Skip to main content
Glama
guyoverclocked

Forensic Artifact Investigator MCP Server

extract-metadata

Read-onlyIdempotent

Extract embedded metadata, detect MIME/extension mismatches, and compute SHA-256 hash from forensic evidence files to verify authenticity and origin.

Instructions

Extract metadata from a forensic evidence file. Runs the real file --brief --mime-type command to detect the actual MIME type, compares it against the file extension using a bundled magic-byte signature database to detect MIME/extension discrepancies, runs ExifTool to extract embedded metadata (camera, GPS, timestamps, dimensions), and computes a streaming SHA-256 hash of the file. Use this tool for metadata extraction, MIME-disguise checks, and file hashing. All results come from actual command execution against the file bytes — no fixtures or mocks.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
filePathYesAbsolute or relative path to the evidence file within the evidence root (e.g. /evidence/suspect_photo.jpg)
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds valuable context: it runs real commands (file, ExifTool), uses a streaming SHA-256 hash, and states results come from actual file bytes without fixtures or mocks, which explains performance and trustworthiness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but efficient; each sentence contributes specific information about the tool's operations. It front-loads the core purpose and then explains the methods. It is slightly longer than necessary but not verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description thoroughly covers what the tool does but fails to describe the output format or return value, which is critical given there is no output schema. The lack of return-value information leaves a gap in fully understanding the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters with a clear description for filePath, and the tool description provides an example path. Since schema coverage is complete, the description adds little beyond the schema, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts metadata from forensic evidence files and enumerates specific operations: MIME type detection, extension comparison, ExifTool metadata extraction, and SHA-256 hashing. It explicitly lists the use cases (metadata extraction, MIME-disguise checks, file hashing), making it distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this tool for metadata extraction, MIME-disguise checks, and file hashing,' providing clear when-to-use guidance. However, it does not mention when not to use the tool or alternative tools, though the sibling names suggest contextual boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/guyoverclocked/forensic-artifact-investigator'

If you have feedback or need assistance with the MCP directory API, please join our Discord server