Runs Volatility 3 memory forensics plugins such as pslist and netscan so an AI assistant can analyze memory dumps.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add volatility -- python /ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py -i '/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>'~/.codex/config.toml
[mcp_servers.volatility]
command = "python"
args = ["/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py", "-i", "/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"]
# codex mcp add volatility -- python /ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py -i '/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>'~/.cursor/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}.vscode/mcp.json
{
"servers": {
"volatility": {
"type": "stdio",
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}