Skip to main content
Glama
Sign In
forensic-mcp

forensic-mcp

by paulojur
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to forensic-mcp

No user-submitted related servers found.

    Related Servers

    • Windows Forensic MCP Server

      nannib
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables an LLM agent to inventory Windows physical disks, partitions and logical volumes read-only, then plan and execute guarded forensic imaging to E01 format via ewftools, requiring validated plans, explicit execution flags, distinct source/destination disks and attested write blockers. Also verifies image integrity, extracts image metadata, and produces Markdown, JSON, HTML and audit-log reports.
      3
      Apache 2.0

    • FEA

      keyuraghao
      A
      license
      C
      quality
      B
      maintenance
      Enables AI agents to inspect forensic disk images locally and read-only across file systems, registry hives, event logs, databases, prefetch, shortcuts, and unallocated space. Every result includes supporting evidence and limitations, with timeline and search operations available through MCP tools.
      35
      MIT

    • VeriSIFT

      Zenidp
      A
      license
      Not graded
      quality
      D
      maintenance
      Read-only MCP server for autonomous, spoliation-proof disk-image triage with self-correcting verification loop.
      MIT

    • sift-mcp

      javierdejesusda
      A
      license
      Not graded
      quality
      D
      maintenance
      Read-only MCP server that exposes deterministic NTFS timestomp detection tools for autonomous forensic triage, with architectural guarantees against evidence modification.
      MIT

    • coroner

      Gutem
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI agents to inspect Autopsy forensic cases through read-only MCP tools for case metadata, filesystem and artifact search, timeline and account queries, evidence extraction, and hash-chained audit/seal verification.
      1 npm
      2
      GPL 3.0
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 1 tool

    Disambiguation5/5

    With only a single tool exposed, there is no possibility of confusing it with another; its purpose (hashing a file or disk image read-only with provenance) is unambiguous.

    Naming Consistency5/5

    The single name hash_evidence_file follows a clear verb_noun snake_case convention and is self-descriptive.

    Tool Count2/5

    One tool is far too thin for a forensic evidence server, which implies hashing, verification, manifest generation, and custody tracking. The surface is essentially a single operation.

    Completeness3/5

    Hashing with provenance is a solid core operation, but there is no batch/directory hashing, known-hash list comparison workflow, manifest or chain-of-custody output, or metadata extraction, leaving notable gaps for real forensic use.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Resources