Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
This repository also configures its own agents. See what sift-mcp tells them →
Skill Claude CodeCodex
Use before calling recordfinding on forensic-mcp, to challenge a drafted forensic finding. An isolated skeptic re-runs the cited tools and tries to refute the observation and interpretation; the investigator then records the finding as it stands, revised, or withdrawn.
Skill Claude CodeCodex
How to start an investigation once the evidence is surveyed: which tools to run first, ingesting evidence into OpenSearch (triage packages, memory, delimited files) and querying it. Use after the evidence survey, before analysis, or when ingesting or querying indexed evidence.
Skill Claude CodeCodex
When and how to send a suspicious file to REMnux for malware analysis, by what the other tools found (signatures, autoruns, prefetch, entropy, injection, YARA, network). Use when a file, process or binary looks suspicious.
Skill Claude CodeCodex
Investigation playbooks: step-by-step procedures, each with its triggers, phases and MITRE techniques. Use when an investigation needs one of: Credential Access Investigation; Data Staging Investigation; DNS Anomaly Investigation; Email Compromise Investigation; Log Tampering Investigation; Malware Analysis…
Skill Claude CodeCodex
Writing the investigation report with report-mcp: the report profiles, case metadata, the writing guidance to follow and saving the report. Use once findings are approved and a report is wanted.
Skill Claude CodeCodex
Which Valhuntir MCP tool or SIFT tool to use for a question, file, IOC or artifact, and the step-by-step workflows that combine them (IOC investigation, threat actor research, detection engineering, malware analysis, disk, memory, timeline and network). Use when choosing tools or planning a multi-step analysis.
Skill Claude CodeCodex
Post-install verification and onboarding for Valhuntir: checks the gateway, backends, tools, knowledge base, report profiles and this client's controls, then explains how to work and how to start a case. Use right after installing, or when asked to verify the installation.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: