Valhuntir MCP
MCP platform for incident response: AI analyzes forensic artifacts and a human approves every finding with a signature.
- 150 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The installer runs with sudo, and the platform executes forensic tools over sensitive evidence.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/AppliedIR/sift-mcp/main/quickstart.sh -o /tmp/vhir-quickstart.sh && bash /tmp/vhir-quickstart.shThe Quick variant from the README for a SIFT workstation: core platform, no databases. The script lives in the sift-mcp repository.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The installer runs with sudo, and the platform executes forensic tools over sensitive evidence.
This is third-party code. Review the repository files before installing.
What it does
Valhuntir turns an incident response analyst into the manager of an AI agent team. The `sift-gateway` gateway connects MCP servers with forensic tools, knowledge bases and Windows baselines. Claude Code, Codex, LibreChat or Open WebUI act as the client. An investigation runs in steps: a case, evidence registration with hashes, parsing and indexing into OpenSearch, search and timeline building. The agent stages findings as drafts and the analyst approves or rejects each in the portal or the `vhir` CLI with their own signature; the report is built from approved findings.
Who it is for. DFIR and SOC analysts who triage digital artifacts and want faster analysis while keeping control and a decision ledger.
Good fit when
- After a compromise, Windows event logs must be indexed and traces found across hosts.
- A timeline from MFT, USN, Shimcache and Amcache is needed with provenance to the source.
- Every AI conclusion needs manual approval with an examiner's signature.
- Evidence is checked against baselines and threat intelligence without spending tokens on raw data.
Not a fit when
- You want autonomous hunting with no human; the README warns that a plain find-evil prompt yields hallucinations.
- The machine has under 16 GB RAM and no tens of gigabytes of space.
- The task is offensive operations rather than evidence analysis.
Example request
Create a case, register the disk image, index the EVTX logs, build a host timeline and stage findings as drafts for my approval.MCP
- Transport
- http, stdio
- Authentication
- API key
Limitations
The platform is new: the README requires verifying every result and guiding the investigation yourself. A basic install needs Python 3.10 or newer and sudo on a SIFT workstation, at least 16 GB RAM and about 50 GB of disk plus evidence space. OpenSearch mode needs 32 GB and Docker, and the recommended databases take about 14 GB. The installer is a `curl` piped to `bash`; read the script first. For memory analysis with Volatility 3 the README advises 24 GB.
How to disable. Stop the gateway and remove the MCP entries from client settings. Case data, signing keys and OpenSearch indices are stored separately; delete them by hand after archiving.
FAQ
Who approves the findings?
The analyst. The agent creates findings as drafts, and approval or rejection is signed with the examiner's key in the portal or the `vhir` CLI.
Which clients are supported?
Claude Code and Codex with Valhuntir controls, LibreChat and Open WebUI in MCP-only mode, and any Streamable HTTP client.
Is there a lighter option?
Yes, Valhuntir Lite: stdio MCP servers only, no gateway or OpenSearch, with 8 GB RAM enough. It installs through `quickstart-lite.sh`.
Why OpenSearch?
It indexes parsed artifacts so the model queries structured data instead of reading raw files, saving tokens at scale.
What does a client install on another machine do?
The `setup-client-linux.sh`, `setup-client-macos.sh` and `setup-client-windows.ps1` scripts connect a client to the SIFT gateway by address and code.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP memory server for agents plus a free gate that stops dangerous commands before they run
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
A malware analysis tool with an MCP server: the agent calls file, document and archive analysis, indicator extraction and signature checks
README in short
Investigation steps: case, evidence, indexing, analysis, findings, review and a report with MITRE mapping. Quick, Recommended and Lite modes exist.