volatility-mcp

volatility-mcp is an open-source project hosted on GitHub that provides an MCP server for Volatility 3.x. Its goal is to seamlessly integrate Volatility 3's powerful memory analysis capabilities with FastAPI and the Model Context Protocol (MCP), making memory forensics barrier-free: plugins such as pslist and netscan can be accessed through a concise REST API, thereby connecting memory forensics artifacts directly to AI assistants and web applications.

Key capabilities

• Volatility 3 integration: Leverages the Volatility 3 framework for memory image analysis.
• FastAPI backend: Provides a RESTful API to interact with Volatility plugins.
• Web frontend support (future feature): Designed to connect to a web-based frontend for interactive analysis.
• Model Context Protocol (MCP): Supports standardized communication with MCP clients such as Claude Desktop.
• Plugin support: Supports a variety of Volatility plugins, including pslist for process listing and netscan for network connection analysis.

Project architecture The project consists of the following components:

• MCP client: Such as Claude Desktop, which interacts with the FastAPI backend.
• FastAPI server: A Python-based server that exposes Volatility plugins as API endpoints.
• Volatility 3: The memory forensics framework that performs the analysis. This architecture allows users to analyze memory images through MCP clients such as Claude Desktop. Users can perform memory forensics analysis using natural language prompts, such as "show me the list of the processes in memory image x" or "show me all the external connections made".

Usage Prerequisites:

• Python 3.7+ is installed on the system.
• The Volatility 3 binary is installed (see the Volatility 3 installation guide) and added to the environment variable path, with the variable name VOLATILITY_BIN.

Steps:

1. Clone the repository: git clone <repository_url> cd <repository_directory>
2. Install the required Python dependencies: pip install -r requirements.txt
3. Start the FastAPI server to expose the Volatility 3 API: uvicorn volatility_fastapi_server:app
4. Install Claude Desktop (see Claude Desktop).
5. Configure Claude Desktop as a volatility MCP client: Navigate to Claude → Settings → Developer → Edit Config, locate the claude_desktop_config.json file, and insert the following configuration: { "mcpServers": { "vol": { "command": "python", "args": [ "/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py", "-i", "/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>" ] } } } Note: The -i option in the config.json file specifies the directory path of the memory image file. Or directly update this file: /Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json
6. Start the FastAPI server as described above.
7. Connect the MCP client (e.g., Claude Desktop) to the FastAPI server.
8. Start prompting by asking questions, such as "show me the running processes", "creating a tree relationship graph for process x", or "show me all external RFC1918 connections".

Applicable scenarios Suitable for scenarios that require memory forensics analysis through an AI assistant or web application, such as quickly listing processes during an investigation, analyzing network connections, generating process relationship graphs, etc.

Future features and enhancements (planned)

• Native Volatility Python integration: introduce the Volatility Python SDK directly into the codebase, rather than calling the volatility binary through a subprocess.
• Yara integration: implement dumping processes from memory and scanning them with Yara rules for malware analysis.
• Multi-image analysis: support analyzing multiple memory images simultaneously to correlate events and identify cross-system patterns.
• Add more Volatility plugins: expand the scope of memory analysis.
• GUI enhancements: develop a user-friendly web interface for interactive memory analysis and visualization.
• Automated report generation: automatically generate detailed reports summarizing memory analysis findings.
• Advanced threat detection: introduce advanced techniques for detecting complex threats and anomalies in memory.

How to contribute Contributions are welcome! Please follow these steps:

1. Fork this repository.
2. Create a new branch (git checkout -b feature/my-feature).
3. Commit your changes (git commit -m 'Add some feature').
4. Push to the branch (git push origin feature/my-feature).
5. Open a pull request.

Limitations and notes

• The project is currently an MCP server; web frontend support is a future feature.
• The Volatility 3 binary must be installed in advance and the environment variables correctly configured.
• Specific details such as the range of supported plugins, performance, and pricing are not yet available.