# Malware Analysis

The Windows Forensics MCP Server is a comprehensive digital forensics toolkit designed specifically for Linux environments. It uses pure Python libraries to natively parse traces from Windows systems without relying on Windows tools. It provides functions such as EVTX log analysis, registry analysis, execution trace analysis, filesystem forensics, user activity analysis, network forensics, malware detection, and API monitoring capture analysis, and supports remote collection and high - level investigation coordinators.

An AI-driven MCP server that automatically connects to the Malware Bazaar platform, providing real-time threat intelligence and malware sample metadata for authorized network security research.

The Threat.Zone MCP server is a malware analysis service interface built on FastMCP, providing LLMs with a standardized threat analysis toolset that supports file/URL detection, sandbox analysis, network behavior monitoring, and other functions.