Loading…
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a deterministic evidence-provenance gate, and produces auditable, hash-chained investigation reports.
SAVVYDFIR-MCP is an MCP server entry in ChatHome Skills, sourced from GitHub MCP Search and scored 26/100. AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, en. As a Model Context Protocol server, it exposes tools that MCP-compatible LLM clients such as Claude, Cursor, and Copilot can call directly, extending an agent's reach beyond its built-in capabilities. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding SAVVYDFIR-MCP to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.
git clone https://github.com/kismatkunwar89/SAVVYDFIR-MCP.gitReview the upstream source before running this command.
Downloads a script and pipes it straight into a shell, executing remote code with no review.
curl`, `jq`.
3. **Install Volatility 3** via `pipx install volatility3` (creates `vol` on PATH).
4. **Install Chainsaw**Dispute this flag?Executes inline Python code, which can hide malicious behavior in a compact payload.
python -c "Dispute this flag?Scan coverage: Install metadata and repository README.
Automated signals from install metadata and a bounded skill body — not a full code security audit and not a recursive source or dependency review.
{
"fullName": "kismatkunwar89/SAVVYDFIR-MCP"
}AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a deterministic evidence-provenance gate, and produces auditable, hash-chained investigation reports.