Winforensics Mcp
Description
<img src="icon.png" width="150" alt="WinForensics MCP"> # Windows Forensics MCP Server > **Windows DFIR from Linux** - A comprehensive forensics toolkit designed entirely for Linux environments with zero Windows tool dependencies. Parse Windows artifacts natively using pure…
About
<img src="icon.png" width="150" alt="WinForensics MCP"> # Windows Forensics MCP Server > **Windows DFIR from Linux** - A comprehensive forensics toolkit designed entirely for Linux environments with zero Windows tool dependencies. Parse Windows artifacts natively using pure Python libraries. --- ## Why This Matters…
Details
- Author
- x746b
- Downloads
- 510
- Categories
- Other, Security, Infrastructure
Jump to
- Parse EVTX logs with filtering and pre-built security queries
- Analyze Registry hives: SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.DAT
- Correlate Prefetch, Amcache, and SRUM for execution evidence
- Extract MFT with timestomping detection and USN Journal
- Investigate user activity: Browser, LNK, ShellBags, RecentDocs
- Analyze PCAP/PCAPNG files for suspicious network activity
- Scan files with 718 YARA rules from signature-base
- Look up hashes, IPs, domains on VirusTotal with caching
- Detect packers and compilers via Detect It Easy (DiE)
- Ingest Eric Zimmerman tool CSV output (MFTECmd, PECmd, etc.)
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Winforensics McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install via uv sync (or pip), then add the server to Claude CLI using claude mcp add or by editing ~/.claude.json. Place a CLAUDE.md file in your case directory to guide the LLM in using orchestrators efficiently. Invoke tools by asking natural language questions (e.g., "Was this binary executed?") or using the provided tools directly.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"winforensics mcp": {
"winforensics-mcp": {
"command": "uv",
"args": [
"run",
"--directory",
"/path/to/winforensics-mcp",
"python",
"-m",
"winforensics_mcp.server"
]
}
}
}
}McpServers
{
"winforensics-mcp": {
"command": "uv",
"args": [
"run",
"--directory",
"/path/to/winforensics-mcp",
"python",
"-m",
"winforensics_mcp.server"
]
}
}Should show winforensics-mcp
---
LLM Integration (CLAUDE.md)
For AI-assisted forensic analysis, include CLAUDE.md in your case directory. It provides:
- Orchestrator-first guidance - Ensures LLMs use high-level tools before low-level parsers
- Token efficiency - Reduces API costs by 50%+ through proper tool selection
- Investigation workflow - Step-by-step methodology for consistent analysis
Usage
Copy CLAUDE.md to your case directory:
cp /path/to/winforensics-mcp/CLAUDE.md /your/case/directory/
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
