forensic-artifact-investigator
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FILE_BINARY | No | file executable path/name | file |
| EVIDENCE_ROOT | No | Canonical directory from which evidence can be read | /evidence |
| STRINGS_BINARY | No | GNU-compatible strings executable path/name | strings |
| EXIFTOOL_BINARY | No | ExifTool executable path/name | exiftool |
| ANALYSIS_LOG_PATH | No | Append-only JSONL chain-of-custody log destination | data/analysis-log.jsonl |
| VOLATILITY_BINARY | No | Verified Volatility executable path; unset causes memory tool dependency error | |
| MCP_TRANSPORT_TYPE | No | MCP transport selection | stdio |
| VIRUSTOTAL_API_KEY | No | Optional key for hash-only reputation lookups | |
| MAX_RETURNED_STRINGS | No | Maximum strings retained in MCP response | 5000 |
| VOLATILITY_TIMEOUT_MS | No | Timeout per Volatility plugin | 300000 |
| FILE_COMMAND_TIMEOUT_MS | No | Timeout for file, ExifTool, and strings commands | 60000 |
| MAX_STRING_OUTPUT_BYTES | No | Captured strings stdout cap | 2000000 |
| VOLATILITY_MAJOR_VERSION | No | Volatility major version (3 or 2) | 3 |
| MAX_SUBPROCESS_STDERR_BYTES | No | General command stderr capture cap | 512000 |
| MAX_SUBPROCESS_STDOUT_BYTES | No | General command stdout capture cap | 2000000 |
| VOLATILITY_MAX_OUTPUT_BYTES | No | Captured Volatility stdout cap | 5000000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tasks | {
"list": {},
"cancel": {},
"requests": {
"tools": {
"call": {}
}
}
} |
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"subscribe": true,
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| extract-metadataA | Run real file and ExifTool analysis on an evidence file, calculate SHA-256, and compare its extension with the detected MIME type. An extension/MIME mismatch confirms a file-type discrepancy, not malware. |
| extract-stringsA | Run GNU strings -n 6 against an evidence file and report bounded real string output plus IP, URL/domain, and suspicious-keyword indicators. Indicators are not proof of malware. |
| analyze-memory-dumpA | Perform bounded, real Volatility analysis of a Windows memory dump inside the evidence root. Returns plugin-level failures honestly; malfind hits require analyst review. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| full-file-analysis | Create a bounded forensic-analysis workflow for one evidence file or memory dump using only the server’s declared forensic capabilities. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| signatures://magic-bytes | Bundled magic-byte and expected-MIME reference table used for extension/MIME comparison. |
| case://analysis-log | Read-only, append-only chain-of-custody analysis log in chronological JSONL order. |
| signatures://threat-intel | Bounded hash-only threat-intelligence lookup. Read a concrete URI containing an MD5, SHA-1, or SHA-256 hash. |
TDQS
Scored across 3 tools
Each tool targets a distinct forensic operation: file metadata and hashing, string extraction, and memory dump analysis. There is no overlap in their purposes, making selection unambiguous.
Tool names follow a clear verb_noun pattern: extract-metadata, extract-strings, analyze-memory-dump. The verbs differ (extract vs. analyze) but this is justifiable based on the action type, and the pattern is consistent throughout.
Three tools is on the lower end, but each tool covers a broad, substantial forensic category. The count is appropriate for a focused investigator server, though could be slightly expanded.
The set covers core artifact investigation needs: metadata extraction (with MIME mismatch and hash), string/indicator extraction, and memory analysis. Minor gaps like disk image carving or network artifact analysis exist, but the major workflows are represented.