5 tagged dfir, measured the same way as everything else here.
Browse within: digital-forensics 5forensics 5
Hook Claude Code
Runs before the agent uses a tool for Write, Write, Edit and Read tool calls, executing guard-root-writes.py and guard-outside-project.py via python3 (2 commands). From TimothyVang/verdict-dfir.
Hook Claude Code
One of 5 in settings.json
Runs after a tool call finishes for mcp__savvydfir__mount_image, mcp__savvydfir__extract_mft_timeline, mcp__savvydfir__extract_usn_journal, mcp__savvydfir__summarize_evtx, mcp__savvydfir__extract_prefetch, mcp__savvydfir__get_amcache, mcp__savvydfir__extract_shimcache, mcp__savvydfir__extract_registry_run_keys…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: