Mulder – Containerized MCP server for digital forensics investigations
I built Mulder for the SANS "FIND EVIL!" hackathon. My background is not in forensics, but I was interested in building the agent. I've been seeing some really cool results and thought this community might like it! Mulder is an MCP server that exposes forensic tools like Volatility, Sleuthkit, Plaso, and more as typed tool calls. Every invocation is recorded in an append-only audit log. When an agent finds something, it submits a "finding" to the case database. Each finding must have evidence citations that are validated before being admitted. If the agent cites evidence or a tool execution…
What it does
In the maker’s words, at launch
I built Mulder for the SANS "FIND EVIL!" hackathon. My background is not in forensics, but I was interested in building the agent. I've been seeing some really cool results and thought this community might like it! Mulder is an MCP server that exposes forensic tools like Volatility, Sleuthkit, Plaso, and more as typed tool calls. Every invocation is recorded in an append-only audit log. When an agent finds something, it submits a "finding" to the case database. Each finding must have evidence citations that are validated before being admitted. If the agent cites evidence or a tool execution that doesn't exist, the finding is dropped. The biggest problem I needed to solve was context window pressure. These investigations often contain a lot of data, and processing it produces a lot of noise that will fill a context window quickly. To avoid this, all tool output is stored in a per-case SQLite database with full-text search. The agent can then search the database and request segments of tool output as much as it wants. It ships as a container with all forensic binaries, symbol tables, YARA rules, MITRE ATT&CK data, and Claude Code pre-configured. You just have to mount your read-only evidence directory, start the container, and ask Claude to start an investigation. I tested it against two test scenarios that I found online. Based on the ground truth I have been able to find, Mulder is producing pretty impressive results. I have provided the output from these runs in the examples in my repo. If you know a lot about digital forensics or if it's something that interests you, please check it out. I'd appreciate any feedback.
Does the same job
all alternatives →
- MSMCP Server for Document Processing via Natural Language2025 · github.com · ▲8
Hey, I'm Nick from Nutrient, I want to share our newly released MCP Server that enables document workflows using natural language — things like redacting, merging, signing, converting formats, or extracting data. While many MCP servers have traditionally been developer-focused, we recognized that the technology could be highly effective in promoting the adoption of tools that are often hidden from end-user interfaces. We’re really interested to see if this side of the protocol could continue to mature. One thing we struggled with was the inability to receive documents from the client (no…
MCPScan21d ago · kuldeepster574.gumroad.com · ▲2Discover & audit shadow Model Context Protocol servers
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 17d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 26d ago · cactuscompute.com
Launched alongside, April 2026
the whole month →
- AG
Thought the resources for GPU arch were lacking, so here we are
Life & fun · Apr 2026 · jaso1024.com
- IB
Built a ~9M param LLM from scratch to understand how they actually work. Vanilla transformer, 60K synthetic conversations, ~130 lines of PyTorch. Trains in 5 min on a free Colab T4. The fish thinks the meaning of life is food. Fork it and swap the personality for your own character.
AI · Apr 2026 · github.com
- BC
Life & fun · Apr 2026 · sam-burns.com
- IB
With social media and now AI, its important to keep the indie web alive. There are many people who write frequently. Blogosphere tries to highlight them by fetching the recent posts from personal blogs across many categories. There are two versions: Minimal (HN-inspired, fast, static): https://text.blogosphere.app/ Non-minimal: https://blogosphere.app/ If you don't find your blog (or your favorite ones), please add them. I will review and approve it.
AI · Apr 2026 · text.blogosphere.app