Autopsy

You are responsible for knowing where your MCP client sends data and what the retention and sharing policies are of that server. For example, a default Claude Desktop installation will send data to Anthropic servers and their access to your data will depend on your settings.

If enabled, your MCP Client (such as Claude) hasread-onlyaccess to your Autopsy data. It can't issue any commands to update or change your data set. We may change this in the future to allow it toadd, but not remove, a score or label. You need to run Autopsy on the same system that Claude Desktop is running on. You need to open the Case in Autopsy first and then Claude can access that data.

Launch Autopsy, go to the Options panel, and navigate to the "AI: MCP Server" panel (far right).

Copy the file path that you see. It should be something like:

C:\\Program Files\\Autopsy-XXX\\bin\\autopsy-mcp-stdio.exe

You will need to preseve the double slashes.

Autopsy will need to restart for the MCP server to be enabled.

Next, find your claude_desktop_config.json file. These apps change quickly, but this is currently where to find it:

C:\Users\JDOE\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json

If not, then search your system for where that file is or see if Anthropic moved the data.

When you open that file in a text editor, you'll see something like this if it is a new installation:

{ "preferences": { "coworkScheduledTasksEnabled": false, "ccdScheduledTasksEnabled": true, "sidebarMode": "chat", "coworkWebSearchEnabled": false } }

Add a comma after the second to last } Add an mcpServer section like the one below before the final }

{ "preferences": { "coworkScheduledTasksEnabled": false, "ccdScheduledTasksEnabled": true, "sidebarMode": "chat", "coworkWebSearchEnabled": false }, "mcpServers": { "autopsy": { "command": "c:\\Program Files\\autopsy-XXX\\bin\\autopsy-mcp-stdio.exe" } } }

Obviously make sure you use the same path that you copied out of the app. The double back slashes are required.

Don't forget to add the comma before you add the "mcpServer". Thats the common mistake.

If you have both Cyber Triage and Autopsy, the section would look like this:

"mcpServers": { "autopsy": { "command": "c:\\Program Files\\autopsy-XXX\\bin\\autopsy-mcp-stdio.exe" }, "cybertriage": { "command": "c:\\Program Files\\Cyber Triage\\bin\\cybertriage-mcp-stdio.exe" } }

After you edit the configuration file, shut down Claude Desktop ENTIRELY.

NOTE 1: On Windows, Claude Desktop is still running even after you close the window. You need to go to your task bar and kill it from there before it fully shuts down and reloads the configuration file!

NOTE 2: Because the version number is in the Autopsy path, you will need to update the above path for each upgrade.

NOTE 3: Be VERY careful if you do in fact have both Cyber Triage and Autopy as MCP servers and they are both open at the same time. If you are not specific in each prompt about which tool to use, then it may jump between data sets!

After you restat Claude Desktop, you should be ready to go.

First, ask Claude "Can you see the Autopsy MCP server?". It should tell you if it can and what kinds of "tools" it supports. If that doesn't work, refer to the Debugging section below.

Next, open a Case. You can now ask it "is there an autopsy case open?".

Make sure your prompts are specific about if they should be for a single host or all of them in the case.

For example: "make a timeline of all USB Devices" vs "make a timeline of USB Devices from host X".

- Claude will prompt you to use each tool. This is a security feature. There doesn't seem to be anything we can do about it. Other clients may not prompt you so much.
- Results cannot be more than 1MB. So if you give a very broad request, you may hit that limit. Please let us know if this happens so that we can know what kinds of questions should be more optimized.

If Claude Desktop can't see the MCP server, then:

Verify you enabled the server and restarted Autopsy Verify you REALLY stopped Claude Desktop fully by going to the Windows task bar and stopping it there (closing windows is not enough)

If the above are all confirmed, open a command prompt and go to the folder that you copied into the configuration file (such as c:\\Program Files\\Autopsy-XXX\\bin). Type in:

That will attempt to connect to the server.

If it passes, then the server is running and the autopsy-mcp-stdio can connect. Therefore, the problem is with your Claude Desktop setup. Double check the configuration file and if your account can access MCP servers.

If autopsy-mcp-stdio can't connect, then the problem is the server. Check the logs in your \\AppData\\Local\\Autopsy\\MCP folder for any errors. Also see if a firewall could have blocked the connection.

To help with debugging and understanding how this all works, here is a quick run down:

If enabled, at startup, Autopsy opens TCP port 8743 for localhost connections only. It also generates a random token for each launch. All connections from other hosts or without the token are rejected. The autopsy-mcp-stdio.exe program can connect to the port. Claude Desktop communicates with it over STDIO and it acts as a transport between Claude Desktop and the running Autopsy application.

Connect to your CISO Adapt workspace to search, analyse, export, and manage risks and policies with natural language

CVE/SBOM security audits, licence compliance, frontend security scanning, domain intelligence, and public records — 55 tools, no API key required Category: Security (also fits: Compliance, Data)

Unmodified government company registry data — 27 national registries, live. Cross-border UBO / beneficial owner chain walker for KYC, AML, due diligence. 27 tools + 10 MCP prompt workflows.

Paid remote MCP for agent data-access boundary reviews, permission scope evidence, sensitive data notes, and governance receipts.

EXIF for AI. AKF embeds trust scores, source provenance, and compliance metadata into every file your AI touches — DOCX, PDF, images, code, and 20+ formats. 9 MCP tools: stamp, inspect, trust, audit, scan, embed, extract, detect. Audit against EU AI Act, SOX, HIPAA, NIST in one command.

Local, privacy-preserving PII detection & redaction over MCP: the model works on shape (schemas, synthetic twins, masked output) while local code touches the real values and returns only masked, aggregated results. Deterministic (Presidio + checksums, AU ABN/ACN/TFN), no LLM calls, no runtime network.

Zero-Trust Data Sanitization (ZTDS) local PII and secrets scrubber for secure LLM pipelines.

KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.

Open-source, self-hostable MCP server for WhisperGraph — a graph of 7.39B nodes / 39B edges mapping DNS, BGP, GeoIP, WHOIS, and threat intelligence. Six read-only tools (Cypher query + schema introspection + threat assessment), six resources, eight investigation prompts. stdio and Streamable HTTP transports.