"author:RemiKG" matching MCP servers:

An autonomous DFIR agent that hunts timestomping and rename/move laundering on the SANS SIFT Workstation, driven by Claude Code, with a read-only architecture and self-correcting triage loop using the USN change journal.