A proof-of-concept MCP bridge that exposes Velociraptor's forensic triage tools to LLMs, enabling natural language querying of Windows endpoints for artifacts like network connections and suspicious processes.
Connects LLMs to BloodHound Enterprise for natural language attack path analysis, Cypher queries, and exploration of Active Directory, Azure/Entra ID, and OpenGraph environments.
Enables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.
Connects LLMs like Claude Desktop with Volatility3 forensics framework, enabling users to analyze memory dumps, detect malware, and perform memory forensics tasks through natural language conversation.