MCP Observatory
6m ago Tracked 53,340 Last 6m ago 24h 2,739
github Python re-analysis due

calebevans/mulder

v1.4.1
github

Agentic DFIR

maintainer
calebevans
license
Apache-2.0
first seen
2026-06-06
last seen
2026-09-05
releases · 30d
5
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 135 tools
transport stdio · streamable-http counts 135 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • analyze_disk_pcaps
  • analyze_execution_timeline
  • analyze_office_document
  • analyze_pdf
  • assess_recovery
  • audit_evidence_coverage
  • audit_tool_coverage
  • carve_sqlite_from_raw
  • check_extraction_status
  • check_finalize_readiness
  • correlate_across_sources
  • correlate_pcap_with_host
  • decode_payload
  • decrypt_app_data
  • deduplicate_findings
  • delete_finding
  • detect_steganography
  • detect_timestomping
  • enrich_iocs
  • export_timeline_slice
  • extract_archive
  • extract_file_by_inode
  • extract_mft_timeline
  • extract_steganography
  • filter_timeline
  • finalize_report
  • find_data_exfiltration_indicators
  • find_defense_evasion
  • find_execution_evidence
  • find_file_staging
  • find_lateral_movement_indicators
  • find_persistence_mechanisms
  • find_suspicious_processes
  • get_amcache
  • get_bookmarks
  • get_carved_iocs
  • get_completed_results
  • get_deleted_files
  • get_eventlog_anomalies
  • get_file_metadata
  • get_fs_timeline
  • get_ioc_summary
  • get_plaso_stats
  • get_process_environment
  • get_process_privileges
  • get_process_tree
  • get_tool_guide
  • get_userassist
  • index_app_files
  • index_evtx_file
  • list_cases
  • list_directory
  • list_files
  • list_partitions
  • list_processes_from_memory
  • lookup_attack_technique
  • open_case
  • parse_android_artifacts
  • parse_autoruns
  • parse_browser_history
  • parse_ios_artifacts
  • parse_mft
  • parse_plist
  • parse_prefetch
  • parse_pst
  • parse_usn_journal
  • query_registry_value
  • query_sqlite_from_image
  • read_evidence_file
  • reconstruct_execution_chains
  • remove_bookmark
  • run_aleapp
  • run_amcache_parser
  • run_bdeinfo
  • run_binwalk
  • run_bulk_extractor
  • run_capa
  • run_chainsaw
  • run_chkrootkit
  • run_clamav
  • run_detect_it_easy
  • run_dislocker
  • run_evtx_parser
  • run_exiftool
  • run_floss
  • run_fls
  • run_foremost
  • run_fsstat
  • run_fvdeinfo
  • run_hashdeep
  • run_hayabusa
  • run_hindsight
  • run_ileapp
  • run_mactime
  • run_mft_parser
  • run_mmls
  • run_mvt_android
  • run_mvt_ios
  • run_parallel
  • run_pasco
  • run_pcap_analysis
  • run_photorec
  • run_plaso
  • run_prefetch_parser
  • run_radare2
  • run_registry_parser
  • run_regripper
  • run_scalpel
  • run_shimcache_parser
  • run_ssdeep
  • run_strings
  • run_suricata
  • run_tcpflow
  • run_tcpxtract
  • run_volatility
  • run_volatility_batch
  • run_vshadow_info
  • run_zeek_analysis
  • run_zircolite
  • scan_evidence
  • scan_files_in_memory
  • scan_hidden_processes
  • scan_kernel_modules
  • start_extraction_batch
  • submit_finding
  • submit_narrative
  • track_progress
  • triage_binary
  • update_finding
  • verify_evidence_integrity
  • wait
  • wait_all
  • yara_scan_files
  • yara_scan_memory
  • yara_scan_with_volatility
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit a2e297d · analyzer v33 · 1w ago

