The Tribunal

Inspiration

The challenge was Find Evil! But AI finds evil fast and hallucinates—and one fake forensic finding voids a case in court. We didn't need a faster analyst. We needed findings that survive cross-examination.

What it does

Tribunal puts AI's forensic findings on trial. One agent accuses, one cross-examines with evidence, one rules. Only findings that survive are sealed into a signed, court-ready chain of custody. Evil, proven.

How we built it

Three adversarial agents over SANS SIFT tools (Volatility, MFT, registry) via a read-only MCP server. Every finding cites sealed evidence; every step is hash-chained. Tiered models keep it cheap at scale.

Challenges we ran into

Stopping the Adversary from rubber-stamping (objections must cite evidence). Read-only-by-construction so we can't corrupt evidence. And proving real detection—live Volatility, not transcribed answers.

Accomplishments that we're proud of

Volatility independently caught a real process injection on a real memory image. A planted hallucination gets dismissed on screen. A signed case file anyone can verify. Zero spoliation, by construction.

What we learned

In forensics, speed without trust is just faster mistakes. You can't fix AI hallucination by self-review—only adversarially. And honesty about what you can't prove is what makes a forensics tool credible.

What's next for The Tribunal

A live-triage mode for active incidents, the full 200-tool SIFT arsenal via our deployment backend, native evidence acquisition, and a community benchmark so the field can measure AI-DFIR accuracy together.

Built With

• ed25519
• fastapi
• mcp
• mitre-att&ck
• openai
• python
• react
• sift
• sqlite
• typescript
• volatility-3