Winforensics Mcp
About
<img src="icon.png" width="150" alt="WinForensics MCP"> # Windows Forensics MCP Server > **Windows DFIR from Linux** - A comprehensive forensics toolkit designed entirely for Linux environments with zero Windows tool dependencies. Parse Windows artifacts natively using pure Python libraries. --- ## Why This Matters…
Explore
- Parse EVTX logs with filtering and pre-built security queries
- Analyze Registry hives: SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.DAT
- Correlate Prefetch, Amcache, and SRUM for execution evidence
- Extract MFT with timestomping detection and USN Journal
- Investigate user activity: Browser, LNK, ShellBags, RecentDocs
- Analyze PCAP/PCAPNG files for suspicious network activity
- Scan files with 718 YARA rules from signature-base
- Look up hashes, IPs, domains on VirusTotal with caching
- Detect packers and compilers via Detect It Easy (DiE)
- Ingest Eric Zimmerman tool CSV output (MFTECmd, PECmd, etc.)
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Winforensics McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc
uv sync
uv pip install -e ".[all]"
Investigate execution of mimikatz.exe and powershell.exe in /mnt/evidence
export VIRUSTOTAL_API_KEY="your-api-key-here"
mkdir -p ~/.config/winforensics-mcp
echo "your-api-key-here" > ~/.config/winforensics-mcp/vt_api_key
Get your free API key at virustotal.com.
Note: Free tier is rate-limited to 4 requests/minute. The client automatically handles rate limiting and caches results for 24 hours.
mkdir -p ~/.config/winforensics-mcp
echo "your-key" > ~/.config/winforensics-mcp/vt_api_key
If you see rate limit errors, wait 15 seconds between requests (automatic) or use cached results.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"winforensics mcp": {
"winforensics-mcp": {
"command": "uv",
"args": [
"run",
"--directory",
"/path/to/winforensics-mcp",
"python",
"-m",
"winforensics_mcp.server"
]
}
}
}
}McpServers
{
"winforensics-mcp": {
"command": "uv",
"args": [
"run",
"--directory",
"/path/to/winforensics-mcp",
"python",
"-m",
"winforensics_mcp.server"
]
}
}Should show winforensics-mcp
---
LLM Integration (CLAUDE.md)
For AI-assisted forensic analysis, include CLAUDE.md in your case directory. It provides:
- Orchestrator-first guidance - Ensures LLMs use high-level tools before low-level parsers
- Token efficiency - Reduces API costs by 50%+ through proper tool selection
- Investigation workflow - Step-by-step methodology for consistent analysis
Usage
Copy CLAUDE.md to your case directory:
cp /path/to/winforensics-mcp/CLAUDE.md /your/case/directory/
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
