The Windows Forensics MCP Server is a comprehensive digital forensics toolkit designed specifically for Linux environments. It uses pure Python libraries to natively parse traces from Windows systems without relying on Windows tools. It provides functions such as EVTX log analysis, registry analysis, execution trace analysis, filesystem forensics, user activity analysis, network forensics, malware detection, and API monitoring capture analysis, and supports remote collection and high - level investigation coordinators.

An AI-driven MCP server that automatically connects to the Malware Bazaar platform, providing real-time threat intelligence and malware sample metadata for authorized network security research.

The Mallory MCP Server is a server that provides real-time network threat intelligence and supports proxy access to network security-related information such as vulnerabilities, threat actors, and malware.

This project uses the MCP protocol and AI technology to build automated network security tools, covering multiple fields such as red - team attack simulation, SOC analysis, malware development, and threat hunting, to achieve the intelligence and automation of security tasks.

The OpenCTI MCP Server is a Model Context Protocol server integrated with the OpenCTI platform, providing a standardized threat intelligence query interface that supports various functions such as report retrieval, malware search, and user management.

Volatility3 MCP Server is a tool that connects MCP clients with the Volatility3 memory forensics framework. Through a natural language interface, non-experts can also conduct professional memory forensics analysis. It supports functions such as malware detection and process inspection for Windows and Linux memory dumps.

The Threat.Zone MCP server is a malware analysis service interface built on FastMCP, providing LLMs with a standardized threat analysis toolset that supports file/URL detection, sandbox analysis, network behavior monitoring, and other functions.

A Python MCP server based on the public ScanMalware.com API, providing functions such as malware scanning, phishing detection, and TLS certificate checking. It supports local running, Docker deployment, and DigitalOcean cloud server deployment.

The MCP server of GridinSoft Inspector provides domain and URL security analysis functions, helping AI assistants verify website credibility, detect phishing, and malware.

An MCP server integrated with the MISP platform, providing threat intelligence capabilities for large language models, including malware detection, threat intelligence search, IoC submission, and report generation.

abusech-mcp is an MCP server that retrieves threat intelligence data about malware, URLs, IPs, and domains from multiple abuse.ch platforms through a unified API.

The Joe Sandbox MCP Server is a Model Context Protocol (MCP) server for interacting with Joe Sandbox cloud services, providing rich malware analysis, IOC extraction, and threat intelligence functions, and can be integrated into MCP - compatible applications.