Skip to content

MCP function catalog

Jump to bottom
Juwon1405 edited this page Jun 15, 2026 · 9 revisions

MCP function catalog · native forensic functions

Note on scope. This page documents the native pure-Python forensic functions that ship with the dart_mcp package. Agentic-DART v0.5 adds a second layer — 25 SIFT Workstation tool adapters (Volatility 3, MFTECmd, EvtxECmd, PECmd, RECmd, AmcacheParser, YARA, Plaso) — bringing the typed MCP surface to a single read-only boundary covering both layers. The SIFT adapters are documented in detail on SIFT-adapter-layer; this page covers the native layer only.

The full surface that the agent can call. Every function is read-only, schema-validated, and grounded in a published reference. Anything not in this catalog cannot be called by the agent — that's the architectural guarantee.

Why this catalog exists. A common reviewer question for any AI-assisted DFIR tool is "where does the detection logic come from? Did you make this up?" The honest answer for Agentic-DART is no — every function follows a specific published reference, listed inline below. If you find a discrepancy between a reference and the implementation, open an issue tagged accuracy.

Quick navigation

Platform Functions Section
Windows (12) + Windows AD (1) 13 Windows
macOS 5 macOS
Linux 6 Linux
Linux + macOS 2 Linux--macos-shared
Cross-platform 21 Cross-platform
Native total 47
SIFT Workstation adapters 25 see SIFT-adapter-layer
Grand total MCP surface 72

Windows

get_amcache

Artifact: Windows\AppCompat\Programs\Amcache.hve (sidecar CSV) Purpose: Execution evidence. Every binary that has run on the host is recorded here, including SHA-1, file metadata, and first-execution timestamp. MITRE: TA0002 (Execution) References:

  • Eric Zimmerman — AmcacheParser (de facto field reference)
  • SANS FOR500 — Windows Forensic Analysis (Day 2: Application Execution Artifacts)

parse_prefetch

Artifact: C:\Windows\Prefetch\*.pf Purpose: Boot-time and execution timeline. Each .pf records up to 8 most-recent run timestamps + file paths the binary touched. MITRE: TA0002 References:

parse_shimcache

Artifact: SYSTEM hive → AppCompatCache value Purpose: Application Compatibility Cache. Records every executable the user has navigated to or launched, even if it never ran (T1218 LOLBin reconnaissance). MITRE: TA0002, TA0007 (Discovery) References:

parse_shellbags

Artifact: NTUSER.DAT (BagMRU + Bags subkey) Purpose: Folder access history per user — including external drives, network shares, and now-deleted folders. MITRE: TA0007, TA0009 (Collection) References:

extract_mft_timeline

Artifact: $MFT (NTFS Master File Table) Purpose: Filesystem-level timeline. Critical for timestomp detection (T1070.006) — $SI (Standard Information) vs $FN (File Name) timestamp comparison. MITRE: TA0005 (Defense Evasion), TA0009 References:

list_scheduled_tasks

Artifact: \Windows\System32\Tasks\ XML + Microsoft-Windows-TaskScheduler/Operational.evtx Purpose: Persistence via scheduled tasks (T1053.005). The current top-3 persistence mechanism in commodity malware (per CrowdStrike Threat Report). MITRE: TA0003 (Persistence) References:

  • MITRE ATT&CK — T1053.005 Scheduled Task
  • Microsoft Docs — Task Scheduler XML Schema
  • CrowdStrike — 2024 Global Threat Report (T1053 prevalence)

analyze_usb_history

Artifacts: SYSTEM hive → USBSTOR, MountedDevices, setupapi.dev.log Purpose: Every USB removable device ever inserted, with first/last connect timestamps and serial numbers. Critical for IP-KVM / insider-threat investigation. MITRE: TA0001 (Initial Access), TA0009 References:

analyze_event_logs

Artifact: *.evtx files (Security, System, Application, Sysmon) Purpose: Windows event log analysis with event-ID + time-window filters. Surfaces clearing events (T1070.001), service installations, account creation. MITRE: TA0005, TA0006, TA0008 References:

analyze_windows_logons

Artifact: Security EVTX (4624 / 4625 / 4634 / 4647 / 4648 / 4672) Purpose: Logon-type analysis — distinguishes interactive (type 2), network (type 3), RDP (type 10), and explicit-credential (type 9 / 4648). MITRE: TA0006, TA0008 References:

