Skip to content
Memscope

memscope-mcp

A focused MCP surface for read-first Windows process discovery, memory research, Lua automation, and opt-in domain plugins.
Get startedBrowse MCP toolsView source

Start with a bounded read

Section titled “Start with a bounded read”

Use a Windows x64 host, a 64-bit Python 3.10 or newer, an x64 target, and an MCP client with stdio support. Install the package from the source configured for your environment and configure the client to run memscope-mcp.

Terminal window
python -m pip install memscope-mcp
memscope-mcp paths

A first read-only session discovers a process, selects an exact PID, attaches, and checks the PE signature without writing or installing a hook:

processes(filter="notepad", limit=10)
attach(process_name="notepad.exe", pid=<selected_pid>)
modules(filter="notepad", limit=10)
local base = getModuleBase("notepad.exe")
if not base then
    error("notepad.exe module not found")
end
addResult("module_base", toHex(base))
addResult("dos_signature", readBytesHex(base, 2))

Continue with installation, client configuration, and the first-session guide.

Eleven tools, composed work

Section titled “Eleven tools, composed work”

The MCP surface is intentionally small: processes, attach, modules, read, write, dump, chain, scan, scan_many, lua, and scripts. Composed work belongs in Lua; domain-specific helpers belong in opt-in plugins.

  • Discover and inspect: enumerate processes, services, threads, modules, PEB data, and memory regions.
  • Read and write: use typed values, bounded dumps, pointer chains, and optional verified write readback.
  • Scan: run strict AOB, string, pointer, and keyed batch scans with bounded scopes and explicit status.
  • Automate and capture: execute Lua, save scripts, make native calls, and use inline hooks.

Read the generated MCP tool reference, Lua reference, and scanning reference for the current contracts.

Plugins stay opt-in

Section titled “Plugins stay opt-in”

Runtime activation scans only $MEMSCOPE_HOME/plugins/*.py as a nonrecursive, filename-sorted directory. The bundled catalog includes:

  • IL2CPP for Unity strings, arrays, lists, dictionaries, and thread-local native-call guidance.
  • Netcap for Winsock capture, stream analysis, framing, search, and durable recordings.

See Use plugins for activation, the plugin lifecycle for composition rules, and the security model for execution and data behavior.

Local data and support

Section titled “Local data and support”

MEMSCOPE_HOME defaults to ~/.memscope-mcp and contains logs, saved scripts, activated plugins, and optional recordings. Set it before startup to relocate these artifacts. Use the CLI and paths reference for exact locations.

For help, use troubleshooting, compatibility, and security support.

Section titled “Project links”