verdict-dfir-beta

{ "$schema": "https://raw.githubusercontent.com/modelcontextprotocol/specification/main/schema/draft/schema.json", "_comment": "SSH-transport variant. Activate with scripts/find-evil-sift, which rewrites IP/key/repo at runtime from env vars (SIFT_SSH_KEY, SIFT_VM_IP, GUEST_USER, GUEST_REPO_PATH). Default key: ~/.ssh/sift_key. Do not hand-edit the IP or key path here; they are populated automatically.", "mcpServers": { "findevil-mcp": { "type": "stdio", "command": "ssh", "args": [ "-i", "~/.ssh/sift_key", "-T", "-o", "StrictHostKeyChecking=accept-new", "-o", "ServerAliveInterval=30", "-o", "ServerAliveCountMax=3", "sansforensics@192.0.2.10", "VOLATILITY_BIN=/home/sansforensics/.local/bin/vol HAYABUSA_BIN=/home/sansforensics/.local/bin/hayabusa VELOCIRAPTOR_BIN=/home/sansforensics/.local/bin/velociraptor exec /home/sansforensics/find-evil/target/release/findevil-mcp" ] }, "findevil-agent-mcp": { "type": "stdio", "command": "ssh", "args": [ "-i", "~/.ssh/sift_key", "-T", "-o", "StrictHostKeyChecking=accept-new", "-o", "ServerAliveInterval=30", "-o", "ServerAliveCountMax=3", "sansforensics@192.0.2.10", "cd /home/sansforensics/find-evil/services/agent_mcp && exec /home/sansforensics/.local/bin/uv run python -m findevil_agent_mcp.server" ] } } }