find-evil

Rome-1/find-evil

★ 0 stars Python AI/LLM Updated today

Grounded autonomous DFIR agent — SANS FIND EVIL! hackathon. Read-only forensic MCP server + finding-confirmation skeptic.

View on GitHub → Try with Claude — $10 free →

Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "find-evil": {
      "command": "uvx",
      "args": [
        "find-evil"
      ]
    }
  }
}

Or install with pip: pip install find-evil

README Excerpt

> SANS **FIND EVIL!** hackathon submission. An autonomous incident-response agent whose spine is **grounded finding-confirmation**: every finding is adjudicated against the exact tool output that supports it, and contradicted findings are re-investigated with a *different* tool before they can enter the report — all over an architecturally read-only forensic MCP surface.

find-evil

Quick Install

README Excerpt

Related AI/LLM Servers