Schema | forensic-artifact-investigator

forensic-artifact-investigator

Describes the environment variables required to run the server.

Name	Required	Description	Default
`FILE_BINARY`	No	file executable path/name	file
`EVIDENCE_ROOT`	No	Canonical directory from which evidence can be read	/evidence
`STRINGS_BINARY`	No	GNU-compatible strings executable path/name	strings
`EXIFTOOL_BINARY`	No	ExifTool executable path/name	exiftool
`ANALYSIS_LOG_PATH`	No	Append-only JSONL chain-of-custody log destination	data/analysis-log.jsonl
`VOLATILITY_BINARY`	No	Verified Volatility executable path; unset causes memory tool dependency error
`MCP_TRANSPORT_TYPE`	No	MCP transport selection	stdio
`VIRUSTOTAL_API_KEY`	No	Optional key for hash-only reputation lookups
`MAX_RETURNED_STRINGS`	No	Maximum strings retained in MCP response	5000
`VOLATILITY_TIMEOUT_MS`	No	Timeout per Volatility plugin	300000
`FILE_COMMAND_TIMEOUT_MS`	No	Timeout for file, ExifTool, and strings commands	60000
`MAX_STRING_OUTPUT_BYTES`	No	Captured strings stdout cap	2000000
`VOLATILITY_MAJOR_VERSION`	No	Volatility major version (3 or 2)	3
`MAX_SUBPROCESS_STDERR_BYTES`	No	General command stderr capture cap	512000
`MAX_SUBPROCESS_STDOUT_BYTES`	No	General command stdout capture cap	2000000
`VOLATILITY_MAX_OUTPUT_BYTES`	No	Captured Volatility stdout cap	5000000

Server capabilities have not been inspected yet.

Functions exposed to the LLM to take actions

Name	Description
No tools

Interactive templates invoked by user choice

Name	Description
No prompts

Contextual data attached and managed by the client

Name	Description
No resources

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/guyoverclocked/forensic-analyzer-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server