Windows Forensics MCP Server

Windows DFIR from Linux - A comprehensive forensics toolkit designed for Linux environments with no Windows runtime dependencies. Parse Windows artifacts natively, with an optional Rust SIDR sidecar for Windows Search.

• mem_forensics-mcp - Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage
• mac_forensics-mcp - macOS DFIR - Unified Logs, FSEvents, Spotlight, Plists, SQLite databases, Extended Attributes

# Install uv (fast Python package manager)
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc

# Ensure Python 3.10+
python3 --version

uv tool install winforensics-mcp

git clone https://github.com/x746b/winforensics-mcp.git
cd winforensics-mcp

# Install with uv (recommended)
uv sync

# Or install with all optional extras
uv venv && source .venv/bin/activate
uv pip install -e ".[all]"

Windows Search parsing uses SIDR 0.9.2. The source repository includes stripped Linux releases for ARM64 (.tools/sidr) and x86_64 (.tools/sidr_x86), built from the pinned commit recorded in their adjacent manifests. Either architecture can rebuild that exact revision with:

bash scripts/build_sidr.sh

The server discovers SIDR from an explicit tool argument, WINFORENSICS_SIDR_PATH, the architecture-matched bundled binary, or PATH, in that order. It never downloads or builds executables at runtime. Build or supply SIDR 0.9.2 separately on unsupported platforms. Without SIDR, windows_search_parse uses a clearly marked partial pyesedb fallback that cannot recover every compressed long value.

uv run python -m winforensics_mcp.server
# Should start without errors (Ctrl+C to exit)

Installed from PyPI

claude mcp add winforensics-mcp --scope user -- uv run winforensics-mcp

Installed from sources

claude mcp add winforensics-mcp \
  --scope user \
  -- uv run --directory /path/to/winforensics-mcp python -m winforensics_mcp.server

Verify:

claude mcp list
# Should show winforensics-mcp

For AI-assisted forensic analysis, include CLAUDE.md in your case directory. It provides:

• Orchestrator-first guidance - Ensures LLMs use high-level tools before low-level parsers
• Token efficiency - Reduces API costs by 50%+ through proper tool selection
• Investigation workflow - Step-by-step methodology for consistent analysis

Copy CLAUDE.md to your case directory:

cp /path/to/winforensics-mcp/CLAUDE.md /your/case/directory/
# Edit paths in CLAUDE.md to match your case

The LLM will automatically follow the orchestrator-first approach:

Investigate if mimikatz.exe was executed on the system at /mnt/evidence

The investigate_execution orchestrator checks Prefetch, Amcache, and SRUM:

{
  "target": "mimikatz.exe",
  "execution_confirmed": true,
  "confidence": "HIGH",
  "evidence": [
    {"source": "Prefetch", "finding": "Executed 3 times, last at 2024-03-15T14:23:45Z"},
    {"source": "Amcache", "finding": "SHA1: abc123..., First seen: 2024-03-14T09:00:00Z"},
    {"source": "SRUM", "finding": "Network: 15.2 MB sent; Foreground: 47 seconds"}
  ]
}

Hunt for the hash 204bc44c651e17f65c95314e0b6dfee586b72089 in /mnt/evidence

The hunt_ioc tool searches Prefetch, Amcache, SRUM, MFT, USN, Browser, EVTX, and optionally YARA:

{
  "ioc": "204bc44c651e17f65c95314e0b6dfee586b72089",
  "ioc_type": "sha1",
  "found": true,
  "sources_with_hits": ["Amcache", "MFT"],
  "findings": [
    {"source": "Amcache", "matches": 1, "details": "bloodhound.exe"},
    {"source": "MFT", "matches": 1, "details": "Users\\Admin\\Downloads\\bloodhound.exe"}
  ]
}

# Option 1: Environment variable
export VIRUSTOTAL_API_KEY="your-api-key-here"

# Option 2: Config file
mkdir -p ~/.config/winforensics-mcp
echo "your-api-key-here" > ~/.config/winforensics-mcp/vt_api_key

Get your free API key at virustotal.com. Free tier is rate-limited to 4 requests/minute; the client handles rate limiting and caches results for 24 hours.

# Debian/Ubuntu
sudo apt install detect-it-easy

# Or download from https://github.com/horsicq/DIE-engine/releases

Source checkouts include stripped SIDR releases for Linux ARM64 and x86_64. To rebuild the pinned revision for the current Rust target, run:

bash scripts/build_sidr.sh

For another installation, set WINFORENSICS_SIDR_PATH to a SIDR 0.9.2 executable. The parser reports the executable path, version, SHA-256, database state, extraction completeness, and evidence hashes in every response. See .tools/SIDR-LICENSE for the bundled sidecar's Apache-2.0 license.

claude mcp remove winforensics-mcp --scope user

Credits: omerbenamram/evtx (Rust EVTX parser), strozfriedberg/sidr (Windows Search), Rohitab Batra (API Monitor), Neo23x0/signature-base (YARA rules), horsicq/DIE-engine (Detect It Easy)

Core winforensics-mcp code is MIT licensed. See LICENSE.

Optional bundled IoC packs may use different licenses:

• winforensics_mcp/ioc_packs/impacket-iocs contains material derived from ThatTotallyRealMyth/Impacket-IoCs and is licensed under GPL-2.0. See winforensics_mcp/ioc_packs/impacket-iocs/LICENSE.

Built for the DFIR community. No Windows required >)