winforensics-mcp
winforensics-mcp is an MCP server. It reaches virustotal. It needs VIRUSTOTAL_API_KEY to authenticate. Its repository has 25 GitHub stars and is licensed under MIT; we last read it on 2026-10-25.
This software provides a comprehensive MCP server for conducting digital forensics on Windows systems within a KALI Linux environment.
Install
Read from winforensics-mcp’s own README, close to verbatim -- not written by us, and not guessed.
uv tool install winforensics-mcp
What it reaches, and what it needs
Reaches
virustotal
Credential
VIRUSTOTAL_API_KEY
Maintenance
Stars
25
State
listed
Licence
MIT
From the repository
A comprehensive MCP server for Windows digital forensics on KALI Linux
What winforensics-mcp can do
40 tools documented in its README. An AI client calls these by name.
investigate_execution- Correlate Prefetch/Amcache/SRUM to prove binary execution
investigate_user_activity- Correlate Browser/ShellBags/LNK/RecentDocs for user activity
hunt_ioc- Hunt IOC (hash/filename/IP/domain) across all artifacts; `yara_scan=True` adds YARA threat intel
build_timeline- Build unified timeline from multiple artifact sources
file_analyze_pe- Static PE analysis - hashes, imports, exports, Authenticode program name, packer detection
disk_parse_prefetch- Parse Prefetch for execution evidence
disk_parse_amcache- Parse Amcache.hve for SHA1 hashes and timestamps
disk_parse_srum- Parse SRUDB.dat with exact/regex app filters, UTC ranges, derived network units, and optional aggregation
yara_scan_file- Scan file with 718 YARA rules (Mimikatz, CobaltStrike, webshells, APT, ransomware)
yara_scan_directory- Batch scan directory for malware
yara_list_rules- List available/bundled YARA rules
ioc_pack_list- List bundled and external IoC packs with license metadata
hunt_ioc_pack- Hunt behavioral IoCs across text exports, filenames, and PCAP payloads
vt_lookup_hash- Look up file hash (MD5/SHA1/SHA256) on VirusTotal
vt_lookup_behavior- Bounded sandbox domains, URLs, commands, registry/file writes; optional full-result persistence
vt_lookup_ip- Get IP address reputation and geolocation
vt_lookup_domain- Get domain reputation and categorization
vt_lookup_file- Calculate file hashes and look up on VirusTotal
pcap_get_stats- Get PCAP statistics - packet counts, protocols, top talkers
pcap_get_conversations- Extract TCP/UDP conversations with byte counts
pcap_get_dns- Extract DNS queries and responses
pcap_get_http- Extract HTTP requests with URLs, methods, user-agents
pcap_search- Search packet payloads for strings or regex patterns
pcap_find_suspicious- Detect C2 indicators, beaconing, DNS tunneling
apmx_parse- Parse .apmx64/.apmx86 capture - process info, modules, call counts
apmx_get_calls- Extract API calls with filtering, pagination, and time range support
apmx_get_call_details- Detailed records with parameter values, return values, timestamps
apmx_detect_patterns- Detect attack patterns (injection, hollowing, credential dumping) with MITRE ATT&CK IDs
apmx_correlate_handles- Track handle producer/consumer chains across API calls
apmx_get_injection_info- Enriched injection chain extraction (target PID, shellcode size, technique)
apmx_get_calls_around- Context window of calls around a specific record
apmx_search_params- Search all records for a specific parameter value
api_analyze_imports- Full PE import analysis with pattern detection and MITRE ATT&CK mapping
api_detect_patterns- Detect attack patterns from PE import tables
api_lookup- Look up Windows API signature (26,944 APIs with params, DLL, category)
api_search_category- Browse APIs by category (e.g., "Process Injection", "File Management")
die_analyze_file- Analyze file for packers, compilers, protectors, .NET
die_scan_directory- Batch scan directory for packed executables
die_get_packer_info- Get info about packer (difficulty, unpack tools)
disk_parse_mft- Parse $MFT with ADS metadata and timestomping detection
Read from the README; names are kept only if the README contains them.
Common questions about winforensics-mcp
- What does winforensics-mcp do?
- This software provides a comprehensive MCP server for conducting digital forensics on Windows systems within a KALI Linux environment.
- How do I install winforensics-mcp?
- Its own README gives this command: uv tool install winforensics-mcp. Run it where your MCP client can launch the server, and check the README for any settings it asks for.
- What does winforensics-mcp connect to, and what does it need?
- It reaches virustotal. The credentials we found in its source are VIRUSTOTAL_API_KEY.
- Is winforensics-mcp official and is it maintained?
- We found nothing naming it as a vendor’s official server. Its repository has 25 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-09-29.
- What licence does winforensics-mcp use?
- The repository declares the MIT licence.