Windows Forensics
Enables Windows digital forensics analysis by parsing EVTX event logs, registry hives, and remotely collecting artifacts via WinRM
A Windows digital forensics server that enables analysis of Windows artifacts including EVTX event logs and registry hives. Provides tools for parsing Security, System, and Sysmon logs with pre-built security event searches, analyzing SAM/SYSTEM/SOFTWARE registry hives for persistence mechanisms and user accounts, and remotely collecting artifacts via WinRM with password or pass-the-hash authentication. Designed for incident response workflows where analysts need to quickly extract and correlate forensic evidence from Windows systems.
Source
Repository: https://github.com/x746b/winforensics-mcp
Maintain Windows Forensics?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[Windows Forensics on getagentictools](https://getagentictools.com/mcp/x746b-winforensics-mcp?ref=badge) Related mcp
MySQL Provides secure MySQL database access for LLMs, enabling read/write operations with transaction support and security features for
Super Shell Enables secure execution of shell commands across Windows, macOS, and Linux with a three-tier whitelist security model for control
Toolkit (System Utilities) Provides system utilities and tools for network diagnostics, monitoring, cryptography, and QR code generation.
Code Runner Executes code snippets in isolated Docker containers with resource limits and security controls for safe testing and debugging acr
IPLocate Integrates with IPLocate.io API to provide IP address geolocation, network information, privacy detection, and abuse contact data
Kubernetes Audit Logs Provides unified access to Kubernetes audit logs across Alibaba Cloud SLS, AWS CloudWatch Logs, and Google Cloud Logging with tool