{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_7tqqeweagbmf","handle":"iflow-mcp-kirandawadi-volatility3-mcp","url":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp","links":{"self":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp/record.json","html":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp","markdown":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp/record.md","api":"https://wellknown.network/api/v1/agents/iflow-mcp-kirandawadi-volatility3-mcp","status":"https://wellknown.network/api/v1/agents/iflow-mcp-kirandawadi-volatility3-mcp/status","claim":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp/claim.json","badge":"https://wellknown.network/agents/iflow-mcp-kirandawadi-volatility3-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/iflow-mcp-kirandawadi-volatility3-mcp/history","tools":"https://wellknown.network/api/v1/agents/iflow-mcp-kirandawadi-volatility3-mcp/tools"},"ard":{"identifier":"urn:air::server:iflow-mcp-kirandawadi-volatility3-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"iflow-mcp_kirandawadi-volatility3-mcp","summary":"Volatility3 MCP Server - Memory forensics analysis through MCP protocol","description":"# Volatility3 MCP Server\n\n## Introduction\nVolatility3 MCP Server is a powerful tool that connects MCP clients like Claude Desktop with Volatility3, the advanced memory forensics framework. This integration allows LLMs to analyze memory dumps, detect malware, and perform sophisticated memory forensics tasks through a simple, conversational interface.\n![Architecture Diagram](./attachments/architecture-diagram.svg)\n\n## Demo\n[Demo Video](https://1drv.ms/v/c/b3eb1096e4f4a3a8/EfKIAsM9zUpGtXjJMDn0zywB-R3UnwvYD4yX71q1CinfRw?e=lke0Ox)\n\nYou can also find a [detailed presentation](./attachments/project-presentation.pdf) on this tool here.\n\n## What This Solves\nMemory forensics is a complex field that typically requires specialized knowledge and command-line expertise. This project bridges that gap by:\n- Allowing non-experts to perform memory forensics through natural language\n- Enabling LLMs to directly analyze memory dumps and provide insights\n- Automating common forensic workflows that would normally require multiple manual steps\n- Making memory forensics more accessible and user-friendly\n\n## Features\n- **Memory Dump Analysis**: Analyze Windows and Linux memory dumps using various plugins\n- **Process Inspection**: List running processes, examine their details, and identify suspicious activity\n- **Network Analysis**: Examine network connections to detect command and control servers\n- **Cross-Platform Support**: Works with both Windows and Linux memory dumps (macOS support coming soon)\n- **Malware Detection**: Scan memory with **YARA rules** to identify known malware signatures\n\n## Configuration\n\n1. Clone this repository:\n2. Create a virtual environment:\n   ```bash\n   python -m venv environ\n   source environ/bin/activate\n   ```\n3. Install the required dependencies:\n   ```bash\n   pip install -r requirements.txt\n   ```\n\nYou can use this project in two ways:\n\n### Option 1: With Claude Desktop\n4. Configure Claude Desktop:\n   - Go to `Claude` -> `Settings` -> `Developer` -> `Edit C…","publisher":{"name":"Kirandawadi","url":null},"homepage":null,"repository":null,"version":"0.1.0","license":null,"protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:iflow-mcp_kirandawadi-volatility3-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.terminal","name":"Terminal & Shell","confidence":0.825,"provenance":"derived"}],"categories":["dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"iflow-mcp_kirandawadi-volatility3-mcp","registry":"pypi","observedAt":"2026-09-15T18:22:06.506Z","publishedAt":"2026-02-07T08:37:21.288284Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"iflow-mcp_kirandawadi-volatility3-mcp","url":"https://pypi.org/project/iflow-mcp_kirandawadi-volatility3-mcp/","firstSeenAt":"2026-09-09T19:24:32.535Z","fetchedAt":"2026-09-15T18:21:01.496Z","normalizedAt":"2026-09-15T18:21:01.496Z"}]},"firstSeenAt":"2026-09-09T19:24:32.535Z","updatedAt":"2026-09-15T18:22:06.506Z"}