mem forensics-MCP

法医学硕士

统一内存取证MCP服务器 -多层引擎结合了Rust速度和Vol3覆盖率。

______________________________________________________________________

建筑

三层引擎自动将每个工具路由到最快的后端：

LLM  [mem-forensics-mcp (Python)]  memoxide (Rust child, stdio MCP)
                                      Volatility3 (Python library)

______________________________________________________________________

安装

先决条件

# Install uv (fast Python package manager)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Ensure Python 3.10+
python3 --version

从PyPI安装

uv pip install mem-forensics-mcp

从源代码安装

git clone https://github.com/x746b/mem_forensics-mcp.git
cd mem_forensics-mcp

# Full install (recommended)
uv sync --extra full

# Minimal (Vol3 only, no YARA/VT)
uv sync --extra volatility3

构建Rust引擎（可选）

预构建的二进制飞船 aarch64-linux 和 x86_64-linux 在 engines/memoxide/服务器自动检测主机架构。要从源代码构建，请执行以下操作：

# Requires Rust toolchain (https://rustup.rs)
cd engines/memoxide-src
cargo build --release

# Binary lands at engines/memoxide-src/target/release/memoxide
# The server auto-detects it (prefers local build over prebuilt)

配置Volatility 3（可选）

如果Vol3安装在 /opt/volatility3 它是自动检测的。否则： export VOLATILITY3_PATH="/path/to/volatility3"

验证

uv run python -m mem_forensics_mcp.server
# Should show: Rust engine: available, Volatility3: available

______________________________________________________________________

添加到Claude CLI

claude mcp add mem-forensics-mcp \
  --scope user \
  -- uv run --directory /opt/mem_forensics-mcp python -m mem_forensics_mcp.server

使用自定义Volatility3路径：

claude mcp add mem-forensics-mcp \
  --scope user \
  -e VOLATILITY3_PATH=/opt/volatility3 \
  -- uv run --directory /opt/mem_forensics-mcp python -m mem_forensics_mcp.server

______________________________________________________________________

快速开始

# 1. Initialize
memory_analyze_image(image_path="/evidence/memory.raw")

# 2. Full triage
memory_full_triage(image_path="/evidence/memory.raw")

# 3. Drill down
memory_run_plugin(image_path="/evidence/memory.raw", plugin="malfind", pid=1234)

______________________________________________________________________

工具参考

核心

分析

提取

威胁情报

______________________________________________________________________

示例：全分类输出

跑步 memory_full_triage 在Windows 10内存转储（Win10 19041，x64，VMware）上：

{
  "threat_level": "critical",
  "risk_score": 100,
  "summary": "Processes: 115 found. Process Anomalies: 4 info-level. Network: 4 flagged of 79 connections. Commands: 56 memory fragments. Injected Code: 12 RWX regions. Correlations: 2 critical.",
  "engine": "rust+python"
}

主要发现：

使用筛选后的文件进行深入分析可以：

memory_run_plugin(image_path="memory.raw", plugin="filescan", filter="notepad")
# Returns: 2 of 7612 results matched (server-side grep before truncation)

______________________________________________________________________

相关项目

• winforensics mcp --Windows磁盘取证（EVTX、注册表、MFT、预取、YARA、PCAP）
• mac_forensics-mcp --macOS DFIR（统一日志、FSEvents、Spotlight、Plists）

______________________________________________________________________

MIT许可证| __偏航距离__ |专为DFIR社区打造。无需Windows>）