skills & prompt files 11

code evidence v1.4.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 140

filesystem 78

  • fs (weak) calebevans-mulder-a2e297d/scripts/extract_attack_tactics.py :29 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/assets/fetch.py :11 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/assets/install.py :17 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/assets/lockgen.py :18 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/assets/manifest.py :18 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/assets/paths.py :26 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/assets/state.py :16 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/audit.py :12 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/cli.py :7 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/db.py :14 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/extractors/classifier.py :8 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/extractors/disk.py :13 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/extractors/volatility.py :12 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/display.py :13 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/evidence.py :15 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/log_tailer.py :14 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/models.py :13 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/prompts/__init__.py :10 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/proxy.py :15 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/orchestrator/runner.py :16 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/report/ioc_export.py :14 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/report/navigator.py :13 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/report/renderer.py :12 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/app.py :14 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/extract_helpers.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/helpers.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/timeouts.py :33 with open("/proc/loadavg") as f:
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :17 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/attack.py :16 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :11 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :10 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/chainsaw.py :11 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :16 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/documents.py :12 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/email.py :11 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/app_files.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :8 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/disk_pcap.py :15 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/evtx.py :9 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :10 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/pcap.py :12 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/plaso.py :7 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/registry.py :10 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/registry_query.py :13 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :8 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/extract/volatility.py :10 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :20 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/hayabusa.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/hindsight.py :11 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/mvt.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :15 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/plaso.py :11 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :14 from pathlib import Path
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :13 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/yara.py :14 import shutil
  • fs calebevans-mulder-a2e297d/src/mulder/server/tools/zircolite.py :12 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/conftest.py :7 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_asset_messages.py :13 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_asset_paths.py :12 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_audit.py :7 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_binary_resolution.py :16 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_classifier.py :5 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_cli_fatal_errors.py :5 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_cli_workspace.py :12 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_correlator.py :5 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_db.py :5 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_disk_pcap.py :10 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_ez_tools.py :12 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_finalize_gates.py :10 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_interpreter_resolution.py :18 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_manifest_parity.py :12 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_model_config.py :6 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_ntuser_hive_discovery.py :10 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_orchestrator.py :7 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_registry_query.py :10 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_report.py :5 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_setup.py :20 from pathlib import Path
  • fs (weak) calebevans-mulder-a2e297d/tests/test_submit_finding.py :5 from pathlib import Path

shell / exec 33

  • shell calebevans-mulder-a2e297d/src/mulder/assets/install.py :18 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/extractors/disk.py :14 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/orchestrator/proxy.py :12 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/helpers.py :15 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :19 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :8 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :11 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/chainsaw.py :8 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/documents.py :9 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/email.py :8 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/app_files.py :15 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :9 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/disk_pcap.py :12 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/evtx.py :10 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :11 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/pcap.py :8 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/plaso.py :8 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/registry.py :7 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :9 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/extract/volatility.py :6 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/hayabusa.py :15 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/hindsight.py :12 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/mvt.py :15 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :17 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/plaso.py :12 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :14 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/yara.py :15 import subprocess
  • shell calebevans-mulder-a2e297d/src/mulder/server/tools/zircolite.py :8 import subprocess
  • shell (weak) calebevans-mulder-a2e297d/tests/test_binary_resolution.py :15 import subprocess
  • shell (weak) calebevans-mulder-a2e297d/tests/test_disk_pcap.py :160 from subprocess import TimeoutExpired
  • shell (weak) calebevans-mulder-a2e297d/tests/test_interpreter_resolution.py :16 import subprocess
  • shell (weak) calebevans-mulder-a2e297d/tests/test_setup.py :437 import subprocess
  • shell (weak) calebevans-mulder-a2e297d/tests/test_tsk.py :5 import subprocess

network 5

  • net (weak) calebevans-mulder-a2e297d/scripts/extract_attack_tactics.py :28 import urllib.request
  • net calebevans-mulder-a2e297d/src/mulder/assets/fetch.py :63 import httpx
  • net calebevans-mulder-a2e297d/src/mulder/orchestrator/proxy.py :104 import urllib.error
  • net calebevans-mulder-a2e297d/src/mulder/server/tools/enrichment.py :19 import httpx
  • net (weak) calebevans-mulder-a2e297d/tests/conftest.py :67 import socket

database 6

  • db calebevans-mulder-a2e297d/src/mulder/db.py :17 from sqlalchemy import (
  • db calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :18 import sqlite3
  • db calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :19 from sqlalchemy import select as sa_select
  • db calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :16 import sqlite3
  • db (weak) calebevans-mulder-a2e297d/tests/test_db.py :8 from sqlalchemy import text
  • db (weak) calebevans-mulder-a2e297d/tests/test_security.py :5 import sqlite3

