---
title: Volexity wires an MCP server into its Volcano memory-forensics tool and has Codex triage a Chrome zero-day sample | ctxsec
url: https://ctxsec.com/items/volexity-volcano-mcp-dfir
description: ""
status: "vendor writeup (product demo)"
published: 2026-10-16
---

> 

[← AI](/ai) · [markdown](/items/volexity-volcano-mcp-dfir.md)

vendor writeup (product demo)

2026-10-16

### Volexity wires an MCP server into its Volcano memory-forensics tool and has Codex triage a Chrome zero-day sample

Part 3 of Volexity's 'Mind the (Patch) Gap' series (Oct 16) shows analysts using OpenAI's Codex client with GPT-6.1-Sol, connected to Volcano's new MCP server, to confirm IOC hits tied to the September Chrome/Windows zero-day chain, label UTA0560 and GRIMWEDGE artifacts, write query, string and YARA IOCs (including JungleBamboo), and schedule targeted collections on endpoints. Re-running the IOCs turned up GRIMWEDGE-encoded JavaScript in free memory, which Volexity says EDR can't see. It's a vendor product demo, and Volexity notes results vary with model strength. The takeaway for defenders is that agent-driven DFIR is moving into commercial tools, so give a forensics MCP server the same scoping and audit trail as any privileged agent tool.

Sources: [Volexity: Mind the (Patch) Gap, Part 3](https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/) · [Volexity IOCs (GitHub)](https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome)