A Model Context Protocol (MCP) server that integrates Volatility 3 memory forensics framework with Claude
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add volatility --env PYTHONPATH='<PYTHONPATH>' -- python /path/to/volatility_mcp_server.py~/.codex/config.toml
[mcp_servers.volatility]
command = "python"
args = ["/path/to/volatility_mcp_server.py"]
env = { PYTHONPATH = "<PYTHONPATH>" }
# codex mcp add volatility --env PYTHONPATH='<PYTHONPATH>' -- python /path/to/volatility_mcp_server.py~/.cursor/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/path/to/volatility_mcp_server.py"
],
"env": {
"PYTHONPATH": "<PYTHONPATH>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"volatility": {
"type": "stdio",
"command": "python",
"args": [
"/path/to/volatility_mcp_server.py"
],
"env": {
"PYTHONPATH": "<PYTHONPATH>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/path/to/volatility_mcp_server.py"
],
"env": {
"PYTHONPATH": "<PYTHONPATH>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/path/to/volatility_mcp_server.py"
],
"env": {
"PYTHONPATH": "<PYTHONPATH>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/path/to/volatility_mcp_server.py"
],
"env": {
"PYTHONPATH": "<PYTHONPATH>"
}
}
}
}Environment variables
PYTHONPATH
Replace the placeholders with your own credentials and keep them out of version control.