tool registrations 135

  • run_parallel calebevans-mulder-a2e297d/src/mulder/server/app.py :571
  • parse_browser_history calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :161
  • parse_plist calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :265
  • query_sqlite_from_image calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :341
  • list_directory calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :438
  • read_evidence_file calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :528
  • detect_steganography calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :656
  • extract_steganography calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :831
  • detect_timestomping calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :1145
  • parse_autoruns calebevans-mulder-a2e297d/src/mulder/server/tools/artifacts.py :1383
  • lookup_attack_technique calebevans-mulder-a2e297d/src/mulder/server/tools/attack.py :166
  • triage_binary calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :669
  • run_capa calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :826
  • run_floss calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :966
  • run_detect_it_easy calebevans-mulder-a2e297d/src/mulder/server/tools/binary.py :1102
  • get_carved_iocs calebevans-mulder-a2e297d/src/mulder/server/tools/bulk.py :25
  • scan_evidence calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :34
  • list_cases calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :240
  • open_case calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :300
  • verify_evidence_integrity calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :359
  • extract_archive calebevans-mulder-a2e297d/src/mulder/server/tools/case.py :455
  • run_chainsaw calebevans-mulder-a2e297d/src/mulder/server/tools/chainsaw.py :416
  • find_execution_evidence calebevans-mulder-a2e297d/src/mulder/server/tools/composite/execution.py :189
  • analyze_execution_timeline calebevans-mulder-a2e297d/src/mulder/server/tools/composite/execution.py :269
  • find_data_exfiltration_indicators calebevans-mulder-a2e297d/src/mulder/server/tools/composite/exfil.py :265
  • find_file_staging calebevans-mulder-a2e297d/src/mulder/server/tools/composite/exfil.py :476
  • find_lateral_movement_indicators calebevans-mulder-a2e297d/src/mulder/server/tools/composite/lateral.py :299
  • find_defense_evasion calebevans-mulder-a2e297d/src/mulder/server/tools/composite/misc.py :615
  • reconstruct_execution_chains calebevans-mulder-a2e297d/src/mulder/server/tools/composite/misc.py :671
  • assess_recovery calebevans-mulder-a2e297d/src/mulder/server/tools/composite/misc.py :757
  • correlate_pcap_with_host calebevans-mulder-a2e297d/src/mulder/server/tools/composite/misc.py :805
  • find_persistence_mechanisms calebevans-mulder-a2e297d/src/mulder/server/tools/composite/persistence.py :252
  • find_suspicious_processes calebevans-mulder-a2e297d/src/mulder/server/tools/composite/process.py :371
  • correlate_across_sources calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :381
  • list_processes_from_memory calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :477
  • get_process_tree calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :496
  • get_eventlog_anomalies calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :514
  • extract_mft_timeline calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :546
  • parse_prefetch calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :570
  • get_amcache calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :588
  • scan_hidden_processes calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :605
  • get_process_environment calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :680
  • get_process_privileges calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :702
  • scan_kernel_modules calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :724
  • get_userassist calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :797
  • scan_files_in_memory calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :814
  • decode_payload calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :924
  • get_bookmarks calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :1303
  • remove_bookmark calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :1356
  • get_tool_guide calebevans-mulder-a2e297d/src/mulder/server/tools/core.py :1391
  • analyze_office_document calebevans-mulder-a2e297d/src/mulder/server/tools/documents.py :597
  • analyze_pdf calebevans-mulder-a2e297d/src/mulder/server/tools/documents.py :742
  • parse_pst calebevans-mulder-a2e297d/src/mulder/server/tools/email.py :261
  • enrich_iocs calebevans-mulder-a2e297d/src/mulder/server/tools/enrichment.py :513
  • index_app_files calebevans-mulder-a2e297d/src/mulder/server/tools/extract/app_files.py :208
  • run_bulk_extractor calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :250
  • run_foremost calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :390
  • run_scalpel calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :453
  • run_binwalk calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :527
  • run_photorec calebevans-mulder-a2e297d/src/mulder/server/tools/extract/carving.py :593
  • analyze_disk_pcaps calebevans-mulder-a2e297d/src/mulder/server/tools/extract/disk_pcap.py :312
  • run_evtx_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/evtx.py :276
  • index_evtx_file calebevans-mulder-a2e297d/src/mulder/server/tools/extract/evtx.py :469
  • run_prefetch_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :233
  • run_amcache_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :319
  • run_shimcache_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :402
  • run_mft_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :498
  • run_strings calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :605
  • run_clamav calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :629
  • run_hashdeep calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :668
  • run_exiftool calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :691
  • run_regripper calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :716
  • run_ssdeep calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :759
  • run_pasco calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :788
  • run_vshadow_info calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :811
  • run_chkrootkit calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :878
  • run_radare2 calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :941
  • run_tcpflow calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :1006
  • run_tcpxtract calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :1080
  • run_dislocker calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :1298
  • run_bdeinfo calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :1339
  • run_fvdeinfo calebevans-mulder-a2e297d/src/mulder/server/tools/extract/misc.py :1399
  • run_pcap_analysis calebevans-mulder-a2e297d/src/mulder/server/tools/extract/pcap.py :757
  • run_zeek_analysis calebevans-mulder-a2e297d/src/mulder/server/tools/extract/pcap.py :1083
  • run_suricata calebevans-mulder-a2e297d/src/mulder/server/tools/extract/pcap.py :1374
  • run_plaso calebevans-mulder-a2e297d/src/mulder/server/tools/extract/plaso.py :67
  • run_registry_parser calebevans-mulder-a2e297d/src/mulder/server/tools/extract/registry.py :419
  • query_registry_value calebevans-mulder-a2e297d/src/mulder/server/tools/extract/registry_query.py :161
  • run_mmls calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :507
  • run_fls calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :555
  • run_mactime calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :675
  • run_fsstat calebevans-mulder-a2e297d/src/mulder/server/tools/extract/tsk.py :737
  • run_volatility calebevans-mulder-a2e297d/src/mulder/server/tools/extract/volatility.py :209
  • run_volatility_batch calebevans-mulder-a2e297d/src/mulder/server/tools/extract/volatility.py :614
  • parse_mft calebevans-mulder-a2e297d/src/mulder/server/tools/eztools.py :157
  • parse_usn_journal calebevans-mulder-a2e297d/src/mulder/server/tools/eztools.py :181
  • submit_finding calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :177
  • update_finding calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :302
  • delete_finding calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :414
  • submit_narrative calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :459
  • finalize_report calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :546
  • deduplicate_findings calebevans-mulder-a2e297d/src/mulder/server/tools/findings.py :893
  • run_hayabusa calebevans-mulder-a2e297d/src/mulder/server/tools/hayabusa.py :164
  • run_hindsight calebevans-mulder-a2e297d/src/mulder/server/tools/hindsight.py :52
  • start_extraction_batch calebevans-mulder-a2e297d/src/mulder/server/tools/jobs.py :38
  • check_extraction_status calebevans-mulder-a2e297d/src/mulder/server/tools/jobs.py :180
  • get_completed_results calebevans-mulder-a2e297d/src/mulder/server/tools/jobs.py :254
  • wait_all calebevans-mulder-a2e297d/src/mulder/server/tools/jobs.py :354
  • wait calebevans-mulder-a2e297d/src/mulder/server/tools/jobs.py :466
  • run_mvt_android calebevans-mulder-a2e297d/src/mulder/server/tools/mvt.py :59
  • run_mvt_ios calebevans-mulder-a2e297d/src/mulder/server/tools/mvt.py :156
  • carve_sqlite_from_raw calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :99
  • parse_android_artifacts calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :297
  • parse_ios_artifacts calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :521
  • decrypt_app_data calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :736
  • run_aleapp calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :1078
  • run_ileapp calebevans-mulder-a2e297d/src/mulder/server/tools/phone.py :1235
  • get_plaso_stats calebevans-mulder-a2e297d/src/mulder/server/tools/plaso.py :104
  • filter_timeline calebevans-mulder-a2e297d/src/mulder/server/tools/plaso.py :122
  • export_timeline_slice calebevans-mulder-a2e297d/src/mulder/server/tools/plaso.py :211
  • audit_evidence_coverage calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :90
  • audit_tool_coverage calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :171
  • check_finalize_readiness calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :257
  • track_progress calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :303
  • get_ioc_summary calebevans-mulder-a2e297d/src/mulder/server/tools/review.py :447
  • list_partitions calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :222
  • list_files calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :239
  • get_deleted_files calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :304
  • get_fs_timeline calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :358
  • extract_file_by_inode calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :398
  • get_file_metadata calebevans-mulder-a2e297d/src/mulder/server/tools/tsk.py :536
  • yara_scan_files calebevans-mulder-a2e297d/src/mulder/server/tools/yara.py :596
  • yara_scan_memory calebevans-mulder-a2e297d/src/mulder/server/tools/yara.py :664
  • yara_scan_with_volatility calebevans-mulder-a2e297d/src/mulder/server/tools/yara.py :750
  • run_zircolite calebevans-mulder-a2e297d/src/mulder/server/tools/zircolite.py :250

declared dependencies 30

  • mcp@>=2.0
  • sqlalchemy@>=2.0
  • volatility3@>=2.0
  • detect-secrets@>=1.5
  • pydantic@>=2.12
  • click@>=8.3
  • jinja2@>=3.1.6
  • markdown@>=3.6
  • python-evtx@>=0.8.1
  • claude-agent-sdk@>=0.2
  • rich@>=15.0
  • pyyaml@>=6.0
  • psutil@>=5.9
  • httpx@>=0.27
  • oletools@>=0.60
  • python-registry@>=1.0
  • weasyprint@>=60.0
  • stix2@>=3.0
  • orjson@>=3.9.15
  • xxhash@>=3.0
  • colorama@>=0.4.4
  • tqdm@>=4.58.0
  • evtx@>=0.6.2
  • pytest@*
  • pytest-asyncio@*
  • pytest-cov@*
  • mypy@*
  • ruff@*
  • pre-commit@*
  • twine@*