Skip to main content
Glama
x746b

Windows Forensics MCP Server

by x746b

apmx_correlate_handles

Track handle values across API calls to reconstruct operation chains and reveal process injection attack sequences.

Instructions

Track handle values across API calls to reconstruct operation chains. Identifies handle-producing APIs (OpenProcess, CreateFile, etc.) and traces where those handles are consumed (VirtualAllocEx, WriteProcessMemory, etc.). Reveals attack chains like: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to .apmx64 or .apmx86 capture file
process_indexNoWhich process to analyze (0 = first/only process)
target_apisNoLimit to specific APIs (default: common injection/evasion APIs)
limitNoMaximum number of handle chains to return
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the burden of disclosing behavior. It explains that the tool identifies handle producers and consumers and reveals attack chains. It does not mention any side effects, authentication needs, or limitations, but the described behavior is consistent with a read-only analysis tool. A score of 4 reflects adequate transparency without annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two sentences that are front-loaded with the core purpose and supplemented with concrete examples. Every word serves a purpose, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description explains the tool's functionality well, it omits important contextual details: the output format is not described (no output schema), and prerequisites like prior parsing with apmx_parse are not mentioned. For a tool with moderate complexity, this gap lowers completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have descriptions in the input schema, achieving 100% coverage. The description adds value by explaining the purpose of target_apis and limit, and giving context about default behavior. The schema handles the basic definitions, but the description enriches understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: tracking handle values across API calls to reconstruct operation chains. It provides specific examples of handle-producing and consuming APIs, and distinguishes itself from sibling tools by focusing on handle correlation rather than generic call listing or pattern detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for analyzing API sequences related to handle usage, with examples of attack chains. However, it does not explicitly state when to avoid this tool or provide alternatives among siblings. The context is clear but lacks explicit usage boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/x746b/winforensics-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server