Labels

• accuracy

  accuracy

  Accuracy / detection-rate work

• architecture

  architecture

  Design decisions about the agent loop / boundary

• area:agent

  area:agent

  Area: dart-agent (loop)

• area:audit

  area:audit

  Area: dart-audit (chain-of-custody log)

• area:corr

  area:corr

  Area: dart-corr (correlation engine)

• area:docs

  area:docs

  Area: documentation / wiki

• area:mcp

  area:mcp

  Area: dart-mcp (typed forensic surface)

• area:playbook

  area:playbook

  Area: dart-playbook (YAML rules)

• area:tests

  area:tests

  Area: test suite / CI

• audit-chain

  audit-chain

  SHA-256 audit chain integrity, replayability

• bug

  bug

  Something isn't working

• case-study

  case-study

• correlation

  correlation

  dart-corr — DuckDB joins, contradiction detection

• dataset

  dataset

  Test datasets — CFReDS, Ali Hadi, M57

• discussion

  discussion

  Needs design discussion before implementing

• documentation

  documentation

  Improvements or additions to documentation

• duplicate

  duplicate

  This issue or pull request already exists

• enhancement

  enhancement

  New feature or request

• evaluation

  evaluation

• from-cfreds-benchmark

  from-cfreds-benchmark

• good first issue

  good first issue

  Good for newcomers

• good-first-issue

  good-first-issue

  Good first contribution

• hackathon

  hackathon

  Specifically for SANS FIND EVIL! 2026 deliverable

• help wanted

  help wanted

  Extra attention is needed

• help-wanted

  help-wanted

  Community help welcome

• invalid

  invalid

  This doesn't seem right

• live-mode

  live-mode

  Real Claude API + MCP stdio integration

• mcp-surface

  mcp-surface

  Adding/changing the typed forensic function surface

• mitre-attack

  mitre-attack

  MITRE ATT&CK mapping / coverage

• opsec

  opsec

  Information disclosure / OPSEC concerns