Skip to main content
Glama
x746b

mem-forensics-mcp

by x746b

memory_run_plugin

Execute forensic analysis plugins against a memory image to uncover processes, network artifacts, or hidden code. Filter results and supply custom plugin parameters.

Instructions

Run a forensics plugin. Tier 1 (Rust, fast): pslist, psscan, cmdline, dlllist, malfind, netscan, cmdscan, search, readraw, rsds — use short names. Tier 3 (Vol3): any other plugin — short names auto-resolve (e.g. 'filescan', 'handles', 'envars'). If a short name fails, use full Vol3 path: 'windows.category.PluginName' (e.g. 'windows.mftscan.MFTScan'). Use 'filter' param to grep results server-side (avoids truncation). For search: use params={"pattern": "text", "encoding": "ascii|utf16le|hex", "limit": N, "context": N}.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pidNoFilter by PID
filterNoCase-insensitive substring filter applied to results before returning. Useful for large result sets like filescan.
paramsNoAdditional plugin parameters
pluginYesPlugin name (e.g., 'pslist', 'malfind', 'filescan')
image_pathYesPath to memory dump file
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description reveals important behavioral traits: tiered plugin performance (Rust vs Vol3), automatic name resolution and fallback failures, server-side filtering to avoid truncation, and the exact parameter structure for 'search'. It doesn't mention output format, but for a plugin runner that varies and is not strictly required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: the first states purpose, the second explains plugin naming conventions, and the third gives usage tips. Each sentence provides essential operational detail with no filler, and key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, nested 'params', no output schema, no annotations), the description covers critical aspects: plugin tiers, name resolution fallback, filter usage, and search parameters. It omits mention of 'pid', but that is a simple filter and self-explanatory in the schema. The lack of return-value description is mitigated by the variability across plugins.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, giving baseline 3. The description adds meaning by explaining how to use 'filter' (case-insensitive, server-side, avoids truncation) and detailing the JSON structure for 'params' when using search plugins, which goes beyond the schema's generic 'Additional plugin parameters'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear action: 'Run a forensics plugin,' identifying the specific resource (memory image) and the tool's role as a generic plugin executor. It distinguishes from sibling tools by listing plugin categories and examples, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete guidance on when to use short names vs. full Vol3 paths, and instructs use of the 'filter' and 'params' parameters for specific scenarios like large result sets or search plugins. However, it doesn't explicitly compare to sibling specialized tools like 'memory_full_triage' or 'memory_hunt_process_anomalies', so exclusion guidance is implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/x746b/mem_forensics-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server