MemProcFS MCP Server

A Model Context Protocol (MCP) server for memory forensics analysis using MemProcFS.

Features

• Load Memory Images: Analyze memory dumps (.mem, .raw, .dmp)

• Process Analysis: List and analyze processes

• Network Analysis: View network connections

• Memory Reading: Read physical memory at any address

• Registry Analysis: List registry hives

• Driver Enumeration: List loaded kernel drivers

• VFS Navigation: Browse MemProcFS virtual file system

• Advanced Commands: Execute any MemProcFS operation via exec_command

Related MCP server: Protocol-SIFT-Async-Bridge

Installation

Prerequisites

• Python 3.10+

• MemProcFS binaries (download separately)

Quick Setup

# Clone the repository
git clone https://github.com/Varshith-JV-1410/memprocfs-mcp.git
cd memprocfs-mcp

# Run the setup script (automatically installs dependencies)
python setup.py

The setup script will:

1. Check Python version (requires 3.10+)

2. Install dependencies from requirements.txt

3. Verify MemProcFS installation

4. Provide exact MCP configuration for VS Code and Claude Desktop

Manual Setup

# Install dependencies from requirements.txt
pip install -r requirements.txt

# Download MemProcFS from:
# https://github.com/ufrisk/MemProcFS/releases/latest
# Extract to memprocfs/ folder

Usage

python server.py

MCP Configuration

For VS Code (GitHub Copilot)

Add to your VS Code settings (mcp.json):

{
  "memprocfs-mcp": {
    "command": "python",
    "args": ["/path/to/memprocfs-mcp/server.py"],
    "type": "stdio",
    "env": {
      "PYTHONPATH": "/path/to/memprocfs-mcp"
    }
  }
}

For Claude Desktop

Add to claude_desktop_config.json:

{
  "memprocfs-mcp": {
    "command": "python",
    "args": ["/path/to/memprocfs-mcp/server.py"],
    "env": {
      "PYTHONPATH": "/path/to/memprocfs-mcp"
    }
  }
}

Replace /path/to/memprocfs-mcp/ with the actual path to this project. Run python setup.py to get the exact configuration for your system.

Available Tools

exec_command Sub-Commands

License

GNU Affero General Public License v3.0