AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a deterministic evidence-provenance gate, and produces auditable, hash-chained investigation reports.
Latest release v1.1.1 — SAVVYDFIR-MCP v1.1.1 — FindEvil Submission · 6 Jun 2026
These files are kismatkunwar89/SAVVYDFIR-MCP's own configuration. They tell Claude Code and Cursor how to work on this repository, so they are not mods to install elsewhere. Copy one as a starting point and replace the parts that are about this project.
CLAUDE.md A 10,844 tok .cursorrules A 422 tok .claude/settings.json A — .claude/settings.json A — .claude/settings.json A — .claude/settings.json A — .claude/settings.json A — .claude/skills/artifact-routing/SKILL.md A 39 tok .claude/skills/investigation-workflow/SKILL.md A 84 tok .claude/skills/pivot-methodology/SKILL.md A 37 tok .claude/skills/sigma-detection/SKILL.md A 43 tok .claude/skills/tools-reference/SKILL.md A 49 tok .claude/agents/amcache-analyst.md A 67 tok .claude/agents/browser-analyst.md C 94 tok .claude/agents/corroboration-analyst.md A 75 tok .claude/agents/evtx-analyst.md A 84 tok .claude/agents/json-repair.md A 48 tok .claude/agents/memory-analyst.md A 83 tok .claude/agents/mft-analyst.md A 58 tok .claude/agents/prefetch-analyst.md A 72 tok .claude/agents/registry-analyst.md A 70 tok .claude/agents/sigma-analyst.md A 72 tok .claude/agents/srum-analyst.md A 87 tok .claude/agents/synthesis-analyst.md A 90 tok .claude/agents/timeline-analyst.md A 56 tok