Runs Volatility 3 memory forensics plugins such as pslist and netscan so an AI assistant can analyze memory dumps.
接入配置
选择客户端，复制配置，再按项目文档补齐环境变量。
claude mcp add volatility -- python /ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py -i '/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>'~/.codex/config.toml
[mcp_servers.volatility]
command = "python"
args = ["/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py", "-i", "/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"]
# codex mcp add volatility -- python /ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py -i '/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>'~/.cursor/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}.vscode/mcp.json
{
"servers": {
"volatility": {
"type": "stdio",
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"volatility": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO_MCP-SERVER/vol_mcp_server.py",
"-i",
"/ABSOLUTE_PATH_TO_MEMORY_IMAGE/<memory_image>"
]
}
}
}