Integrates with GitHub Copilot in VS Code to perform memory forensics analysis, including loading memory dumps, enumerating processes and drivers, reading memory, and exploring the virtual file system.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MemProcFS MCP Server Load the memory dump chall1.mem"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for memory forensics analysis using MemProcFS.
Load Memory Images: Analyze memory dumps (.mem, .raw, .dmp)
Process Analysis: List and analyze processes
Network Analysis: View network connections
Memory Reading: Read physical memory at any address
Registry Analysis: List registry hives
Driver Enumeration: List loaded kernel drivers
VFS Navigation: Browse MemProcFS virtual file system
Advanced Commands: Execute any MemProcFS operation via exec_command
Related MCP server: Protocol-SIFT-Async-Bridge
Python 3.10+
MemProcFS binaries (download separately)
# Clone the repository
git clone https://github.com/Varshith-JV-1410/memprocfs-mcp.git
cd memprocfs-mcp
# Run the setup script (automatically installs dependencies)
python setup.pyThe setup script will:
Check Python version (requires 3.10+)
Install dependencies from requirements.txt
Verify MemProcFS installation
Provide exact MCP configuration for VS Code and Claude Desktop
# Install dependencies from requirements.txt
pip install -r requirements.txt
# Download MemProcFS from:
# https://github.com/ufrisk/MemProcFS/releases/latest
# Extract to memprocfs/ folderpython server.pyAdd to your VS Code settings (mcp.json):
{
"memprocfs-mcp": {
"command": "python",
"args": ["/path/to/memprocfs-mcp/server.py"],
"type": "stdio",
"env": {
"PYTHONPATH": "/path/to/memprocfs-mcp"
}
}
}Add to claude_desktop_config.json:
{
"memprocfs-mcp": {
"command": "python",
"args": ["/path/to/memprocfs-mcp/server.py"],
"env": {
"PYTHONPATH": "/path/to/memprocfs-mcp"
}
}
}Replace
/path/to/memprocfs-mcp/with the actual path to this project. Runpython setup.pyto get the exact configuration for your system.
Tool | Description |
| Load a memory dump file for analysis |
| List all processes in the memory image |
| Analyze a specific process by PID |
| Get all network connections |
| Get physical memory map |
| Read physical memory at address |
| List registry hives |
| List loaded kernel drivers |
| Get session state |
| Save analysis report |
| Execute advanced commands |
Command | Description | Parameters |
| List VFS directory |
|
| Read VFS file |
|
| List Windows services | - |
| List user accounts | - |
| List kernel objects | - |
| List pool tags (30s timeout) | - |
| Get detailed process info |
|
| Get kernel build number | - |
| List VFS files with details |
|
This server cannot be deployed
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
