Forensics Utils MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CACHE_MAX_SIZE_MB | No | Maximum cache size in MB (default: 200) | 200 |
| VIRUSTOTAL_API_KEY | No | Required for VirusTotal features. Get your API key from https://www.virustotal.com/gui/my-apikey |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| vt_scan_file_toolA | Scan a file using VirusTotal. For files smaller than 32MB, uploads the file directly. For larger files, calculates hash and checks VirusTotal database. |
| vt_get_file_report_toolA | Get VirusTotal analysis report for a file by its hash. |
| vt_get_file_behavior_toolA | Get behavior summary for a file analyzed in VirusTotal's sandbox. |
| vt_scan_url_toolC | Submit a URL to VirusTotal for scanning. |
| vt_get_url_report_toolB | Get VirusTotal analysis report for a URL. |
| vt_get_domain_report_toolA | Get VirusTotal intelligence report for a domain. Includes: WHOIS data, DNS records, SSL certificates, reputation score, and related files/URLs. |
| vt_get_ip_report_toolA | Get VirusTotal intelligence report for an IP address. Includes: Geolocation, ASN information, reputation score, related files, URLs, and domains. |
| vt_search_files_toolA | Search for files using VirusTotal Intelligence. Supports advanced search syntax:
|
| vt_get_comments_toolB | Get community comments for a VirusTotal object. |
| die_analyze_file_toolA | Analyze a file using Detect It Easy (DIE) with deep scan mode. Uses flags: -a (all types), -u (heuristic scan), --verbose, -j (JSON output) Returns detailed analysis including:
|
| calculate_hashes_toolA | Calculate multiple hash values for a file. Calculates: MD5, SHA1, SHA256, SHA512, and SSDEEP (if available) |
| extract_exif_toolA | Extract EXIF and metadata from a file using ExifTool. Supports images, documents, media files, and many other formats. Extracts: camera info, GPS coordinates, timestamps, software versions, author information, and hundreds of other metadata fields. |
| extract_strings_toolA | Extract readable strings from a binary file. Useful for analyzing malware, finding embedded URLs, file paths, error messages, and other interesting artifacts. |
| binwalk_scan_toolA | Scan a file for embedded signatures using binwalk. Detects file signatures, archives, compressed data, and other embedded file types within binary data. Useful for firmware analysis, memory dumps, and packed executables. |
| binwalk_extract_toolA | Extract embedded files from a binary using binwalk. Automatically extracts known file types (ZIP, ELF, etc.) found within the binary. Uses recursive extraction to handle nested archives. |
| firefox_profile_summary_toolA | Summarize basic Firefox artifacts available in a browser profile. Typical Firefox profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Extract with disk-forensics first, then point this tool at the extracted directory. Detects whether history, bookmarks, downloads, cookies, sessions, favicons, extensions, preferences, and login metadata artifacts are present. |
| firefox_parse_history_toolA | Parse Firefox browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_bookmarks_toolA | Parse Firefox bookmark entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_downloads_toolB | Parse Firefox download candidates from a browser profile. |
| firefox_parse_cookies_toolB | Parse Firefox cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_decrypt_cookies_toolA | Return Firefox cookies as already-decrypted plaintext values. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Firefox stores cookies plaintext in cookies.sqlite, so this tool provides parity with Chromium-style decrypt flows by normalizing plaintext values into a decrypt-oriented response. |
| firefox_parse_sessions_toolB | Parse Firefox session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_session_storage_toolC | Parse Firefox session storage records when sessionstore contains them. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_favicons_toolA | Parse Firefox favicons from the favicons database. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_extensions_toolA | Parse Firefox installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_preferences_toolA | Parse Firefox preferences from prefs.js. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_logins_toolA | Parse Firefox saved-login metadata from logins.json. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_web_data_toolC | Parse Firefox web-data-like artifacts such as form history, permissions, Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". content preferences, and search engines. |
| firefox_parse_local_storage_toolA | Parse Firefox local storage records from webappsstore and storage/default/ls. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_indexeddb_toolB | Parse Firefox IndexedDB records from storage/default/*/idb. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_parse_cache_toolB | Parse Firefox cache records from storage/default/*/cache. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". |
| firefox_decrypt_logins_toolA | Attempt to decrypt Firefox saved passwords via firefox_decrypt. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Requires NSS libs and optional primary_password. |
| chromium_profile_summary_toolA | Summarize deep Chromium artifacts available in a browser profile. Typical Chromium profile paths: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (Chrome) or "C:\Users<user>\AppData\Local\Microsoft\Edge\User Data\Default" (Edge). Extract with disk-forensics first, then point this tool at the extracted directory. Detects whether Local Storage, Session Storage, IndexedDB, and Cache are present and returns a small sample of the content identifiers for each. |
| chromium_parse_local_storage_toolA | Parse Chromium Local Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_session_storage_toolA | Parse Chromium Session Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_indexeddb_toolB | Parse Chromium IndexedDB records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_cache_toolB | Parse Chromium HTTP cache records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_history_toolA | Parse Chromium browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_downloads_toolA | Parse Chromium download records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". Reads downloads from both the History database and shared_proto_db when present. |
| chromium_parse_sessions_toolB | Parse Chromium session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_favicons_toolA | Parse Chromium favicons from the Favicons database. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_web_data_toolB | Parse common Chromium Web Data tables. Supports categories such as autofill, keywords, and profiles when present. |
| chromium_parse_extensions_toolA | Parse Chromium installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_preferences_toolC | Parse Chromium Preferences and Secure Preferences data. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_bookmarks_toolA | Parse Chromium bookmark URL entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". |
| chromium_parse_cookies_toolA | Parse Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". Supports both legacy |
| chromium_decrypt_cookies_toolA | Attempt to decrypt Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". Supports two modes:
|
| chromium_parse_logins_toolA | Parse Chromium saved-login metadata from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (or Edge). On Windows the Local State file is required for v10/v11 decryption. Reads the |
| chromium_decrypt_logins_toolA | Attempt to decrypt Chromium saved passwords from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default". Supports two modes:
|
| get_cache_statsB | Get cache statistics. Returns: JSON object with cache stats including size and entry count |
| clear_cacheA | Clear all cache entries. Returns: JSON object with operation status |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 51 tools
Most tools have distinct targets, but there are several easily confused pairs: parse vs decrypt cookies for both Chromium and Firefox, session vs session storage, and the generic get_cache_stats vs browser-specific cache parsing tools. These ambiguities could lead an agent to select the wrong tool.
The majority of tools follow a clear snake_case pattern with domain prefixes (vt_, chromium_, firefox_), but the cache utilities (get_cache_stats, clear_cache) lack the _tool suffix, and some tools use verb-first naming (extract_exif_tool) while others use tool-first (binwalk_scan_tool). Overall, the naming is mostly consistent and readable.
With 51 tools, the server far exceeds the threshold where a toolset feels heavy. While the breadth of browser forensics explains many tools, the granularity (e.g., separate tools for each artifact type in each browser) makes the server difficult to navigate, and the presence of two unrelated cache utilities adds unnecessary bloat.
The toolset provides comprehensive coverage for file analysis (hashing, EXIF, strings, binwalk, DIE) and VirusTotal interactions, and very thorough browser forensics for Chromium and Firefox, including parsing, decryption, and profile summaries. Minor gaps exist, such as no direct memory/disk forensics and no ability to add VirusTotal comments, but these are outside the apparent core scope.