What it does## Inspiration
An AI-powered adversary can compromise an entire system and achieve full domain control in under 8 minutes, with advanced breakout cycles taking less than 60 seconds. Meanwhile, human incident responders are severely throttled by the steep command-line learning curves of low-level data tools. During an active breach, manual syntax building for forensic parsing creates a dangerous operational bottleneck.
We were inspired to close this machine-speed gap by transforming traditional, multi-hour forensic investigations into a 10-second natural language threat-hunting session, giving every defender an AI co-pilot that can triage incidents at the exact pace modern threats demand.
What it does
Protocol-SIFT-Mini serves as an autonomous, secure local AI workstation built on top of the defensive tool philosophy of the SANS SIFT ecosystem. By utilizing the Model Context Protocol (MCP), it securely bridges cloud-isolated LLMs (like Claude) with host-level operating environments.
Instead of an analyst manually searching display flags during a 3 AM incident, the agent safely executes, correlates, and reasons over native forensic binaries directly on the endpoint. It can parse raw network packets via TShark, audit offline system memory dumps via Volatility 3, and crawl filesystem metadata using The Sleuth Kit (fls)—delivering real-time structured security intelligence from conversational prompts.
How we built it
The core system is designed as a decoupled, non-blocking orchestration loop built for Windows environments:
The Orchestration Bridge: Built from scratch using Python and the fastmcp framework to expose complex endpoint actions as standardized LLM tools.
Resilient Path Configuration: Hardcoded absolute environment execution maps utilizing the explicit Python core environment paths to ensure seamless JSON-RPC communication within the Claude Desktop client app.
Isolated Tool Execution Engine: Wrapped native binaries (tshark.exe, vol.exe, fls.exe) via Python's subprocess layer. By passing stdin=subprocess.DEVNULL, we isolated process streams to guarantee that interactive background command loops never hang or block the AI client.
Challenges we ran into
Environment and Pathing Mismatches: Getting a cloud-centric model to interface smoothly with local Windows directory paths and specific Python execution environments caused initial JSON-RPC connection errors. We resolved this by auditing background processes and crafting an airtight, absolute-path configuration mapping layer.
Stream Deadlocks: Forensic tools running via standard shell execution can easily hang indefinitely if they wait for interactive inputs. We had to implement defensive execution constraints to suppress interactive flags and handle empty packet streams cleanly.
The Cloud Data Privacy Dilemma: Real enterprise incident response teams cannot leak corporate data or upload massive 32GB raw memory dumps to a public cloud API. We solved this by ensuring all binary data processing remains completely localized on the host hard drive—only clean, structural text metadata summaries are ever returned to the model context.
Accomplishments that we're proud of
Flawless Live Triage: In live testing environment runs, our agent successfully ingested raw .pcapng packet files. In under five seconds, it cleanly mapped out local machine paths, isolated active QUIC/UDP streams, broke down step-by-step TLS 1.2 handshakes (Server Hello ➔ Certificate ➔ Key Exchange), flagged network retransmissions, and identified dead gateway ARP queries.
100% Data Confidentiality: We successfully kept highly sensitive network packet metrics strictly on-premise, proving that advanced AI threat hunting does not require sacrificing data privacy.
What we learned
We learned that the Model Context Protocol (MCP) is completely reshaping the defensive security landscape. Building an effective AI agent isn't about letting the model write code from scratch or hallucinate commands; it's about providing the model with a highly structured, strictly constrained set of local tools. When given clear execution pathways, an LLM's capability to instantly correlate raw hex data and telemetry logs into human-readable analysis is unmatched.
What's next for FIND EVIL AGENT
Multi-Agent Orchestration: Moving from a single custom MCP server to a multi-agent framework (like LangGraph or CrewAI) where specialized analyst agents can collaborate—one focusing purely on memory anomalies while another cross-correlates network traffic.
Autonomous Remediation Playbooks: Extending the server's toolset from passive triage to active response, enabling the agent to safely isolate an endpoint from the network or terminate malicious process trees the moment "evil" is identified.
Deep SIFT Suite Integration: Expanding the binary bindings to include timeline analysis utilities and registry tools to leverage more of the 200+ utilities available in the SIFT ecosystem.
Built With
- arp
- languages:-python-frameworks:-fastmcp-(model-context-protocol-sdk)-platforms-&-clients:-claude-desktop-application
- quic/udp
- sans-sift-workstation-platform-ecosystem-digital-forensics-&-incident-response-(dfir)-binaries:-tshark-(wireshark-network-analyzer-engine)
- the-sleuth-kit-(fls-partition-logic)-operating-system-environment:-windows-11-host-endpoint-architecture-data-transport-protocols:-json-rpc-(local-ipc)
- tlsv1.2
- volatility-3-(advanced-memory-forensics-framework)
