1. Conduid
  2. Security
  3. Dfir
MCP server · Security

Dfir

· github.com/Androsh7/mcp_dfir

Disk and Memory Forensics MCP Server

Unclaimed forensics-toolsmcp-server
InstallView source
34Low

Scored a month ago · breakdown

About Dfir

Dfir is an MCP server in the Security category: disk and Memory Forensics MCP Server.

Install

From source
git clone https://github.com/Androsh7/mcp_dfir

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (18)

add_analyst_noteCreates a new analyst note

Parameters not published.

download_linux_symbolDownloads a Linux symbol file from Abyss-W4tcher/volatility3-symbols

Parameters not published.

download_windows_symbolDownloads and converts Windows PDB symbols for Volatility3

Parameters not published.

get_command_historyReturns all previously run commands

Parameters not published.

get_command_resultReturns the output of a specific past command

Parameters not published.

get_hashComputes a hash of a file

Parameters not published.

list_filesLists files in `evidence`, `artifacts`, or `symbols`

Parameters not published.

run_findRuns `find` to search for files

Parameters not published.

run_grepRuns `grep` on files

Parameters not published.

run_sleuthkit_commandRuns any Sleuth Kit tool for disk forensics

Parameters not published.

Show all 18 tools
run_stringsRuns `strings` on a file

Parameters not published.

run_volatility_commandRuns Volatility3 (`vol`) for memory forensics

Parameters not published.

search_linux_symbolsSearches the Linux symbol map by regex to find matching symbol files

Parameters not published.

show_analyst_noteRetrieves the content of a specific analyst note

Parameters not published.

show_analyst_notes_summaryLists all analyst notes

Parameters not published.

untar_fileExtracts a tar archive into `/artifacts`

Parameters not published.

unzip_fileExtracts a zip archive into `/artifacts`

Parameters not published.

update_analyst_noteUpdates an existing analyst note

Parameters not published.

Ask AI

✦

Ask AI about Dfir

Powered by Claude · Grounded in docs

I know everything about Dfir. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Dfir

How do I install Dfir?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Dfir safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Dfir still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.