ai-dfir-toolkit

A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.

{
  "mcpServers": {
    "ai-dfir-toolkit": {
      "command": "uvx",
      "args": [
        "ai-dfir-toolkit"
      ]
    }
  }
}

claude mcp add ai-dfir-toolkit uvx ai-dfir-toolkit

{
  "mcpServers": {
    "ai-dfir-toolkit": {
      "command": "uvx",
      "args": [
        "ai-dfir-toolkit"
      ]
    }
  }
}