memscope MCP server
Commit Nov 1, 2026Enables low-level Windows x64 process memory research, including typed memory access, AOB scanning, inline hooking, and Lua automation.
Also known as Boti-Ormandi/memscope-mcp
- Stars
- 4
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Nov 1, 2026
- License
- MIT
What is memscope MCP?
memscope enables low-level Windows x64 process memory research, including typed memory access, AOB scanning, inline hooking, and Lua automation.
Summary generated from the project's README
About memscope MCP server
Reverse engineering and live-process research on Windows x64 systems becomes more direct through memscope-mcp. This server provides an eleven-tool interface that allows researchers to discover processes, attach to them, and perform typed memory access. It operates via stdio and uses the Windows permissions granted to its host process, meaning any memory writes performed will modify the target application.
Users can perform complex tasks like Array of Bytes scanning, installing inline hooks, and executing Lua automation to call native target functions. The system supports saved scripts and session logs that persist under the MEMSCOPE_HOME directory. For extended functionality, developers can use opt-in Python plugins that load at server startup. This setup is designed for local execution on Windows to facilitate deep inspection of running software.
What you can do with it
- 1Automating memory research with LuaYou can instruct an AI client to write and run Lua scripts that call native functions within a target process.
- 2Scanning for specific byte patternsA developer can ask the AI to locate specific code sequences using Array of Bytes scanning.
- 3Modifying live process behaviorYou can use the server to install inline hooks that intercept or redirect execution flow.
- 4Extending functionality with PythonDevelopers can add custom capabilities to the server by using Python plugins.
Written from the project's README. Every use case is checked against a quote from it.
README
View on GitHubmemscope-mcp
memscope-mcp is a Windows x64 process-memory MCP server for reverse engineering and live-process research. It exposes an 11-tool stdio surface over process discovery, attachment, typed memory access, scanning, Lua automation, saved scripts, inline hooks, and opt-in Python plugins.
The documentation is available at memscope.esrc.dev. Start with:
- Install memscope-mcp
- Configure VS Code on Windows
- Perform the first read
- Browse the generated MCP tool reference
The server uses the Windows permissions granted to its process. Writes modify target memory. Lua can call native target functions and install hooks. Activated plugins load as Python at server startup. Session logs, saved scripts, and optional recordings persist under MEMSCOPE_HOME.
Repository files
- Contributing — development setup, tests, documentation maintenance, and release checks.
- Security policy — intended selected-target behavior and private reporting for unintended defects.
- Documentation site — Astro/Starlight content, build instructions, and the generated MCP tool reference.
- Documentation URL map — site URLs and their Markdown source files.
- Architecture — system overview.
- Inline-hooking notes and PEB notes — repository implementation material.
- Release history — version-specific GitHub Releases.
Project links
memscope MCP questions
What capabilities does memscope-mcp provide for process research?
It provides an 11-tool surface covering process discovery, attachment, typed memory access, scanning, Lua automation, and inline hooks.
How does the server handle memory modifications?
The server operates using the Windows permissions granted to its process, and writes will modify the target memory.
Where are session logs and scripts stored?
Session logs, saved scripts, and optional recordings are persisted under the MEMSCOPE_HOME directory.