Skip to main content
Glama
OLGTX303

sift-forensic-mcp

by OLGTX303
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to sift-forensic-mcp

No user-submitted related servers found.

    Related Servers

    • SIFTGuard

      sodiq-code
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables autonomous digital forensics and incident response by wrapping SIFT Workstation tools as MCP tools and orchestrating a multi-agent AI pipeline for evidence analysis and remediation planning.
      2
      MIT

    • findevil-agent

      povfarwa
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables autonomous digital forensics and incident response through 21 typed forensic tools covering disk, memory, registry, network, timeline, carving, and patterns, integrated with AI-driven reasoning and self-correction.
      MIT

    • VERDICT

      tejcodes-rex
      A
      license
      B
      quality
      D
      maintenance
      Enables autonomous DFIR investigation by turning the SIFT toolchain into evidence-safe MCP functions, with self-correction, corroboration, and traceable audit trails.
      34
      MIT

    • Forensics MCP Server

      Ghosthunter5599
      F
      license
      A
      quality
      C
      maintenance
      Enables AI agents to perform digital forensics and incident response tasks by dynamically discovering and utilizing host tools for memory analysis, metadata extraction, threat detection, and file dissection.
      5
      1
      -

    • Self-Assembling Forensic MCP

      Ghosthunter5599
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI assistants to perform digital forensics analysis including memory analysis, file metadata inspection, and threat-intelligence lookups.
      7 npm
      ISC

    • Sift MCP (Docker edition)

      Sidera-Labs
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables digital forensics investigation by exposing SANS SIFT tools (The Sleuth Kit, Volatility 3, Plaso, etc.) as callable MCP tools, running in a self-contained Docker container with safe, allowlisted commands.
      -
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.6/5.0

    Scored across 19 tools

    Disambiguation4/5

    Tools are largely distinct, but some overlap exists: parse_evtx and get_logon_events both deal with EVTX files, and check_known_malware_hashes and yara_scan both target malware detection. However, descriptions clarify different contexts.

    Naming Consistency4/5

    Most tools follow a consistent snake_case verb_noun pattern (e.g., mount_image, parse_evtx). The exception is yara_scan (noun_verb) which breaks the pattern slightly. Overall, naming is predictable.

    Tool Count5/5

    19 tools cover a comprehensive forensic workflow without being overwhelming. Each tool serves a clear purpose in the analysis pipeline, from evidence setup to unmounting.

    Completeness4/5

    The tool set covers the core forensic workflow: evidence setup, mounting, system info, user analysis, artifact extraction, timeline creation, and malware scanning. Missing some advanced features like file carving or deep file system recovery, but it's adequate for typical investigations.

    Maintenance

    ActivityInactive
    ResponsivenessNo issues

    Resources