Loading ToolBench
Forensic MCP Server for Windows incident investigation and triage, providing tools for analyzing disk images, registry hives, prefetch files, shellbags, LNK files, jump lists, MFT, Amcache, Shimcache, event logs, and other forensic artifacts
22 tools with highly variable quality. Most have descriptions (good), but schemas are inconsistent and many lack parameter type definitions. Tool naming follows verb_noun pattern (analyze_*, prepare_*, list_*, etc.) which is correct. However, parameter descriptions are often generic ('List of paths to analyze') without format constraints or validation guidance. Output schemas are undocumented, LLMs cannot predict return structure. Error handling is absent from visible code. Security concerns: no evidence of input sanitization or permission gates. STDIO transport caps protocol readiness at 50.
Windows Amcache Analysis: Process Windows Amcache.hve files for program execution analysis. Amcache is a CRITICAL artifact that provides UNIQUE SHA1 file hashes for every executable on the system. This enables definitive malware identification via hash database lookups.
Windows Event Logs Analysis: Analyze Windows Event Logs (.evtx files) for security events, system activity, and user actions. Event logs contain detailed records of system and application events.
Windows Jump Lists Analysis: Analyze Windows Jump Lists for recent file and program access history. Jump Lists are stored in AppData and contain metadata about recently accessed files and programs.
Windows LNK Files Analysis: Analyze Windows shortcut (.lnk) files for program execution evidence, file access history, and user activity. LNK files are created in Recent folders and contain metadata about accessed files.
NTFS Master File Table (MFT) Analysis: Analyze NTFS MFT for file system activity, file creation/modification/access timestamps, and deleted file recovery. MFT is the core NTFS file system structure containing metadata for all files.
Windows Prefetch Analysis: Analyze Windows Prefetch files (.pf) for program execution evidence, execution timestamps, and file access patterns. Prefetch files are created by Windows for every executable run and persist even after program deletion.
Output schemas completely undocumented. No tool documents what fields it returns, forcing LLMs to guess structure and plan downstream calls blindly.
Parameter descriptions lack format constraints and validation rules. E.g., 'paths' accepts array of strings but no guidance on valid formats, depth limits, or error cases. LLMs cannot self-validate input.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | <=2025-11-25 | v2 |
Windows Registry Analysis: Analyze Windows registry hives (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, USRCLASS.DAT) for forensic evidence including user activity, system configuration, installed software, network connections, and security settings. Available modules: registry_all (Runs all registry analysis modules including user activity, system configuration, installed software, network connections, and security settings)
Windows Shellbags Analysis: Analyze Windows Shellbags registry entries for folder access history, USB device connections, and user navigation patterns. Shellbags reveal which folders users accessed and when.
Windows Shimcache Analysis: Analyze Windows Shimcache (Application Compatibility Cache) for program execution evidence and file metadata. Shimcache is maintained by Windows for application compatibility and contains execution history.
Analyze SQLite database files for forensic evidence
Review audit log of KAPE operations
Browse and list files and folders in any directory (disk images, output directories, case folders)
Cleanup and release prepared forensic image
Decompress Mozilla LZ4 compressed files (.mozlz4, .jsonlz4) - Used for Firefox session restore data (open tabs), session backups, and search engine configs. Essential for analyzing browser session state and recovering user activity.
Get catalog of available KAPE parsing modules
Identify forensic artifact type and suggest appropriate tools
Parse forensic artifact using KAPE modules
List all currently prepared forensic images with metadata
Parse and analyze XML forensic evidence
Prepare forensic disk image for analysis (E01, DD, VMDK, VHD formats)
Read and analyze CSV data files from forensic images OR case output directories (exported SQLite queries, KAPE results, etc.). Supports chunked reading for large files. Use this to analyze exported data from previous operations.
Read text-based file contents with encoding support. Use this for ALL text files including: .txt (text files), .log (log files), .json (JSON data), .xml (XML data), .html/.htm (HTML files), .csv (comma-separated values), .ini/.conf (config files), .yaml/.yml (YAML files), .md (markdown), .sh/.bash (shell scripts), .py/.js/.c/.cpp (source code), and any other human-readable text format. Works with forensic images - extraction is automatic and transparent.
No error handling guidance visible in tool definitions. Tools like prepare_disk_image, cleanup_prepared_image lack recovery instructions. LLMs cannot determine if errors are retryable or fatal.
Destructive tool (cleanup_prepared_image) lacks confirmation/dry-run pattern. No evidence of permission gates or audit logging. Agents could accidentally delete forensic evidence.
Tool composition risk: analyze_* tools all accept 'paths' array but no guidance on batch limits or pagination. Large result sets could exhaust context window. No documented result limits.