// SCAN REPORT

SIFTGuard

10 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 30 Jun 2026

4 can modify or destroy data

6 read-only

10 tools total

Community server · catalogue entry verified 30/06/2026

How to control SIFTGuard ↓

TOOL MAP

What SIFTGuard exposes to your agents

Read (6) Write / Execute (4) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous SIFTGuard tools

Execute · High build_timeline This tool actively processes and correlates multiple evidence sources (memory, logs, disk artifacts) from a directory to produce a unified timeline. Execute · High run_sleuthkit This is an Execute tool because it runs external commands/tools (Sleuthkit utilities) whose behavior and output depend on supplied arguments (disk image paths, options). Execute · High run_volatility This is Execute rather than Read because it runs code (volatility3 plugins) whose effects and output depend on runtime arguments and the memory dump provided. Write · Medium record_finding This tool writes/creates a new forensic finding record to a case file.

4 of SIFTGuard's 10 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control SIFTGuard

PolicyLayer is an MCP gateway — it sits between your AI agents and SIFTGuard, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "record_finding": {
    "limits": [
      {
        "counter": "record_finding_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "check_mitre": {
    "limits": [
      {
        "counter": "check_mitre_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register SIFTGuard — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON SIFTGUARD →

Instant setup, no code required.

FULL CATALOGUE

All 10 SIFTGuard tools

EXECUTE 3 tools

Execute build_timeline Build a supertimeline from all evidence in a directory. Correlates memory, logs, disk artifacts chronologicall Execute run_sleuthkit Run Sleuthkit (fls/mmls/istat) to analyze disk images. Reveals deleted files, filesystem metadata, partition t Execute run_volatility Run a volatility3 plugin against a memory dump for forensic analysis. Plugins: windows.pslist, windows.netscan

WRITE 1 tools

Write record_finding Record a validated forensic finding to the case file. Requires: title, severity, evidence list, mitre_techniqu

READ 6 tools

Read check_mitre Map observed attacker behavior to MITRE ATT&CK techniques and tactics. Read extract_iocs Extract Indicators of Compromise (IOCs) from text: IPs, domains, file hashes, URLs, registry keys, file paths. Read get_audit_trail Return the complete structured audit trail of all tool calls in this investigation session. Read list_evidence List all forensic artifacts available in the evidence directory. Read parse_evtx Parse Windows Event Log (.evtx) file and filter by Event IDs. Key IDs: 4624=logon, 4688=process, 4720=new_user Read search_playbook Retrieve DFIR investigation playbook for a threat type: ransomware | malware | intrusion | lateral_movement

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about SIFTGuard

How do I prevent bulk modifications through SIFTGuard? +

The SIFTGuard server has 1 write tools including record_finding. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach SIFTGuard.

How many tools does the SIFTGuard MCP server expose? +

10 tools across 2 categories: Execute, Read. 6 are read-only. 4 can modify, create, or delete data.

How do I enforce a policy on SIFTGuard? +

Register the SIFTGuard MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every SIFTGuard tool call.

Deterministic rules across all 10 SIFTGuard tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON SIFTGUARD →

Instant setup, no code required.

10 SIFTGuard tools catalogued and risk-classified — across an index of 43,000+ MCP servers.