Skip to main content
Glama
deenesjakoruzh
Ghosthunter5599

Forensics MCP Server

by Ghosthunter5599
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

自组装取证 MCP 服务器（FastMCP / Python）

一个基于 Python 和 FastMCP（mcp>=2.0.0）构建的模块化数字取证与事件响应（DFIR）模型上下文协议（MCP） 服务器。

它在启动时动态发现主机和容器取证工具，并自动自组装功能性工具、资源和分类提示，供本地大语言模型和 AI 代理（Ollama、Claude、Cursor、Antigravity 等）使用。

🌟 特性

  • 🔍 动态能力发现：探测主机环境路径、已安装的二进制文件（exiftool、strings、volatility3、binwalk、tshark、objdump、gdb、yara）以及 Docker 运行时。缺失的工具会被优雅地报告而不会导致崩溃。

  • 🧩 自组装工具原语：仅自动注册主机环境中可用的工具。

  • 🛡️ 隔离与离线就绪：内置离线威胁情报数据库，包含已知样本签名（EICAR、WannaCry、Mimikatz），用于安全、零数据泄露的事件响应。

  • 📋 防篡改监管链：每次工具执行、检查的工件、SHA-256 校验和以及操作参数都会经过密码学哈希处理，并记录到仅可追加的分类账中（evidence/chain_of_custody.jsonl）。

  • 🩺 自报告健康与资源：实时能力矩阵（forensics://capabilities）、监管日志（forensics://custody）和系统健康状态（forensics://health）。

  • ⚡ 双传输方式：支持原生 MCP 客户端（Cursor、Claude、Antigravity）的标准 STDIO，以及 Web 大语言模型代理（Ollama、Open WebUI）的 SSE/HTTP。

Related MCP server: findevil-agent

🚀 快速开始

1. 前置要求

  • Python 3.10+（或 uv）

2. 运行服务器

选项 A：原生 STDIO 传输（适用于本地代理 / Cursor / Claude）

cd /home/b47m4n/Projects/forensics-mcp-framework
uv run src/server.py

选项 B：SSE / HTTP 传输（适用于 Web / 远程大语言模型）

cd /home/b47m4n/Projects/forensics-mcp-framework
uv run src/server.py --transport sse --port 8000

🔌 连接到本地大语言模型和代理

1. Antigravity / Claude / Cursor（claude_desktop_config.json / mcp.json）

{
  "mcpServers": {
    "forensic-analyzer": {
      "command": "uv",
      "args": [
        "--directory",
        "/home/b47m4n/Projects/forensics-mcp-framework",
        "run",
        "src/server.py"
      ]
    }
  }
}

2. 通过 Ollama + MCP 连接本地大语言模型

通过 SSE 端点连接您的本地模型（例如 llama3.1、qwen2.5-coder）： http://localhost:8000/sse

🛠️ 已发现的工具目录

工具

类别

动态条件

描述

extract_metadata

元数据与文件

始终可用

计算哈希（MD5/SHA256）、EXIF 标签，并检测 MIME 不匹配

extract_strings

静态分析

始终可用

提取可打印的 ASCII 和 Unicode 字符串

scan_iocs

威胁检测

始终可用

扫描 C2 URL、IP 地址、Base64 块、命令执行

check_threat_intel

威胁情报

始终可用

根据离线签名和可选的实时 API 检查哈希

system_health_check

诊断

始终可用

健康状态、存储检查和工具就绪性

windows_image_info

内存取证

vol 或 Docker

Volatility 3 windows.info

windows_pslist

内存取证

vol 或 Docker

Volatility 3 windows.pslist

windows_pstree

内存取证

vol 或 Docker

Volatility 3 windows.pstree

windows_netscan

内存取证

vol 或 Docker

Volatility 3 windows.netscan

windows_malfind

内存取证

vol 或 Docker

Volatility 3 windows.malfind（注入代码）

binwalk_scan

文件提取

binwalk 存在

固件签名和文件系统提取

pcap_analyze

网络取证

tshark 存在

解析 PCAP 网络数据包捕获

binary_disassemble

逆向工程

objdump 存在

反汇编二进制机器指令

gdb_inspect

调试

gdb 存在

自动化批量调试检查

yara_scan

签名匹配

yara 存在

根据 YARA 规则文件扫描证据

📂 项目架构

forensics-mcp-framework/
├── pyproject.toml
├── .env.example
├── README.md
├── evidence/                  # Evidence locker & chain of custody ledger
│   ├── suspect_photo.jpg
│   ├── eicar_test.com
│   └── chain_of_custody.jsonl
└── src/
    ├── server.py              # Master FastMCP bootstrap & dynamic assembler
    ├── core/
    │   ├── discovery.py       # Host & container capability scanner
    │   ├── custody.py         # Tamper-evident append-only chain of custody
    │   └── health.py          # System diagnostics & health reporter
    ├── tools/
    │   ├── metadata.py        # ExifTool & MIME mismatch detector
    │   ├── strings_ioc.py     # String & IOC scanner (IP, URL, Base64, shell)
    │   ├── threat_intel.py    # Offline/online threat intelligence
    │   ├── memory_vol.py      # Volatility 3 memory analysis engine
    │   └── dynamic_cli.py     # CLI wrappers (binwalk, tshark, objdump, gdb)
    ├── resources/
    │   └── system_resources.py# MCP Resources
    └── prompts/
        └── triage_prompts.py  # Structured DFIR workflows
Install Server
F
license - not found
A
quality
C
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

Related MCP Servers

  • Velociraptor MCP Server

    snoe-findley
    A
    license
    -
    quality
    D
    maintenance
    Enables AI agents to interface with Velociraptor for digital forensics and incident response tasks, including file/memory scans, remediation actions, and artifact collection across multiple operating systems.
    1
    MIT

  • findevil-agent

    povfarwa
    A
    license
    -
    quality
    B
    maintenance
    Enables autonomous digital forensics and incident response through 21 typed forensic tools covering disk, memory, registry, network, timeline, carving, and patterns, integrated with AI-driven reasoning and self-correction.
    MIT

  • SIFTGuard

    sodiq-code
    A
    license
    -
    quality
    B
    maintenance
    Enables autonomous digital forensics and incident response by wrapping SIFT Workstation tools as MCP tools and orchestrating a multi-agent AI pipeline for evidence analysis and remediation planning.
    2
    MIT

  • Veritas MCP

    balajinrrbgm
    A
    license
    -
    quality
    C
    maintenance
    Enables AI agents to conduct evidence-grounded forensic triage of compromised hosts, with architectural safeguards against evidence spoliation and hallucinated findings, supporting self-correction and chain of custody.
    MIT

View all related MCP servers

Related MCP Connectors

  • agentbay-mcp

    Persistent memory and knowledge management for AI agents with semantic search and 50+ tools.

  • nucleus

    Sovereign Agent OS — Persistent Memory, Governance & Compliance for AI Agents.

  • OpenAkashic

    Shared long-term memory vault for AI agents with 20 MCP tools.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Ghosthunter5599/Forensics-MCP-Server-FastMCP-Ollama'

If you have feedback or need assistance with the MCP directory API, please join our Discord server