Volatility3 Mcp Server

by OMGhozlan

1 stars

254 downloads

Not rated

GitHub

Other

About

MCP (Model Context Protocol) interface for Volatility 3, providing memory forensics capabilities through LLM-based tools. Query, analyze, and automate Volatility 3 plugins using natural language via API or agent-based workflows

Details

Author: OMGhozlan
GitHub stars: 1
Downloads: 254
Categories: Other

- Powered by Volatility 3 for modern plugin support
- Cross‑platform analysis (Windows, Linux, macOS)
- Asynchronous plugin execution with JSON output
- Built‑in error handling and validation
- FastMCP server interface for clean integration
- Docker‑ready environment for containerized deployment

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Volatility3 Mcp Server

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

From the repository

Install Python 3.11+, install dependencies (fastmcp, rich, python-dotenv), and run the server using FastMCP. Connect via stdio (by configuring a mcp.json file) or SSE (by starting the server with fastmcp run ... --transport sse and pointing a client to http://localhost:8000/sse). A Docker‑ready image can also be built and run with volume mounts for memory dumps and output.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "volatility3 mcp server": {
            "volatility3": {
                "command": "npx",
                "args": [
                    "mcp-remote",
                    "http://localhost:8000/sse"
                ]
            }
        }
    }
}

McpServers

{
    "volatility3": {
        "command": "npx",
        "args": [
            "mcp-remote",
            "http://localhost:8000/sse"
        ]
    }
}

❄️ Volatility MCP Server

---

📌 Overview

The Volatility MCP Server is a powerful memory forensics automation toolkit powered by Volatility 3. It provides a modular, extensible interface for running Volatility plugins across Windows, Linux, and macOS memory dumps.

It makes memory analysis faster and more accessible via:

✅ Plugin automation
✅ Cross-platform support (Windows, Linux, macOS)
✅ Modular plugin architecture
✅ Rich logging with beautiful formatting
✅ Easy plugin registration and management

---

💡 Key Features

- 🔍 Powered by Volatility 3
- 🧠 Supports Windows, Linux, and macOS plugins
- ⚙️ Asynchronous plugin execution
- 📤 JSON output format
- 📊 Built-in error handling and validation
- 👨‍💻 FastMCP server interface
- 🐳 Docker-ready environment

---

📦 Requirements

python 3.11+
pip install -r requirements.txt

requirements.txt:

fastmcp

rich

python-dotenv

---

📁 Project Structure

Volatility-MCP-Server/
├── volatility_mcp_server.py    # Main server implementation
├── plugins/                    # Plugin modules
│   ├── base_plugin.py         # Base plugin class
│   ├── plugin_factory.py      # Plugin registration
│   ├── windows/               # Windows plugins
│   ├── linux/                 # Linux plugins
│   ├── mac/                   # macOS plugins
│   └── common/                # Common plugins
├── requirements.txt           # Dependencies
└── README.md                 # This file

---

🖥️ Usage

🔧 Local Connection

Using `stdio`

Create a .cursor/mcp.json file with:

{
  "mcpServers": {
    "Volatility3": {
      "command": "fastmcp",
      "args": ["run", "path/to/volatility_mcp_server.py:mcp", "--transport", "stdio"]
    }
  }
}

Using `sse`

Run the server using

fastmcp run volatility_mcp_server.py:mcp --transport sse

For Claude desktop

{
    "mcpServers": {
      "volatility3": {
        "command": "npx",
        "args": ["mcp-remote", "http://localhost:8000/sse"]
      }
    }
  }

For Cursor

{
  "mcpServers": {
    "Volatility3": {
      "url": "http://localhost:8000/sse"
    }
  }
}

📊 Available Plugins

Windows Plugins

- Process: PsList, PsTree, PsScan - Memory: Malfind, MemMap - Network: NetScan - Registry: RegistryHiveList, RegistryPrintKey - System: SvcScan, CmdLine, DllList, Handles, FileScan - Disk: ADS, MFTScan, ResidentData

Linux Plugins

- Process: PsList, PsTree, PsScan, PsAux, PsCallStack - System: Bash, Boottime, Capabilities - Network: IpAddr, IpLink, Netfilter - Memory: Malfind, ModuleExtract - File System: Files, InodePages, RecoverFs

macOS Plugins

- Process: PsList, PsTree, Psaux - System: Bash, Dmesg, Lsmod - Network: Ifconfig, Netstat - Security: Check_syscall, Check_sysctl, Check_trap_table

Common Plugins

- Framework: Banners, ConfigWriter, FrameworkInfo, IsfInfo, LayerWriter - Scan: RegExScan, YaraScan, Vmscan - Timeline: Timeliner

---

🐳 Docker Usage (No idea what I wanted to do here but might be useful in the future)

⚙️ 1. Build the Docker Image

From the root directory:

docker build -t volatility-mcp .

▶️ 2. Run the Server

docker run --rm -it \
  -v $(pwd)/memdumps:/memdumps \
  -v $(pwd)/output:/output \
  volatility-mcp

---

🔧 Developer/Contributor Guide

🧱 Setup Virtual Environment

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

🧪 Run Locally

python volatility_mcp_server.py

---

✍️ Customization Tips

- 📀 Want to add a new plugin? Extend BasePlugin and register it in plugin_factory.py
- 🧩 Want to add a new OS? Create a new plugin directory and implement the plugins
- 📚 Want to add new features? The modular architecture makes it easy to extend

---

🙋 FAQ

> 🟠 Does this support Volatility 2.x?
🔻 No. This server supports Volatility 3 only for modern plugin support.

> 🔵 Can I add custom plugins?
✅ Yes! Just extend the BasePlugin class and register it in the factory.

> 🔴 Why use FastMCP?
It provides a clean, efficient interface for running Volatility plugins with proper error handling and async support.

---

📜 License

MIT ©️ 2025

---

🌐 More Tools?

You may also like:
- Volatility Foundation
- FastMCP Documentation
- Python-dotenv

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

❄️ Volatility MCP Server

📌 Overview

💡 Key Features

📦 Requirements

📁 Project Structure

🖥️ Usage

🔧 Local Connection

Using stdio

Using sse

📊 Available Plugins

Windows Plugins

Linux Plugins

macOS Plugins

Common Plugins

🐳 Docker Usage (No idea what I wanted to do here but might be useful in the future)

⚙️ 1. Build the Docker Image

▶️ 2. Run the Server

🔧 Developer/Contributor Guide

🧱 Setup Virtual Environment

🧪 Run Locally

✍️ Customization Tips

🙋 FAQ

📜 License

🌐 More Tools?

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀

Using `stdio`

Using `sse`