The Sleuth Kit Mcp Server

by heejung0

259 downloads

Not rated

GitHub

Developer Tools

About

The Sleuth Kit MCP Server는 Sleuth Kit CLI 도구(mmstat, mmls, fls, ifind, icat)를 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 파일시스템 이미지(E01, RAW, VMDK 등) 를 분석하고 파일을 추출할 수 있습니다.

Details

Author: heejung0
Downloads: 259
Categories: Developer Tools

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name The Sleuth Kit Mcp Server

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

From the repository

Clone the repository, create a Python virtual environment, install dependencies, and install Sleuth Kit separately. Then configure your MCP client with a JSON entry specifying the Python interpreter path and the server script path, plus necessary environment variables (e.g., PATH). The server provides tools such as sleuthkit_healthcheck, disk_info, disk_partition_info, search_inode_by_path, files_in_directory, extract_files_by_inode, extract_directory_tree_by_inode, and istat_metadata.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "the sleuth kit mcp server": {
            "sleuthkit-MCP": {
                "command": "/path/to/.venv/Scripts/python",
                "args": [
                    "/path/to/sleuthkit_mcp_server.py"
                ],
                "env": {
                    "PATH": "/path/to/sleuthkit/bin"
                }
            }
        }
    }
}

McpServers

{
    "sleuthkit-MCP": {
        "command": "/path/to/.venv/Scripts/python",
        "args": [
            "/path/to/sleuthkit_mcp_server.py"
        ],
        "env": {
            "PATH": "/path/to/sleuthkit/bin"
        }
    }
}

The Sleuth Kit MCP Server

The Sleuth Kit MCP Server는 Sleuth Kit CLI 도구(mmstat, mmls, fls, ifind, icat)를 Model Context Protocol (MCP) 서버 형태로 노출합니다. 이를 통해 Cursor, Claude Desktop 등 MCP 클라이언트에서 파일시스템 이미지(E01, RAW, VMDK 등) 를 분석하고 파일을 추출할 수 있습니다.

Tools

- sleuthkit_healthcheck : Sleuth Kit 바이너리 설치 상태 점검 - disk_info : file 명령어와 mmstat으로 디스크 이미지 파일 정보 확인 - disk_partition_info : mmls로 디스크 파티션 정보 분석 - search_inode_by_path : ifind로 메인 파티션 오프셋을 기준으로 직접 경로 탐색을 통해 해당 폴더의 inode 번호 확인 - files_in_directory : fls로 폴더의 내용 확인 - extract_files_by_inode : icat으로 inode 번호를 활용한 파일 추출 - extract_directory_tree_by_inode : icat으로 원본 경로 구조를 유지하며 inode 번호를 활용한 파일 추출 - istat_metadata : istat으로 디스크 이미지에서 inode를 기반으로 해당 파일들의 메타 정보 확인

Installation

1. Python 환경 준비

bash
git clone https://github.com/heejung0/sleuthkit-mcp-server.git
cd sleuthkit-mcp-server
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt


- Windows의 경우 python-magic-bin 추가 설치

2. Sleuth Kit 설치

- MacOS (Homebrew)

bash
    brew install sleuthkit



- Linux

bash
    sudo apt update
    sudo apt install sleuthkit



- Windows : 해당 링크에서 Windows Binary 다운로드


3. MCP Client 연결

- MacOS

json
{
  "mcpServers": {
    "sleuthkit-MCP": {
      "command": "/path/to/.venv/bin/python",
      "args": [
        "/path/to/sleuthkit_mcp_server.py"
      ],
      "env": {
        "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
      }
    }
  }
}



- Windows

json
{
  "mcpServers": {
    "sleuthkit-MCP": {
      "command": "/path/to/.venv/Scripts/python",
      "args": [
        "/path/to/sleuthkit_mcp_server.py"
      ],
      "env": {
        "PATH": "/path/to/sleuthkit/bin"
      }
    }
  }
}

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

The Sleuth Kit MCP Server

Tools

Installation

1. Python 환경 준비

2. Sleuth Kit 설치

3. MCP Client 연결

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright