Skip to main content
Glama
Sign In
mem-forensics-mcp

mem-forensics-mcp

by x746b
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Rust
Local

memory_dump_process

Extract process details from memory dumps by specifying PID and image path, revealing memory regions and loaded DLLs for forensic analysis.

Instructions

Get process info including memory regions and loaded DLLs.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "image_path": "<image_path>",
      "pid": "<pid>"
    },
    "name": "memory_dump_process"
  }
}

Input Schema

NameRequiredDescriptionDefault
pidYesProcess ID to dump
image_pathYesPath to memory dump file
output_dirNoDirectory for output files

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.2.2

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, but it only states a high-level action. It does not mention potential side effects like writing output files (despite output_dir parameter), required permissions, or operational considerations such as whether it reads from a dump file or a live process. This leaves significant behavioral ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that is front-loaded with the core action and key details. There is no superfluous text, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema and the presence of numerous sibling tools, the description is too sparse to fully contextualize the tool's operation. It doesn't explain what the output looks like, how memory regions and DLLs are presented, or when to prefer this over more specific sibling tools, so it falls short of complete guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter having a description, so the baseline is 3. The tool description adds no extra parameter-level meaning beyond what the schema already provides, but it does loosely align with the notion of dumping process information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Get process info') and specifies content ('memory regions and loaded DLLs'), giving a clear sense of purpose. However, it does not differentiate from sibling tools like memory_dump_vad or memory_analyze_image, which may also involve process or memory details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided regarding when to use this tool versus alternatives such as memory_dump_vad or memory_analyze_image. The description offers no context for selection or exclusions, leaving the agent without criteria to choose appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools