Alternatively, update this file directly:
/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json
Usage
1. Start the FastAPI server as described above.
2. Connect an MCP client (e.g., Claude Desktop) to the FastAPI server.
3. Start the prompt by asking questions regarding the memory image in scope, such as showing me the running processes, creating a tree relationship graph for process x, or showing me all external RFC1918 connections.
Future Features and Enhancements
* **Native Volatility Python Integration:** Incorporate Volatility Python SDK directly in the code base as opposed to subprocess volatility binary
- 来源
- awesome · https://github.com/Gaffx/volatility-mcp
- 按领域浏览
- MCP 服务
- Traction
- 52 ★
- 收录于
- 昨天
更多MCP 服务
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。