memscope-mcp
Connect to a process and read its PE signature
Section titled “Connect to a process and read its PE signature”- Install memscope-mcp.
- Configure VS Code with a fresh
MEMSCOPE_HOME. - Select a process by PID, attach, and read its first two bytes.
A loaded Windows executable normally starts with the PE DOS signature 4D 5A. Reading it confirms that Memscope can resolve the process’s main module and access its memory.
Memory tools and Lua automation
Section titled “Memory tools and Lua automation”Memscope provides processes, attach, modules, read, write, dump, chain, scan, scan_many, lua, and scripts. Use Lua to combine dependent operations, and add domain-specific helpers through opt-in plugins.
- Discover and inspect: enumerate processes, services, threads, modules, PEB data, and memory regions.
- Read and write: use typed values, bounded dumps, pointer chains, and optional verified write readback.
- Scan: run strict AOB, string, pointer, and keyed batch scans with bounded scopes and explicit status.
- Automate and capture: execute Lua, save scripts, call native target functions, and install inline hooks.
See the MCP tool reference for request and response schemas, the Lua reference for available functions, and the scanning reference for scan modes and status fields.
Execution and local data
Section titled “Execution and local data”Windows permissions apply to each selected process operation. Writes modify target memory. Lua/native calls and hooks execute or modify target behavior. Activated files under $MEMSCOPE_HOME/plugins/*.py load as Python when the server starts. Session logs, saved scripts, plugin files, and optional recordings persist under MEMSCOPE_HOME.
See permissions and local data, plugin overview, and the security model for details.