Enables checking file hash reputation against VirusTotal's threat intelligence database to identify known malicious files.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Forensic Artifact Investigator MCP Server run strings on the memory.dmp file"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A production-quality Model Context Protocol (MCP) server built with the NitroStack framework. It performs real, local forensic analysis of file bytes by orchestrating system forensic binaries (file, exiftool, GNU strings, and Volatility) via safe, shell-free subprocess execution.
Related MCP server: BinaryAnalysis-MCP
This server exposes local forensic tools as MCP primitives to LLM clients. The execution flow is strictly live:
Client Handshake: The MCP client establishes a JSON-RPC session over STDIO.
Tool Selection: When asked to inspect a file, the LLM calls extract-metadata or extract-strings.
Execution Safety: The server validates the path to ensure it remains inside the configured EVIDENCE_ROOT and blocks symlink/path traversal attacks.
Command Execution: The server spawns command-line forensic utilities directly (using execFile/spawn with shell: false). It enforces CPU timeouts and memory boundaries.
Chain-of-Custody Logging: Every command execution, success or failure, is appended to an audit log (data/analysis-log.jsonl).
Result Formatting: Results are returned to the client in structured JSON. The LLM can render the analysis-report widget to show a premium UI panel.
The server requires Node.js v18+ (v22 LTS recommended) and system forensic binaries.
On Debian/Ubuntu:
sudo apt-get update
sudo apt-get install -y file libimage-exiftool-perl binutils python3 python3-pip python3-venvOn CentOS/RHEL (EPEL required):
sudo dnf install epel-release
sudo dnf install -y file perl-Image-ExifTool binutils python3 python3-pipIt is highly recommended to install Volatility 3 in a dedicated virtual environment inside or adjacent to the project directory:
python3 -m venv .venv-volatility
source .venv-volatility/bin/activate
pip install --upgrade pip
pip install volatility3Determine the absolute path of the vol binary (usually .venv-volatility/bin/vol).
Follow the standard Linux installation instructions inside your WSL terminal (e.g. Ubuntu). Access Windows files via /mnt/c/.
Node.js: Install Node.js LTS via the official installer.
File Utility: Install git-bash or downoad the native Win32 file command via Git for Windows, then add it to your System PATH.
ExifTool: Download the stand-alone Windows executable from exiftool.org, rename it to exiftool.exe, and place it in a folder in your System PATH.
GNU strings: Download strings.exe from Sysinternals Suite and add it to your PATH.
Volatility 3:
Install Python 3 via the Microsoft Store or Python website.
Install Volatility 3 using PowerShell:
python -m venv .venv-volatility
.venv-volatility\Scripts\activate
python -m pip install --upgrade pip
python -m pip install volatility3The path to your binary will be .venv-volatility\Scripts\vol.exe.
Configure your local environment by creating a .env file in the root of forensic-artifact-investigator:
# Absolute path to the folder containing your evidence files
EVIDENCE_ROOT=/Users/nambi/Documents/Forensic Open Source/evidence
# Volatility configuration
VOLATILITY_MAJOR_VERSION=3
VOLATILITY_BINARY=/Users/nambi/Documents/Forensic Open Source/.venv-volatility/bin/vol
# Optional: VirusTotal Reputation API Key (Leave empty to skip online reputation checks)
VIRUSTOTAL_API_KEY=
# Execution Limits
FILE_COMMAND_TIMEOUT_MS=60000
VOLATILITY_TIMEOUT_MS=300000
MAX_RETURNED_STRINGS=5000
MAX_STRING_OUTPUT_BYTES=2000000
VOLATILITY_MAX_OUTPUT_BYTES=5000000extract-metadataExtracts filesystem size, runs file --mime-type to detect the actual type, checks for MIME discrepancies using the signatures database, computes the SHA-256, and extracts camera, GPS, and timestamp metadata via ExifTool.
Parameters:
{
"filePath": "/evidence/suspect_photo.jpg"
}Response Example:
{
"tool": "extract-metadata",
"targetFile": "/evidence/suspect_photo.jpg",
"fileSizeBytes": 1717,
"extension": ".jpg",
"detectedMimeType": "image/jpeg",
"expectedMimeTypes": ["image/jpeg"],
"extensionKnown": true,
"extensionMismatch": false,
"sha256": "37751c11e6cc72ef0d39e31dcd4dfdf2252c8adab256be47e24b745499cf29fa",
"metadata": {
"camera": {
"make": "TestCamera",
"model": "Forensic-1000",
"lens": "TestLens 35mm"
},
"gps": {
"latitude": "37 deg 48' 0.00\" N",
"longitude": "122 deg 25' 0.00\" W",
"altitude": "10 m"
},
"software": "EvidenceGen v1.0",
"timestamps": {
"dateTimeOriginal": "2026:07:12 12:00:00"
}
}
}extract-stringsExtracts ASCII/Unicode characters with a minimum length of 6, and scans them for IP addresses, URLs, domains, and suspicious command-line keywords.
