SIFT Sentinel wraps the SIFT Workstation's forensic tooling in a read-only MCP server and orchestrates a dual-agent loop (Analyst + Skeptic) where every investigative finding must carry artifact-level citations that independently re-verify. Safety is architectural, not prompt-based.
**A DFIR investigation architecture that minimizes hallucination and enforces traceable, reproducible findings through structural citation validation.** SIFT Sentinel wraps the SIFT Workstation's forensic tooling in a read-only MCP server and orchestrates a dual-agent loop (Analyst + Skeptic) where every investigative finding must carry artifact-level citations that independently re-verify. Safety is architectural, not prompt-based.