agentmods.dev

dfir MCP servers

16 tagged dfir, measured the same way as everything else here.

Browse within: forensics 10digital-forensics 8ai-forensics 6human-in-the-loop 6

Sort RelevanceRecently updatedFewest tokensSecurity gradeRepo starsStars this weekTop rated 16 mods

findevil-mcp

01

TimothyVang/verdict-dfir

MCP server Claude CodeCodexCursor +2

One of 6 in .mcp.json

MCP server "findevil-mcp" as configured in TimothyVang/verdict-dfir. Launched with bash scripts/run-mcp-rust.sh.

not rated 12 1mo ago A tokens not measured original Apache-2.0

case-uco

02

vulnmaster/CASE-UCO-SDK

MCP server Cursor

MCP server "case-uco", hosted remotely at 127.0.0.1, as configured in vulnmaster/CASE-UCO-SDK.

not rated 9 2d ago A tokens not measured original Apache-2.0

mem-forensics-mcp

03

x746b/mem_forensics-mcp

MCP server Claude CodeCodexCursor +2

Unified Memory Forensics MCP Server - Multi-tier engine (Rust + Python + Vol3). Runs locally from the mem-forensics-mcp Python package.

not rated 6 18d ago A tokens not measured original MIT

savvydfir

04

kismatkunwar89/SAVVYDFIR-MCP

MCP server Claude CodeCodexCursor +2

MCP server "savvydfir" as configured in kismatkunwar89/SAVVYDFIR-MCP. Runs sift_mcp.server with ./venv/bin/python3. Needs 4 environment variables to run.

not rated 5 22d ago A tokens not measured original MIT

evidencegene

05

FUYOH666/evidencegene-court

MCP server Claude CodeCodexCursor +2

MCP server "evidencegene" as configured in FUYOH666/evidencegene-court. Runs locally from the evidencegene Python package.

not rated 1 4mo ago A tokens not measured original MIT

kali

06

Unaacceptable297/kali-mcp

MCP server Claude CodeCodexCursor +2

MCP server "kali" as configured in Unaacceptable297/kali-mcp. Runs dist/index.js with node.

not rated 1 5d ago A tokens not measured copy · 83% MIT

verdict-dfir

07

tejcodes-rex/verdict

MCP server Claude CodeCodexCursor +2

MCP server "verdict-dfir" as configured in tejcodes-rex/verdict. Runs locally from the verdict-dfir Python package.

not rated 0 4mo ago A tokens not measured original MIT

deepsift

08

ahammadshawki8/DeepSIFT

MCP server Claude CodeCodexCursor +2

MCP server "deepsift" as configured in ahammadshawki8/DeepSIFT. Runs mcp_server/server.py with python3. Needs 1 environment variable to run.

not rated 0 3mo ago A tokens not measured original MIT

dfir-pcap-mcp

10

Gentle-bae/dfir-pcap-mcp

MCP server Claude CodeCodexCursor +2

MCP server "dfir-pcap-mcp" as configured in Gentle-bae/dfir-pcap-mcp. Runs locally from the dfir-pcap-mcp Python package.

not rated 0 2mo ago A tokens not measured original MIT

threatintel-mcp

11

ChristianPresley/threatintel-mcp

MCP server Claude CodeCodexCursor +2

MCP server "threatintel-mcp" as configured in ChristianPresley/threatintel-mcp. Runs locally from the threatintel-mcp Python package.

not rated 0 22d ago A tokens not measured original MIT

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: