github Python analyzed 4c222be

ahammadshawki8/DeepSIFT

DeepSIFT - A zero-hallucination autonomous DFIR agent for the SANS SIFT Workstation. 148 typed, audited, guard-railed MCP forensic tools with per-claim grounding verification, 4-axis confidence scoring, and an HMAC-signable chain of custody. .

maintainer: ahammadshawki8
license: MIT
first seen: 2026-06-14
last seen: 2026-06-20
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 155 tools

transport stdio counts 155 tools · 0 res · 0 prompts permission surface via code analysis

tools

adversarial_review
analyze_email_headers
analyze_ole_doc
analyze_pdf_doc
analyze_rtf_doc
analyze_slack_space
analyze_vss_shadows
analyze_with_exiftool
analyze_zip_archive
calculate_file_hashes
calculate_fuzzy_hash_similarity
carve_files_foremost
carve_files_scalpel
check_tool_availability
correlate_artifacts
create_mac_timeline
create_super_timeline
decode_rdp_bitmap_cache
detect_ads_streams
detect_capabilities_capa
detect_contradictions
detect_dde_payload
detect_event_log_tampering
detect_log_wiping
detect_packer
detect_prefetch_anomalies
detect_secure_deletion
detect_timestomping
dump_process
evidence_store_stats
extract_dns_queries
extract_email_attachments
extract_file
extract_floss_strings
extract_pcap_files
extract_strings
filter_timeline
find_injected_code
finish_analysis
get_ads_memory
get_atoms
get_browser_history
get_cachedump
get_callbacks
get_clipboard
get_command_history
get_devicetree
get_driverirp
get_env_vars
get_file_listing
get_file_type
get_filescan
get_fs_statistics
get_getsids
get_handles
get_hashdump
get_image_info
get_investigation_state
get_ldrmodules
get_linux_bash_history
get_linux_envars
get_linux_malfind
get_linux_modules
get_linux_mounts
get_linux_network
get_linux_processes
get_linux_syscall
get_loaded_dlls
get_lsadump
get_mft_memory
get_modules
get_mutexes
get_network_connections
get_partition_table
get_pe_metadata
get_privileges
get_process_list
get_registry_hives
get_registry_key
get_running_services
get_sessions
get_ssdt
get_timeliner
get_vad_info
index_evidence
list_hayabusa_rules
list_yara_rule_sets
lookup_domain_reputation
lookup_hash_reputation
lookup_ip_reputation
parse_amcache
parse_apache_logs
parse_arp_cache
parse_bam_dam
parse_browser_cookies
parse_browser_passwords
parse_chrome_extensions
parse_chrome_history
parse_chromium_cache
parse_dropbox_logs
parse_eml_file
parse_event_logs
parse_firefox_history
parse_firewall_logs
parse_google_drive_logs
parse_hayabusa
parse_icloud_logs
parse_ie_edge_legacy_history
parse_iis_logs
parse_installed_software
parse_jump_lists
parse_linux_crontab
parse_lnk_files
parse_logon_history
parse_mft
parse_netflow
parse_network_history
parse_onedrive_logs
parse_open_save_mru
parse_pcap_summary
parse_prefetch
parse_pst_ost
parse_recentdocs
parse_recycle_bin
parse_registry_hive
parse_run_mru
parse_sam_hive
parse_shellbags
parse_shimcache
parse_slack_artifacts
parse_srum
parse_syslog
parse_teams_artifacts
parse_thunderbird
parse_typed_paths
parse_usb_history
parse_userassist
parse_usn_journal
parse_windows_timeline
parse_wordwheelquery
parse_zeek_logs
query_evidence
read_raw_block
record_hypothesis
run_bulk_extractor
run_hindsight
scan_file_with_yara
scan_hidden_processes
scan_memory_with_yara
search_deleted_files
search_ioc_database
search_mitre_technique
update_hypothesis
verify_findings
verify_image_integrity

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 4c222be · analyzer v33 · 4d ago

skills & prompt files 2

agent-rules ahammadshawki8-DeepSIFT-4c222be/AGENTS.md
agent-rules ahammadshawki8-DeepSIFT-4c222be/CLAUDE.md

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 87

filesystem 50

fs ahammadshawki8-DeepSIFT-4c222be/agents/orchestrator.py :11 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/agents/reasoning_agent.py :32 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/benchmark/compare.py :20 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/benchmark/reports/html_report.py :14 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/benchmark/scorer.py :5 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/benchmark/vigia_runner.py :38 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/demo.py :36 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/examiner_portal.py :40 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/examiner_review.py :26 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/investigate.py :28 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/audit.py :9 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/config.py :2 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/custody.py :22 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/evidence_store.py :17 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/parsers/grounding_verifier.py :15 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/preflight.py :18 import shutil
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :16 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :23 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :20 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/correlation.py :11 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :15 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :16 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :16 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/evidence_index.py :10 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_analysis.py :17 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :18 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/hayabusa.py :21 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :19 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/log2timeline.py :4 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_analysis.py :14 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :19 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :18 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :4 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :14 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :13 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :21 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :10 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/yara_tools.py :4 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/preflight.py :15 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/rag/ingest/case_history.py :5 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/rag/ingest/mitre_attack.py :6 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/rag/ingest/run_all.py :70 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/rag/ingest/threat_intel.py :6 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/rag/knowledge_base.py :13 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_evidence_store.py :36 with open(d / "MFT.csv", "w", newline="", encoding="utf-8") as f:
fs (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_examiner_portal.py :4 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_grounding_integrity.py :11 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_integration_rocba.py :9 from pathlib import Path
fs (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_reasoning_agent.py :5 from pathlib import Path
fs ahammadshawki8-DeepSIFT-4c222be/verify_findings.py :22 from pathlib import Path

shell / exec 23

shell ahammadshawki8-DeepSIFT-4c222be/agents/orchestrator.py :79 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/audit.py :58 registry `_run_ez`) before subprocess.run(). The primary control is that every tool
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :15 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :21 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :14 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :14 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :15 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_analysis.py :16 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :17 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/hayabusa.py :19 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :18 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/log2timeline.py :3 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_analysis.py :13 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :17 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :17 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :3 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :13 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :12 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :20 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :17 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :9 import subprocess
shell ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/yara_tools.py :3 import subprocess
shell (weak) ahammadshawki8-DeepSIFT-4c222be/tests/test_guardrails_bypass.py :90 guard_command(["python3", "-c", "import os; os.system('rm -rf /')", ";", "rm -rf /"])

network 4

net ahammadshawki8-DeepSIFT-4c222be/examiner_portal.py :503 from urllib.parse import urlparse, parse_qs
net ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :50 import urllib.request
net ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :848 import requests
net ahammadshawki8-DeepSIFT-4c222be/rag/ingest/mitre_attack.py :15 import requests

secrets 6

secrets ahammadshawki8-DeepSIFT-4c222be/agents/reasoning_agent.py :69 key = api_key or os.getenv("ANTHROPIC_API_KEY", "")
secrets ahammadshawki8-DeepSIFT-4c222be/examiner_review.py :22 import getpass
secrets ahammadshawki8-DeepSIFT-4c222be/mcp_server/audit.py :234 k = os.getenv("DEEPSIFT_AUDIT_KEY", "")
secrets ahammadshawki8-DeepSIFT-4c222be/mcp_server/config.py :32 ANTHROPIC_API_KEY = os.getenv("ANTHROPIC_API_KEY", "")
secrets ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :39 api_key = os.getenv("VT_API_KEY", "")
secrets ahammadshawki8-DeepSIFT-4c222be/rag/knowledge_base.py :47 key = os.getenv("OPENAI_API_KEY", "")

database 4

db ahammadshawki8-DeepSIFT-4c222be/agents/orchestrator.py :488 import sqlite3, shutil, tempfile
db ahammadshawki8-DeepSIFT-4c222be/mcp_server/evidence_store.py :16 import sqlite3
db ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :20 import sqlite3
db ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :18 import sqlite3

tool registrations 155

detect_timestomping ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :27
detect_log_wiping ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :120
detect_secure_deletion ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :204
detect_ads_streams ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :295
analyze_vss_shadows ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :368
detect_prefetch_anomalies ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :435
detect_event_log_tampering ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/anti_forensics.py :512
parse_chrome_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :160
parse_firefox_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :281
parse_chrome_extensions ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :371
parse_browser_cookies ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :443
run_hindsight ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :519
parse_browser_passwords ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :571
parse_ie_edge_legacy_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :635
parse_chromium_cache ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/browser_artifacts.py :706
parse_dropbox_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :43
parse_onedrive_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :128
parse_google_drive_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :198
parse_slack_artifacts ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :256
parse_teams_artifacts ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :320
parse_icloud_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/cloud_artifacts.py :401
correlate_artifacts ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/correlation.py :54
adversarial_review ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/correlation.py :250
detect_contradictions ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/correlation.py :449
get_fs_statistics ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :26
get_image_info ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :76
create_mac_timeline ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :133
read_raw_block ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :187
analyze_slack_space ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :256
verify_image_integrity ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/disk_extended.py :328
analyze_pdf_doc ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :30
analyze_ole_doc ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :118
analyze_rtf_doc ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :197
analyze_zip_archive ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :265
detect_dde_payload ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/document_analysis.py :343
parse_pst_ost ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :32
parse_thunderbird ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :108
parse_eml_file ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :174
extract_email_attachments ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :258
analyze_email_headers ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/email_artifacts.py :328
index_evidence ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/evidence_index.py :20
query_evidence ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/evidence_index.py :50
evidence_store_stats ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/evidence_index.py :72
get_pe_metadata ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_analysis.py :48
extract_strings ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_analysis.py :178
detect_packer ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_analysis.py :240
run_bulk_extractor ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :29
carve_files_foremost ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :96
carve_files_scalpel ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :154
analyze_with_exiftool ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :206
calculate_file_hashes ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :265
detect_capabilities_capa ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :312
extract_floss_strings ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :380
get_file_type ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/file_carving.py :456
parse_hayabusa ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/hayabusa.py :115
list_hayabusa_rules ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/hayabusa.py :205
record_hypothesis ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/investigation_state.py :57
update_hypothesis ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/investigation_state.py :103
get_investigation_state ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/investigation_state.py :151
get_linux_processes ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :45
get_linux_bash_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :105
get_linux_network ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :164
get_linux_modules ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :199
get_linux_syscall ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :236
get_linux_malfind ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :272
get_linux_envars ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :302
get_linux_mounts ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :343
parse_syslog ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :379
parse_linux_crontab ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/linux_forensics.py :460
create_super_timeline ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/log2timeline.py :30
filter_timeline ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/log2timeline.py :62
get_browser_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/log2timeline.py :114
parse_pcap_summary ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_analysis.py :38
extract_dns_queries ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_analysis.py :138
parse_arp_cache ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_analysis.py :227
parse_zeek_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :41
parse_iis_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :165
parse_apache_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :276
extract_pcap_files ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :365
parse_firewall_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :439
decode_rdp_bitmap_cache ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :534
parse_netflow ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/network_extended.py :589
parse_shellbags ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :93
parse_windows_timeline ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :173
parse_bam_dam ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :224
parse_typed_paths ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :285
parse_run_mru ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :326
parse_open_save_mru ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :376
parse_wordwheelquery ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :408
parse_installed_software ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :456
parse_sam_hive ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :503
parse_logon_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/registry_extended.py :539
get_partition_table ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :28
get_file_listing ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :54
extract_file ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :88
search_deleted_files ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/sleuthkit.py :126
check_tool_availability ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/system_health.py :11
lookup_hash_reputation ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :24
lookup_domain_reputation ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :97
search_mitre_technique ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :173
search_ioc_database ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :234
calculate_fuzzy_hash_similarity ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/threat_intel_extended.py :267
get_process_list ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :76
find_injected_code ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :127
get_network_connections ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :170
get_loaded_dlls ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :215
get_command_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :250
get_registry_hives ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :290
get_registry_key ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :314
get_handles ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :350
scan_hidden_processes ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :380
get_running_services ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :442
verify_findings ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :488
finish_analysis ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility.py :563
get_modules ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :44
get_driverirp ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :94
get_getsids ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :138
get_hashdump ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :189
get_lsadump ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :238
get_cachedump ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :283
get_clipboard ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :319
get_atoms ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :359
get_sessions ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :403
get_mft_memory ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :447
get_ads_memory ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :488
dump_process ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_advanced.py :520
get_privileges ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :58
get_mutexes ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :109
get_env_vars ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :157
get_vad_info ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :213
get_ldrmodules ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :268
get_ssdt ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :319
get_callbacks ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :368
get_filescan ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :418
get_timeliner ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :471
get_devicetree ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/volatility_extended.py :510
parse_event_logs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :283
parse_shimcache ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :359
parse_amcache ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :403
parse_prefetch ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :445
parse_mft ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :483
parse_lnk_files ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :543
parse_jump_lists ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :579
parse_registry_hive ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :601
parse_recycle_bin ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :640
parse_srum ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :679
parse_usn_journal ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :766
lookup_ip_reputation ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :838
parse_userassist ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :898
parse_recentdocs ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :957
parse_network_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :986
parse_usb_history ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/windows_artifacts.py :1016
scan_file_with_yara ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/yara_tools.py :36
scan_memory_with_yara ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/yara_tools.py :67
list_yara_rule_sets ahammadshawki8-DeepSIFT-4c222be/mcp_server/tools/yara_tools.py :98

declared dependencies 10

mcp@>=1.0.0
langgraph@>=0.2.0
chromadb@>=0.5.0
sentence-transformers@>=2.2.0
anthropic@>=0.25.0
langchain@>=0.2.0
langchain-anthropic@>=0.1.0
python-dotenv@>=1.0.0
pytest@>=7.0.0
requests@>=2.31.0