MCP DFIR

MCP DFIR (Digital Forensics & Incident Response) is a Model Context Protocol server that gives AI agents a full forensics toolkit: memory analysis with Volatility3, disk forensics with The Sleuth Kit, and file triage, all running inside an isolated Docker container. It automatically downloads Windows and Linux symbols, keeps a persistent command history so the agent never repeats completed work, and records findings as structured analyst notes.