Parameters:
{
"filePath": "/evidence/suspect_photo.jpg"
}Response Example:
{
"tool": "extract-strings",
"totalStringsCaptured": 23,
"returnedCount": 23,
"patternMatches": {
"ipAddresses": [],
"urlsAndDomains": [
{
"matchedValue": "http://malicious-site.com/payload.exe",
"sourceString": "Download link http://malicious-site.com/payload.exe here.",
"type": "url"
}
],
"suspiciousKeywords": [
{
"keyword": "powershell",
"sourceString": "powershell -EncodedCommand AAAA"
}
]
}
}analyze-memory-dumpInvokes the configured Volatility binary to run sequentially: windows.info, windows.pslist, windows.netscan, and windows.malfind.
Parameters:
{
"filePath": "/evidence/winmem.raw"
}Response Example (Truncated):
{
"tool": "analyze-memory-dump",
"volatilityVersion": 3,
"volatilityBinary": "/path/to/vol",
"osProfile": {
"NTBuildLab": "14393.pc.release...",
"SystemTime": "2026-07-12 12:00:00"
},
"processList": [
{
"PID": 4,
"PPID": 0,
"ImageFileName": "System"
}
],
"pluginResults": {
"info": { "status": "success", "rowCount": 1 },
"pslist": { "status": "success", "rowCount": 120 },
"netscan": { "status": "success", "rowCount": 15 },
"malfind": { "status": "success", "rowCount": 3 }
}
}signatures://magic-bytesReturns the JSON sign-off references containing mapping tables.
MIME: application/json
case://analysis-logReturns the append-only logs compiled from data/analysis-log.jsonl.
MIME: application/json
signatures://threat-intel/{hash}Returns VirusTotal file hash summary statistics.
Special offline path: Querying MD5 44d88612fea8a8f36de82e1278abb02f (EICAR) returns a local response without internet connection:
{
"status": "found",
"source": "deterministic-eicar-fixture",
"hash": "44d88612fea8a8f36de82e1278abb02f",
"hashAlgorithm": "md5",
"malicious": 1,
"summary": "Known EICAR antivirus test-file hash; deterministic test response."
}full-file-analysis: An interactive prompt guiding LLMs to parse, check reputation, and organize findings under exact headers: Confirmed Anomalies, Possible Anomalies, and Clean.
analysis-report: Headless React interface. Renders structured results on a dark-mode optimized layout with interactive copy-pastes for analysts.
To add this server to Claude Code, run:
claude mcp add forensic-server node /path/to/forensic-artifact-investigator/dist/index.js(Make sure to compile the project first using npm run build and populate the .env file.)
To configure inside Cursor IDE:
Open Cursor Settings.
Go to Features -> MCP.
Click + Add New MCP Server.
Configure as follows:
Name: Forensic Investigator
Type: command
Command: node "/path/to/forensic-artifact-investigator/dist/index.js"
Save and check that the indicator turns green.
Add this configuration to your local config at ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"forensic-artifact-investigator": {
"command": "node",
"args": [
"/path/to/forensic-artifact-investigator/dist/index.js"
],
"env": {
"EVIDENCE_ROOT": "/path/to/evidence",
"VOLATILITY_BINARY": "/path/to/vol",
"VOLATILITY_MAJOR_VERSION": "3"
}
}
}
}Install Dependencies:
npm installRun Typechecking:
npm run typecheckRun Tests (Vitest):
npm testBuild Server and Widgets:
npm run buildRun Server Locally:
npm startNo Shell Interpolation: Evaluates arguments array in a shell-free execution context to prevent subprocess vulnerability exploits.
Log Sanitation: The application guarantees that VIRUSTOTAL_API_KEY is not logged in files or included in errors.
Path Restrictions: Every file validation requires canonical comparison against EVIDENCE_ROOT to prevent symlink traversal breakouts.
Findings are Indicators: Discrepancies and strings are only indicators. They are designed to assist human validation and must not be used as final legal proof of malware.
Analyze a Windows memory dump using the installed Volatility binary. Runs Volatility plugins sequentially: windows.info (OS/kernel details), windows.pslist (process list), windows.netscan (network connections), and windows.malfind (injected/code-hinting regions). Each plugin result independently reports success, failure, or unavailability — a single plugin failure does not fail the entire analysis. Designed for Windows memory dumps because the required plugins are Windows-specific. A malfind result requires analyst review — it is an indicator, not proof of malware. No forensic results are fabricated; if Volatility cannot parse the dump, real failure output is returned.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to the memory dump file within the evidence root (e.g. /evidence/winmem.raw) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already declare readOnlyHint=true and destructiveHint=false, the description adds substantial behavioral context: plugins run sequentially, each independently reports success/failure/unavailability, a single failure does not fail the overall analysis, malfind output requires analyst review, and no results are fabricated. These details go far beyond the annotations and help the agent set expectations correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, starting with a precise purpose statement, then listing the plugins and behavioral caveats. Each sentence contributes essential information without redundancy, making it efficient and well-structured for an agent to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter, no output schema, and moderate complexity, the description is thorough: it covers input type, plugin sequence, failure handling, output interpretation, and domain restriction. The lack of a return structure is mitigated by the detailed explanation of what each plugin reports, making the description sufficient for invocation and result understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the only parameter, filePath, with a clear description and example (i.e., /evidence/winmem.raw). The tool description adds no additional parameter-specific meaning, only reference to 'Windows memory dump' in general; given the 100% schema coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Analyze a Windows memory dump' and enumerates four distinct Volatility plugins, making its function unmistakable. It clearly distinguishes itself from sibling extraction tools (extract-metadata, extract-strings) by focusing on deep forensic analysis rather than simple extraction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states it is 'designed for Windows memory dumps' and notes the plugins are Windows-specific, providing a clear exclusions for non-Windows files. However, it does not explicitly compare with the sibling tools or state when to choose them instead, leaving the alternative guidance implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Extract metadata from a forensic evidence file. Runs the real file --brief --mime-type command to detect the actual MIME type, compares it against the file extension using a bundled magic-byte signature database to detect MIME/extension discrepancies, runs ExifTool to extract embedded metadata (camera, GPS, timestamps, dimensions), and computes a streaming SHA-256 hash of the file. Use this tool for metadata extraction, MIME-disguise checks, and file hashing. All results come from actual command execution against the file bytes — no fixtures or mocks.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to the evidence file within the evidence root (e.g. /evidence/suspect_photo.jpg) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds valuable context: it runs real commands (file, ExifTool), uses a streaming SHA-256 hash, and states results come from actual file bytes without fixtures or mocks, which explains performance and trustworthiness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but efficient; each sentence contributes specific information about the tool's operations. It front-loads the core purpose and then explains the methods. It is slightly longer than necessary but not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description thoroughly covers what the tool does but fails to describe the output format or return value, which is critical given there is no output schema. The lack of return-value information leaves a gap in fully understanding the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with a clear description for filePath, and the tool description provides an example path. Since schema coverage is complete, the description adds little beyond the schema, meeting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool extracts metadata from forensic evidence files and enumerates specific operations: MIME type detection, extension comparison, ExifTool metadata extraction, and SHA-256 hashing. It explicitly lists the use cases (metadata extraction, MIME-disguise checks, file hashing), making it distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this tool for metadata extraction, MIME-disguise checks, and file hashing,' providing clear when-to-use guidance. However, it does not mention when not to use the tool or alternative tools, though the sibling names suggest contextual boundaries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Extract readable strings from a forensic evidence file using the real GNU strings -n 6 command. Scans the actual command output for suspicious patterns including IPv4 addresses, URLs, domains, and suspicious keywords (cmd.exe, powershell, base64, Invoke-Expression, certutil, rundll32, etc.). A keyword hit is an indicator, not proof of malware. Results are bounded to prevent oversized responses. Use this tool to find embedded text, URLs, and potential indicators in binary files.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to the evidence file within the evidence root (e.g. /evidence/suspect_photo.jpg) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds significant behavioral context beyond annotations: specifies the exact command (GNU strings -n 6), describes pattern scanning, cautions that keyword hits are indicators not proof, and notes bounded results. These details help the agent understand side effects and limitations. No contradiction with readOnlyHint or idempotentHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four focused sentences, each adding value: the action, scanning behavior, caveat about indicators, and usage guidance. No fluff, front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's single parameter, full schema coverage, and existing annotations, the description fully covers what the tool does, how it behaves, and when to use it. No output schema is present, but the description implies the output (readable strings) and mentions bounded results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already provides full coverage for the single filePath parameter (100%). The description does not add additional parameter-level detail beyond what the schema states, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb+resource: 'Extract readable strings from a forensic evidence file using the real GNU `strings -n 6` command.' It clearly distinguishes from sibling tools extract-metadata and analyze-memory-dump by focusing on string extraction and indicator scanning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: 'Use this tool to find embedded text, URLs, and potential indicators in binary files.' It does not explicitly state when not to use the tool or mention alternatives, but the context is sufficient given the sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0analyze-memory-dumpextract-metadataextract-stringsScored across 3 tools
Each tool addresses a completely distinct forensic task: file metadata/hash, string extraction with indicator scanning, and memory dump analysis. There is no functional overlap, so agents can easily select the right tool.
All tool names follow the same verb-noun pattern with lowercase and hyphens (extract-metadata, extract-strings, analyze-memory-dump). The naming is perfectly consistent and predictable.
Three tools is on the lower end but still within a reasonable range for a focused forensic artifact investigator. The count is just slightly under what might be expected, but each tool covers a major area.
The toolset covers core forensic workflows: file metadata/hash analysis, string/indicator extraction, and memory dump analysis. Minor gaps exist (e.g., no timeline or registry parsing), but the essential artifact types are addressed.
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Third-party sandbox verdict on any artifact in one call, no account. Also an agent marketplace.
Offline methodology engine for authorized penetration testing, CTF, and security research.
