macOS Forensics Mcp Server
About
MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).
Details
- Author
- x746b
- Downloads
- 337
- Categories
- Other
Jump to
- Structured queries instead of raw text searches
- Automatic timestamp normalization (Mac Absolute Time → UTC)
- Pre-built security event detection patterns
- Cross-artifact correlation and timeline building
- Pagination to prevent context overflow
- Artifact discovery to determine available data
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
macOS Forensics Mcp ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository to /opt/macOS/mac_forensics-mcp, create a virtual environment with uv, and install the package. Then configure it with Claude Code using the claude mcp add command or by manually adding a JSON entry to mcpServers, specifying the command to run python -m mac_forensics_mcp.server. Tools are invoked by calling their function names (e.g., mac_unified_logs_search) from an MCP client.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"macos forensics mcp server": {
"mac-forensics": {
"command": "/opt/mac_forensics-mcp/.venv/bin/python",
"args": [
"-m",
"mac_forensics_mcp.server"
],
"env": []
}
}
}
}McpServers
{
"mac-forensics": {
"command": "/opt/mac_forensics-mcp/.venv/bin/python",
"args": [
"-m",
"mac_forensics_mcp.server"
],
"env": []
}
}macOS Forensics MCP
MCP (Model Context Protocol) server for macOS Digital Forensics and Incident Response (DFIR).Overview
This MCP server provides structured forensic analysis tools for macOS triage collections, reducing context overhead when investigating incidents with LLMs. Key Benefits: - Structured queries instead of raw grep through massive files - Automatic timestamp normalization (Mac Absolute Time → UTC) - Pre-built security event detection patterns - Cross-artifact correlation and timeline building - Pagination to avoid context overflow - Artifact discovery to know what's available 23 tools covering: Unified Logs, FSEvents, Spotlight, Plists, SQLite databases, Extended Attributes, System Logs, and more.Installation
```bash cd /opt/macOS/mac_forensics-mcpSign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
