- Conduid
- Marketplace
- #forensics
MCP servers tagged forensics
46 live MCP servers tagged "forensics", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with forensics.
Prowler
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Volatility3
Volatility 3.0 development
Sift MCP
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
OSINT BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
Mem Forensics MCP
Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.
shark
Wireshark-like forensic analysis for Model Context Protocol communications Capture, inspect, and investigate all HTTP requests and responses between your IDE and MCP servers
Awesome Osint Repos
Continuously updated catalogue of open-source OSINT tools, skills, plugins, MCP servers, and agentic integrations.
Anti Autoresearch
Don't trust an autoresearch paper at face value. Reviewer-side integrity forensics (self-consistency + fabrication), deterministic verdict. 61 signals: 46 integrity hack-patterns…
Mulder
Agentic DFIR
LovelyMiscLab
面向取证的节点式可视化工作台 —— 像 ComfyUI 一样搭工作流，专为编码解密、隐写取证、图像分析、密码学而生。
AI Dfir Toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider t…
Wechat Decrypt Macos
微信 macOS 聊天记录解密与分析工具 | Decrypt & analyze WeChat chat history on macOS via SQLCipher key extraction from process memory
Repo Forensics
Security scanner for GitHub repos, Agent Skills, Plugins, and MCP servers. 18 scanners. Zero dependencies.
Valhuntir
Valhuntir CLI — AI-augmented incident response platform
UltraFastFileSearch
Ultra-fast file search for Windows using NTFS MFT
Verdict Dfir
VERDICT — a DFIR agent (Claude Code as the engine) that produces a signed, offline-verifiable verdict. SANS Find Evil! 2026.
Hermes OTG
Your agentic system rescue companion, especially for broken host Hermes. Hermes Agent on a USB stick — zero install & portable, hot-swappable & instant full agent power on any PC.
Wintools MCP
Valhuntir Windows forensic tool execution via MCP
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Txgraph
Builds a transaction graph from ledger/account data and surfaces structuring, layering, and mule-network patterns for AML triage.
Agent Trace Witness
External witness for autonomous multi-agent AI systems: signed readiness seal, choke-point capture, and PROV-DM causal graphs for post-incident reconstruction
Agentic Dart
Automate digital forensics and incident response tasks using an autonomous agent aligned with MITRE ATT&CK frameworks.
Verdict
Autonomous DFIR agent for SIFT - cited findings, audited actions, zero hallucinated evil.
EDB FILE EXPLORER
Cross-platform GUI, CLI and MCP server for Microsoft ESE databases (ntds.dit, SRUDB.dat, Exchange .edb, WebCacheV01.dat, Windows.edb) - digital forensics tool with multi-format ex…
Memory Blackbox
Agent memory forensics — trace a bad agent action back to the exact poisoned memory, see the blast radius, roll it back
CyberChef MCP
[CyberChef-MCP] Model Context Protocol Server for CyberChef ... exposing GCHQ's "Cyber Swiss Army Knife" as 463+ executable AI agent tools spanning encryption, encoding, compressi…
ProcWitness
Passive process forensics for Windows, Linux and macOS. Records process behavior locally and produces an AI-ready evidence bundle.
Mftparse
Analyze an NTFS $MFT CSV for timestomping and suspicious file activity
Ssltriage
Grade TLS config (protocols/ciphers/expiry) from openssl/sslyze output
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
SAVVYDFIR MCP
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a determinis…
Evidencegene Court
Adversarial autonomous DFIR: Prosecutor/Defender/Arbiter AI court over a typed read-only MCP server. Findings without real evidence refs are structurally rejected. SANS FIND EVIL!…
Cyber Incident Investigation And Triage MCP Server
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount…
WinReg MCP
Unlock deeper insights into the Windows Registry with AI-powered analysis.
NTZ
Evidence-first VM experimentation platform for system analysis, debugging, and AI-assisted investigation.
ManuSift
Screen scholarly PDFs and Source Data for integrity red flags—image reuse, table anomalies, metadata—offline CLI and MCP. No API key required.
Glaive
Graph-Linked Adversarial Investigation & Verification Engine autonomous DFIR with architectural hallucination resistance.
Steganography MCP
128-tool MCP server for steganography analysis — LSB detection, chi-square steganalysis, RS analysis, JPEG/F5/JSteg/OutGuess detection, BPCS, video & GIF stego, network covert cha…
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Memtriage
Triage memory-dump artifacts: strings, IOCs, suspicious processes from a dump export
FindEvil CyberSecurity
🏆 Hackathon — AI-powered threat detection & malicious pattern recognition tool for cybersecurity analysis
Trackblock
Family phone stalkerware audit — MVT-class iOS/Android forensics
Agenthusk
Local-first forensic scanner for secrets and risky residue left by AI coding agents.
Skeptic
SKEPTIC — the local text forensics lab. Paste anything, trust nothing, transmit nothing. 9 deterministic instruments · zero dependencies · browser app + REST API + MCP server.
Prefetchparse
Surface program-execution evidence from Windows Prefetch exports
OpenProcessGuard MCP
Read-only Windows process-forensics MCP server for Claude Desktop — 17 tools across 6 hunt stages, cosign-signed releases + SBOM, zero telemetry.