  • Microsoft Docs — Audit Logon Events
  • JPCERT/CC — Detecting Lateral Movement (event-ID matrix per technique)

detect_lateral_movement

Inputs: Windows logon events + process tree Purpose: Pattern-based detection of PsExec (service install + 4672), WMIExec (wmiprvse.exe → cmd.exe), WinRM (5985/5986 + WSMan provider), SMB admin shares (T1021.002). MITRE: TA0008 References:

  • JPCERT/CC — Detecting Lateral Movement through Tracking Event Logs (the canonical reference for this category)
  • MITRE ATT&CK — T1021.002, T1047, T1021.006
  • F-Secure / WithSecure — Lateral Movement field manual

detect_brute_force_rdp

Artifact: Security EVTX (4625 with logon type 10) Purpose: RDP-specific brute force detection. Distinguishes credential stuffing, password spray, and single-account targeting based on source-IP and user-name patterns. MITRE: TA0006 (T1110.001 / T1110.003) References:

detect_persistence

Artifacts: Run keys, services, scheduled tasks, WMI subscriptions Purpose: Cross-mechanism persistence enumeration with anomaly scoring (recently created entries in user-writable paths get higher scores). MITRE: TA0003 (T1547, T1543, T1053, T1546) References:

  • MITRE ATT&CK — Persistence tactic page (every sub-technique)
  • Microsoft Sysinternals — Autoruns reference

Windows AD

analyze_kerberos_events

Artifact: Domain controller Security EVTX (4768 / 4769 / 4770 / 4771) Purpose: Kerberos attack detection — Kerberoasting (RC4 ticket request), AS-REP Roasting (no pre-auth), Golden / Silver Ticket residue. MITRE: TA0006 (T1558.003 Kerberoasting, T1558.004 AS-REP Roasting) References:

macOS

parse_unified_log

Artifact: log show --style ndjson output Purpose: macOS unified log parser with rule pack — TCC bypass attempts, SSH auth failures, Gatekeeper / quarantine, XProtect detections, suspicious launchd loads. MITRE: TA0001, TA0005, TA0006 References:

parse_knowledgec

Artifact: ~/Library/Application Support/Knowledge/knowledgeC.db (SQLite) Purpose: macOS CoreDuet activity database — app usage, Safari history, in-focus times. Cocoa-epoch (NSDate) → ISO 8601 conversion. MITRE: TA0007, TA0009 References:

parse_fsevents

Artifact: /.fseventsd/ (root-only) Purpose: macOS filesystem event stream. Records create / rename / delete / modify operations on every mounted volume (T1070.004 indicators). MITRE: TA0005, TA0009 References:

parse_launchd_plist 🆕 (v0.4)

Artifact: *.plist in any of 5 standard launchd paths Purpose: Surfaces persistence indicators — RunAtLoad=true in user-writable path, executable in /tmp/, aggressive KeepAlive, label masquerading. MITRE: TA0003 (T1543.001 LaunchDaemon, T1543.004 LaunchAgent) References:

parse_macos_quarantine 🆕 (v0.6.1)

Artifact: com.apple.LaunchServices.QuarantineEventsV2 SQLite at ~/Library/Preferences/ Purpose: Download provenance — links a file on disk to the URL, agent app, and timestamp that introduced it. The Gatekeeper attribute trail. MITRE: T1204 (User Execution download chain attribution) References:

  • Sarah Edwards — macOS QuarantineV2 schema reverse engineering (mac4n6.com)
  • Apple — LaunchServices Quarantine attribute documentation

Cross-platform (network)

detect_dns_tunneling 🆕 (v0.6.1)

Artifact: DNS query log (NXDOMAIN-heavy, TXT-heavy, or *.tld queries) Purpose: TA0011 (C2) entry point. Iodine/dnscat2 signature detection + Shannon entropy per subdomain + per-domain query volume heuristics. MITRE: T1071.004 (Application Layer Protocol — DNS), T1568.002 (Dynamic Resolution — DGA), T1572 (Protocol Tunneling) References:

  • Pal Asbjørn Andersen et al. — Iodine protocol whitepaper
  • iagox86 — dnscat2 design notes
  • SANS — DNS exfiltration detection with high-entropy subdomains

Linux

parse_auditd_log 🆕 (v0.4)

Artifact: /var/log/audit/audit.log Purpose: Kernel-level syscall audit. Filter by syscall, key, executable. The single most authoritative DFIR data source on Linux. MITRE: TA0002, TA0006, TA0004 References:

parse_systemd_journal 🆕 (v0.4)

