Sift MCP, developed by Sift MCP as part of the Valhuntir platform, is a Model Context Protocol (MCP) server built with Python 3.10+. It connects Large Language Models (LLMs) to the SANS SIFT digital-forensics toolkit, exposing its capabilities as callable tools. Operating as a stdio subprocess of the sift-gateway, Sift MCP aggregates these backends behind a single HTTP endpoint. It is categorized as an MCP server for digital forensics and incident response, designed to bridge AI capabilities with structured forensic analysis. A Docker edition is also available, offering a self-contained distribution.

What does Sift MCP connect to?

Sift MCP is an MCP server that links to and exposes the SANS SIFT digital-forensics toolkit as callable tools for LLMs. It functions as a stdio subprocess of the sift-gateway, which consolidates these backends behind one HTTP endpoint. Optionally, Sift MCP can connect to a local or remote OpenSearch instance for evidence indexing and querying through opensearch-mcp. Its primary role is to serve as an MCP server for digital forensics and incident response, enabling AI interaction with established forensic capabilities.

Core features and tools

Sift MCP exposes five callable tools, wrapping standard DFIR command-line programs. These include The Sleuth Kit, Volatility 3, Plaso, exiftool, and YARA. It supports Streamable HTTP transport with Bearer token authentication, making it compatible with AI clients such as Claude Code, Claude Desktop, Cherry Studio, self-hosted LibreChat, and Ollama Desktop. This allows for diverse client integration with its core digital forensics capabilities.

Who is it for?

Sift MCP is intended for forensic investigators, incident responders, and teams working with high-value hardware. It helps connect AI to structured forensic tools. The program assists in AI-assisted forensic investigation, ensuring human-in-the-loop review and maintaining a complete audit trail. It also supports evidence indexing and querying at scale, and automated analysis of memory images. This is not the right fit if you require a standalone digital forensics tool without AI integration or a gateway architecture.

How to get started

No credentials are required.

Use cases

• AI-assisted forensic investigation: connects AI to structured MCP tools, enforces human-in-the-loop review, and maintains a complete audit trail.
• Evidence indexing and querying at scale: parses evidence programmatically and indexes it into OpenSearch, providing LLMs with purpose-built query tools.
• Automated analysis of memory images: identifies hidden processes, C2 connections, injected code, and dumps processes for static analysis.

Sift MCP serves as a vital bridge, connecting advanced AI capabilities with established digital forensics tools. It enables investigators and responders to enhance their analysis workflows, from initial evidence parsing to detailed memory image examination. The platform's design supports both local and remote operations, with varying authentication models depending on the deployment. It aims to accelerate forensic processes while ensuring oversight and auditability.