Skip to main content
Glama
x746b

Windows Forensics MCP Server

by x746b
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Hybrid

Related Servers

Alternatives to Windows Forensics MCP Server

No user-submitted related servers found.

    Related Servers

    • Self-Assembling Forensic MCP

      Ghosthunter5599
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI assistants to perform digital forensics analysis including memory analysis, file metadata inspection, and threat-intelligence lookups.
      2 npm
      ISC

    • Forensics MCP Server

      Ghosthunter5599
      F
      license
      A
      quality
      C
      maintenance
      Enables AI agents to perform digital forensics and incident response tasks by dynamically discovering and utilizing host tools for memory analysis, metadata extraction, threat detection, and file dissection.
      5
      1
      -

    • findevil-agent

      povfarwa
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables autonomous digital forensics and incident response through 21 typed forensic tools covering disk, memory, registry, network, timeline, carving, and patterns, integrated with AI-driven reasoning and self-correction.
      MIT

    • Vertex Cyber MCP

      Denisijcu
      F
      license
      Not graded
      quality
      C
      maintenance
      Enables local AI models to perform defensive cybersecurity analysis through narrowly scoped read-only tools for host posture, Windows security operations, file/IOC triage, code scanning, and allowlisted filesystem/network access while enforcing boundaries and audit trails.
      -

    • mcp-hayabusa

      SBecraft
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables Windows event log forensics by wrapping Hayabusa, offering EVTX scanning, Sigma rule exploration, ATT&CK coverage analysis, and detection engineering resources.
      MIT

    • DeskTether MCP Server

      HLRJ
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI agents to safely perform file operations, run terminal sessions, manage processes, search content, and inspect Git repositories on a local Windows machine under configurable permission and audit controls.
      Apache 2.0
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.2/5.0

    Scored across 55 tools

    Disambiguation3/5

    Several tools have overlapping purposes, such as api_analyze_imports vs api_detect_patterns, evtx_search vs evtx_security_search, and registry_query vs registry_search vs registry_get_key. Descriptions help distinguish them, but the volume of similar-sounding tools creates moderate ambiguity.

    Naming Consistency4/5

    Most tool names follow a snake_case pattern with domain prefixes (e.g., api_, apmx_, evtx_, registry_, disk_parse_). A few tools lack a domain prefix (build_timeline, hunt_ioc, investigate_execution), but overall naming is predictable and readable.

    Tool Count2/5

    With 55 tools, the server is far above the typical 3-15 range and exceeds the 25-tool threshold for 'too many.' While the broad forensics domain justifies many tools, the count is heavy and likely to overwhelm agents.

    Completeness4/5

    The server covers a wide range of Windows forensic artifacts (API captures, NTDS, EVTX, registry, disk, user activity, browser). Minor gaps exist, such as no ShimCache, Jump List, or Recycle Bin parsing, and no acquisition tools, but core parsing and analysis needs are well met.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources