- Conduid
- Marketplace
- #dfir
MCP servers tagged dfir
50 live MCP servers tagged "dfir", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with dfir.
Sift MCP
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
Mem Forensics MCP
Unified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.
Mulder
Agentic DFIR
Huntkit
Investigation toolkit for Claude Code: case management, OSINT, structured analytic techniques, chain-of-custody evidence capture, and bundled threat-intel MCP servers.
AI Dfir Toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider t…
Sectinel
Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any…
Valhuntir
Valhuntir CLI — AI-augmented incident response platform
Winforensics MCP
A comprehensive MCP server for Windows digital forensics on KALI Linux
Maltego MCP
OSINT graphs are point-and-click busywork. maltego-mcp lets an LLM author the .mtgx and run the whois, DNS, ASN, and crt.sh lookups. Works on the Basic plan.
Malware Sandbox MCP
Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straig…
Vigia Intent Analysis
DFIR intentionality engine for SIFT. Verdicts sealed before any LLM sees the evidence. Detects fabricated artifacts and false flags — not just what happened, but who benefits f…
Verdict Dfir
VERDICT — a DFIR agent (Claude Code as the engine) that produces a signed, offline-verifiable verdict. SANS Find Evil! 2026.
Wintools MCP
Valhuntir Windows forensic tool execution via MCP
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Txgraph
Builds a transaction graph from ledger/account data and surfaces structuring, layering, and mule-network patterns for AML triage.
Agent Trace Witness
External witness for autonomous multi-agent AI systems: signed readiness seal, choke-point capture, and PROV-DM causal graphs for post-incident reconstruction
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Whisper Skills
Agent Skills for the WhisperGraph MCP connector — indicator investigation, bulk triage, Cypher query authoring, and brand-protection sweeps. Claude Code plugin, portable to any SK…
Verdict
Autonomous DFIR agent for SIFT - cited findings, audited actions, zero hallucinated evil.
LogPoseSIFT
An autonomous, multi-agent DFIR orchestrator. LogPose utilizes custom MCP boundaries to safely execute SIFT tools and synthesize breach data into actionable timelines at machine s…
Yararun
Run simple YARA-style string/regex rules over a directory
EDB FILE EXPLORER
Cross-platform GUI, CLI and MCP server for Microsoft ESE databases (ntds.dit, SRUDB.dat, Exchange .edb, WebCacheV01.dat, Windows.edb) - digital forensics tool with multi-format ex…
Memory Blackbox
Agent memory forensics — trace a bad agent action back to the exact poisoned memory, see the blast radius, roll it back
Otx
MCP server for AlienVault OTX / LevelBlue Open Threat Exchange — complete DirectConnect API coverage (29 tools), stdio + streamable HTTP transports, read-only by default. Built on…
Dfireballz
AI-native digital forensics & cybercrime investigation platform. 7 MCP servers (Volatility3, Ghidra, Wireshark, OSINT, threat-intel & more) orchestrated by Claude, ChatGPT, or Oll…
ProcWitness
Passive process forensics for Windows, Linux and macOS. Records process behavior locally and produces an AI-ready evidence bundle.
Dfir MCP Server
MCP server exposing 98 DFIR & threat intelligence tools for AI agents — IOC checking, CVE lookup, threat actor enrichment, phishing analysis, and more. Built on Cloudflare Workers.
Phishforge
Open-source phishing simulation — campaigns, templates, training
Mftparse
Analyze an NTFS $MFT CSV for timestomping and suspicious file activity
Ssltriage
Grade TLS config (protocols/ciphers/expiry) from openssl/sslyze output
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
SAVVYDFIR MCP
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a determinis…
Evidencegene Court
Adversarial autonomous DFIR: Prosecutor/Defender/Arbiter AI court over a typed read-only MCP server. Findings without real evidence refs are structurally rejected. SANS FIND EVIL!…
Cyber Incident Investigation And Triage MCP Server
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount…
AI Agent Audit
Offline Windows endpoint scanner for AI coding agent security posture (Claude Code, Cursor, Codex, Copilot, Grok)
Glaive
Graph-Linked Adversarial Investigation & Verification Engine autonomous DFIR with architectural hallucination resistance.
Anubis
An MCP server that gives your AI assistant the ability to triage malware. Static analysis, YARA, VirusTotal — all local. (beta)
CASE UCO SDK
Multi-language SDK (Python, C#, Java, Rust) for building validated CASE/UCO JSON-LD graphs for digital forensics and cyber-investigation. AI-agent ready with MCP server. Support f…
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Memtriage
Triage memory-dump artifacts: strings, IOCs, suspicious processes from a dump export
Gti Lookup
Threat context from Google Threat Intelligence (GTI Standard feature set) - CLI + local MCP server
FindEvil CyberSecurity
🏆 Hackathon — AI-powered threat detection & malicious pattern recognition tool for cybersecurity analysis
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Trackblock
Family phone stalkerware audit — MVT-class iOS/Android forensics
Governed Agentic Security Operations
Enterprise reference architecture for governed Agentic SOC, MSSP, MDR, Cloud IR, and private/local LLM-assisted DFIR operations.
Edrgap
EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories
Neo Finds Evil
Read-only Neo4j graph-correlation layer extending Protocol SIFT for AI-driven DFIR — cross-host, cross-time evidence correlation exposed to a Claude Code agent via architecturally…
Prefetchparse
Surface program-execution evidence from Windows Prefetch exports
OpenProcessGuard MCP
Read-only Windows process-forensics MCP server for Claude Desktop — 17 tools across 6 hunt stages, cosign-signed releases + SBOM, zero telemetry.
Pranith Jain.github.io
No description published.