Enables digital forensics investigation by exposing SANS SIFT tools (The Sleuth Kit, Volatility 3, Plaso, etc.) as callable MCP tools, running in a self-contained Docker container with safe, allowlist…
| Tool name | Description | Destructive? |
|---|---|---|
| sift_list_evidence | ✓ no | |
| sift_server_info | ✓ no | |
| sift_disk_partitions | ✓ no | |
| sift_image_info | ✓ no | |
| sift_filesystem_info | ✓ no |
| sift_list_files | ✓ no | |
| sift_extract_file | ✓ no | |
| sift_carve_files | ✓ no | |
| sift_file_type | ✓ no | |
| sift_hash_file | ✓ no | |
| sift_volatility | ✓ no | |
| sift_create_timeline | ✓ no | |
| sift_export_timeline | ✓ no | |
| sift_parse_evtx | ✓ no | |
| sift_exiftool | ✓ no | |
| sift_strings | ✓ no | |
| sift_binwalk | ✓ no | |
| sift_hexdump | ✓ no | |
| sift_yara_scan | ✓ no |