Volatility3 MCP

🚀 Volatility3 MCP Server

Volatility3 MCP Server is a powerful tool that connects MCP clients (such as Claude Desktop) with Volatility3, an advanced memory forensics framework. This integration enables LLMs to analyze memory dumps, detect malware, and perform complex memory forensics tasks through a simple conversational interface.

🚀 Quick Start

Introduction

The Volatility3 MCP Server is a powerful tool that connects MCP clients (such as Claude Desktop) with Volatility3, an advanced memory forensics framework. This integration enables LLMs to analyze memory dumps, detect malware, and perform complex memory forensics tasks through a simple conversational interface.

Problem Solved

Memory forensics is a complex field that typically requires specialized knowledge and command-line skills. This project addresses the following issues:

• Allows non-experts to perform memory analysis through natural language.
• Enables LLMs to directly analyze memory dumps and provide insights.
• Automates common forensics workflows that usually require multiple manual steps.
• Improves the usability and accessibility of memory forensics.

✨ Features

• Memory Dump Analysis: Analyze Windows and Linux memory dumps using various plugins.
• Process Inspection: List running processes, view their details, and identify suspicious activities.
• Network Analysis: Examine network connections to discover command and control servers.
• Cross-Platform Support: Supports Windows and Linux memory dumps (macOS support coming soon).
• Malware Detection: Scan memory using YARA rules to identify known malware signatures.

🎥 Demo

Demo Video

You can also find a detailed presentation about this tool here.

📦 Installation

1. Clone this repository:
2. Create a virtual environment:

   python -m venv environ
   source environ/bin/activate
   

3. Install the required dependencies:

   pip install -r requirements.txt
   

You can use this project in two ways:

Option 1: Use with Claude Desktop

4. Configure Claude Desktop:
   • Go to Claude -> Settings -> Developer -> Edit Configuration -> claude_desktop_config.json, and add the following content:

        {
            "mcpServers": {
            "volatility3": {
                "command": "Absolute path/to/virtual/environment/bin/python3",
                "args": [
                "Absolute path/to/bridge_mcp_volatility.py"
                ]
            }
            }
        }
     

5. Restart Claude Desktop and start analyzing memory dumps.

Option 2: Use with Cursor (SSE Server)

4. Start the SSE server:

   python3 start_sse_server.py
   

5. Configure Cursor to use the SSE server:
   • Open Cursor settings.
   • Navigate to Features -> MCP Server.
   • Add a new MCP server with the URL http://127.0.0.1:8080/sse.
6. Use Cursor Composer's proxy mode and start analyzing memory dumps.

💻 Usage Examples

Available Tools

• initialize_memory_file: Set up the memory file for analysis.
• detect_os: Identify the operating system of the memory dump.
• list_plugins: Display all available Volatility3 plugins.
• get_plugin_info: Get detailed information about a specific plugin.
• run_plugin: Execute any Volatility3 plugin with custom parameters.
• get_processes: List all running processes in the memory dump.
• get_network_connections: View all network connections of the system.
• list_process_open_handles: Check resources such as open handles and accessed files of processes.
• scan_with_yara: Scan memory for malicious patterns using YARA rules.

🤝 Contribution

Any contributions are welcome! Please feel free to submit a Pull Request.