Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@sift-forensic-mcp investigate the VANKO disk image"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Autonomous incident response agent that mounts a 119 GB forensic disk image, hunts malware and anti-forensics through 18 MCP tools on a SIFT Workstation VM, and writes a courtroom-ready report — with no human in the loop.
Demo video: https://youtu.be/ySjuSR9AP3Q
License: MIT
Architecture pattern: Custom MCP Server
The agent receives a single prompt ("investigate the VANKO disk image") and autonomously:
Mounts the EWF forensic image read-only via ewfmount + ntfs-3g
Enumerates users, recent files, and installed software
Scans for suspicious executables in %TEMP%, %AppData%, and Downloads
Parses the Windows registry for persistence mechanisms
Extracts and correlates Windows Event Log logon events
Runs YARA malware signatures across the image
Identifies Prefetch artifacts proving anti-forensic tool execution
Produces findings/findings_report.json with confidence-scored IOCs
On the VANKO case it found 8 confirmed findings including WiFi packet capture, evidence destruction (SDelete), an encrypted volume (VeraCrypt FORMAT confirmed), a typosquatted RAT, and identified the subject as anthony.vanko@gmail.com.
Related MCP server: SIFTGuard
┌──────────────────────────────────────────────────────────┐
│ Windows Host (analyst workstation) │
│ │
│ orchestrator.py ←→ gpt-5.4-mini (OpenAI-compat API) │
│ │ │
│ sift-forensic-mcp (18 MCP tools, stdio transport) │
│ │ asyncssh (TCP 22) │
└────────┼─────────────────────────────────────────────────┘
│
┌────────▼─────────────────────────────────────────────────┐
│ SIFT Workstation 2026 VM (Ubuntu 22.04, VMware NAT) │
│ │
│ /cases/VANKO/surface_physical.E01 │
│ ewfmount → /mnt/ewf/ewf1 │
│ kpartx → /dev/mapper/loop0p3 │
│ ntfs-3g → /mnt/windows/ (READ-ONLY) │
│ │
│ SIFT tools: ewfmount, log2timeline, yara, │
│ regripper, python-evtx, strings, file │
└──────────────────────────────────────────────────────────┘See docs/architecture.md for the full tool inventory and security boundary breakdown.
Windows 10/11 host with VMware Workstation Pro 17+
Python 3.10+
OpenAI-compatible API key (or set OPENAI_BASE_URL to a local endpoint)
~150 GB free disk space (119 GB evidence + SIFT VM)
8 GB+ RAM (16 GB recommended)
git clone https://github.com/OLGTX303/find-evil-sift-agent
cd find-evil-sift-agent
pip install -e .$ovftool = "C:\Program Files (x86)\VMware\VMware Workstation\OVFTool\ovftool.exe"
& $ovftool --acceptAllEulas --name="SIFT-2026" sift-2026-04-22.ova F:\SIFT-VM\find\VANKO\surface_physical.E01 (through .E21)
find\VANKO\vanko-c-drive.CYLR.7zpython setup_sift_vm.py
# Starts the VM, enables SSH, copies evidence — prints the VM IP at the end$env:OPENAI_API_KEY = "sk-..."
$env:OPENAI_BASE_URL = "https://api.openai.com/v1" # or your endpoint
$env:SIFT_HOST = "192.168.x.x" # from setup_sift_vm.py
$env:SIFT_PORT = "22"
$env:SIFT_USER = "sansforensics"
$env:SIFT_PASS = "forensics"
$env:EVIDENCE_DIR = "/cases/VANKO"python orchestrator.py --output-dir ./findingsThe agent prints reasoning and tool calls to stderr in real time.
Investigation takes 15–30 minutes (log2timeline on 119 GB runs in background).
# Structured findings report
cat findings/findings_report.json
# Full timestamped audit trail
cat findings/agent_execution_log.jsonl# Register the MCP server in Claude Code
claude mcp add sift-forensic \
-e SIFT_HOST=192.168.x.x \
-e SIFT_PORT=22 \
-e SIFT_USER=sansforensics \
-e SIFT_PASS=forensics \
-- sift-mcp
# Then in Claude Code:
# "Mount the VANKO image and find evil"sift-agent/
├── orchestrator.py ← Autonomous IR agent (gpt-5.4-mini)
├── setup_sift_vm.py ← One-time VM setup
├── pyproject.toml
├── LICENSE ← MIT
├── src/sift_mcp/
│ ├── server.py ← MCP server (stdio transport)
│ ├── tools.py ← 18 forensic tool implementations
│ └── ssh_client.py ← asyncssh helper with sudo support
├── findings/
│ ├── findings_report.json ← Structured IOC report
│ └── agent_execution_log.jsonl ← Full timestamped audit trail
├── demo/
│ ├── demo_find_evil.mp4 ← Narrated demo video (local copy)
│ ├── mcp_session.json ← Real captured tool output
│ └── cover_3x2.png ← Devpost thumbnail (1200×800)
└── docs/
├── architecture.md ← Component diagram + security boundaries
├── accuracy_report.md ← Finding accuracy + false positive analysis
├── dataset.md ← Evidence dataset documentation
└── try-it-out.md ← Judges guideDocument | Contents |
Component diagram, tool inventory, security boundaries, guardrails | |
8 findings vs ground truth, false positives, evidence integrity | |
VANKO case dataset, provenance, integrity hashes | |
Step-by-step judges guide with troubleshooting |
MIT — see LICENSE.
Check hashes against local NSRL/malware hash database.
Inputs: hashes (required).
Read strings from a file on the mounted image (first 4KB).
Inputs: remote_path (required).
Extract prefetch files, hosts file, browser history paths.
Inputs: no named parameters.
Find executables in anomalous locations: Temp dirs, user AppData, ProgramData.
Inputs: no named parameters.
Extract logon/logoff events (4624, 4625, 4634) from Security.evtx.
Inputs: top_n.
Extract Run/RunOnce autostart registry keys from all user hives.
Inputs: no named parameters.
Extract OS version, hostname, timezone from the mounted image.
Inputs: no named parameters.
Check if log2timeline is running; return last log lines.
Inputs: no named parameters.
Compute MD5 and SHA256 hash of a file on the mounted image.
Inputs: remote_path (required).
List recently accessed files (LNK files) for a user.
Inputs: username, count.
List Windows user accounts discovered in the image.
Inputs: no named parameters.
Mount the E01 forensic image using ewfmount + kpartx. Required before any file-system analysis.
Inputs: image_path.
Parse a Windows EVTX event log file.
Inputs: evtx_path (required), event_ids, top_n.
Parse a Windows registry hive. Optionally navigate to a specific key.
Inputs: hive_path (required), key_path.
Start log2timeline timeline creation (long-running). Poll with get_timeline_status.
Inputs: output_file, partition.
Query the plaso timeline. Returns events sorted by time.
Inputs: filter_query, top_n.
Copy evidence to SIFT VM and verify. Call this first.
Inputs: no named parameters.
Unmount the forensic image cleanly after analysis.
Inputs: no named parameters.
Run YARA malware detection rules against a path in the mounted image.
Inputs: scan_path, rules_dir.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 19 tools
Tools are largely distinct, but some overlap exists: parse_evtx and get_logon_events both deal with EVTX files, and check_known_malware_hashes and yara_scan both target malware detection. However, descriptions clarify different contexts.
Most tools follow a consistent snake_case verb_noun pattern (e.g., mount_image, parse_evtx). The exception is yara_scan (noun_verb) which breaks the pattern slightly. Overall, naming is predictable.
19 tools cover a comprehensive forensic workflow without being overwhelming. Each tool serves a clear purpose in the analysis pipeline, from evidence setup to unmounting.
The tool set covers the core forensic workflow: evidence setup, mounting, system info, user analysis, artifact extraction, timeline creation, and malware scanning. Missing some advanced features like file carving or deep file system recovery, but it's adequate for typical investigations.
PDF, photo, email, and file comparison evidence checks with plain-language reports.
Signed sandbox verdicts on any artifact, plus an agent marketplace. No key, no signup, no payment.
Independent AI-agent reviews: trust checks, evidence scorecards, incident registry, recommendations.
Machine-native utility network: verified evidence services for autonomous agents.
