Schema | forensic-artifact-investigator

forensic-artifact-investigator

Describes the environment variables required to run the server.

Name	Required	Description	Default
`FILE_BINARY`	No	file executable path/name	file
`EVIDENCE_ROOT`	No	Canonical directory from which evidence can be read	/evidence
`STRINGS_BINARY`	No	GNU-compatible strings executable path/name	strings
`EXIFTOOL_BINARY`	No	ExifTool executable path/name	exiftool
`ANALYSIS_LOG_PATH`	No	Append-only JSONL chain-of-custody log destination	data/analysis-log.jsonl
`VOLATILITY_BINARY`	No	Verified Volatility executable path; unset causes memory tool dependency error
`MCP_TRANSPORT_TYPE`	No	MCP transport selection	stdio
`VIRUSTOTAL_API_KEY`	No	Optional key for hash-only reputation lookups
`MAX_RETURNED_STRINGS`	No	Maximum strings retained in MCP response	5000
`VOLATILITY_TIMEOUT_MS`	No	Timeout per Volatility plugin	300000
`FILE_COMMAND_TIMEOUT_MS`	No	Timeout for file, ExifTool, and strings commands	60000
`MAX_STRING_OUTPUT_BYTES`	No	Captured strings stdout cap	2000000
`VOLATILITY_MAJOR_VERSION`	No	Volatility major version (3 or 2)	3
`MAX_SUBPROCESS_STDERR_BYTES`	No	General command stderr capture cap	512000
`MAX_SUBPROCESS_STDOUT_BYTES`	No	General command stdout capture cap	2000000
`VOLATILITY_MAX_OUTPUT_BYTES`	No	Captured Volatility stdout cap	5000000

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Features and capabilities supported by this server

Protocol revision2025-11-25

Capability	Details
`tasks`	{ "list": {}, "cancel": {}, "requests": { "tools": { "call": {} } } }
`tools`	{ "listChanged": true }
`prompts`	{ "listChanged": true }
`resources`	{ "subscribe": true, "listChanged": true }

Functions exposed to the LLM to take actions

Name	Description
extract-metadataA	Run real file and ExifTool analysis on an evidence file, calculate SHA-256, and compare its extension with the detected MIME type. An extension/MIME mismatch confirms a file-type discrepancy, not malware.
extract-stringsA	Run GNU strings -n 6 against an evidence file and report bounded real string output plus IP, URL/domain, and suspicious-keyword indicators. Indicators are not proof of malware.
analyze-memory-dumpA	Perform bounded, real Volatility analysis of a Windows memory dump inside the evidence root. Returns plugin-level failures honestly; malfind hits require analyst review.

Interactive templates invoked by user choice

Name	Description
`full-file-analysis`	Create a bounded forensic-analysis workflow for one evidence file or memory dump using only the server’s declared forensic capabilities.

Contextual data attached and managed by the client

Name	Description
`signatures://magic-bytes`	Bundled magic-byte and expected-MIME reference table used for extension/MIME comparison.
`case://analysis-log`	Read-only, append-only chain-of-custody analysis log in chronological JSONL order.
`signatures://threat-intel`	Bounded hash-only threat-intelligence lookup. Read a concrete URI containing an MD5, SHA-1, or SHA-256 hash.

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/guyoverclocked/forensic-analyzer-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server