Artifact: journalctl -o json --no-pager output Purpose: Unified system log — services, kernel, user sessions. Successor to traditional syslog on modern distros (RHEL 7+, Ubuntu 16.04+). MITRE: TA0006, TA0008, TA0003 References:

analyze_unix_auth

Artifact: /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family) Purpose: SSH, sudo, and PAM events. Brute-force, sudo-not-in-sudoers, su escalation, key-based vs password auth distinction. MITRE: TA0006, TA0004 References:

  • pam(8), sshd_config(5) man pages
  • SANS FOR577
  • Hal Pomeranz — Linux IR talks (auth log forensics chapter)

parse_linux_cron_jobs 🆕 (v0.6.1)

Artifact: /etc/crontab, /etc/cron.d/*, /etc/cron.{hourly,daily,weekly,monthly}/*, /var/spool/cron/*, /etc/anacrontab Purpose: Scheduled-task persistence enumeration with attacker-pattern flagging — curl/wget-pipe-shell, base64 decode, eval, raw-IP URLs, darknet TLDs, netcat listeners, bash /dev/tcp redirects, /tmp/*.sh, @reboot triggers. MITRE: T1053.003 (Cron), T1059.004 (Unix Shell), T1546 (Event Triggered Execution) Schema: evidence_root (default /), flagged_only (default false), pagination via cursor + limit. References:

  • crontab(5), anacrontab(5) man pages
  • Red Hat — RHEL Security Guide ch. 7
  • SANS FOR577

parse_linux_text_log 🆕 (v0.7.1)

Artifact: Apache/nginx combined access log, syslog (RFC3164), /var/log/messages, /var/log/secure, auditd dispatcher text mode Purpose: Auto-detects log format from line shape, parses structured records, applies 10 suspicious-content patterns plus a scanner-user-agent meta-rule. MITRE: T1003.008 (/etc/shadow read), T1190 (path traversal + SQLi), T1505.003 (webshell patterns), T1105 (remote download to shell), T1071.001 (netcat), T1046 (scanner invocation), T1222.002 (dangerous chmod), T1059.004 (reverse-shell oneliners), T1213.002 (database credential use), T1595.002 (scanner UA observed) References:

  • Apache mod_log_config — combined log format
  • RFC 3164 — The BSD syslog Protocol
  • auditd dispatcher text-mode output (/etc/audisp/audispd.conf)

parse_linux_shell_history 🆕 (v0.7.1)

Artifact: bash/zsh history files (with HISTTIMEFORMAT epoch comment lines if enabled) Purpose: Per-command attacker-pattern detection — sensitive file reads, world-writable execs, netcat listeners, reverse-shell oneliners, SSH key persistence, history clearing, cron mutation, base64 obfuscation, database credential use, scanner invocation. MITRE: T1059.004 (Unix Shell), T1003.008 (Credentials from Files), T1098.004 (SSH Authorized Keys), T1070.003 (Clear Command History), T1053.003 (Cron), T1027 (Obfuscated Files), T1046 (Network Service Discovery), T1071.001 (Application Layer Protocol) References:

  • bash(1) — HISTTIMEFORMAT semantics
  • MITRE ATT&CK — T1070.003, T1098.004, T1059.004
  • Hal Pomeranz — Linux IR (history forensics)

Linux + macOS shared

parse_bash_history 🆕 (v0.4)

Artifact: ~/.bash_history, ~/.zsh_history Purpose: Shell history with attacker-pattern detection — encoded payloads, reverse shells, SSH key insertion, history clearing (T1070.003), kernel-module load. MITRE: TA0002 (T1059.004 Unix Shell), TA0005 (T1070.003), TA0003 (T1098.004), TA0001 (T1105 Ingress Tool Transfer) References:

  • MITRE ATT&CK — T1059.004, T1070.003, T1098.004
  • SANS FOR577 — Linux IR
  • Atomic Red Team — T1059.004 test corpus (matched by our pattern set)

Cross-platform

get_process_tree

Input: process listing CSV from any OS (tasklist /v /fo csv, ps -ef, etc.) Purpose: Parent-child reasoning. Surfaces orphan processes, suspicious parents (winword.exe → powershell.exe → cmd.exe). MITRE: TA0002 References: SANS FOR508, MITRE ATT&CK T1059, Microsoft Sysmon (event-ID 1)

parse_browser_history

Input: Chrome / Firefox / Safari / Edge SQLite history Purpose: URL visits + download metadata across major browsers. Cross-OS because the SQLite schemas are identical regardless of host OS. MITRE: TA0009 (T1185 Browser Session Hijacking indicators) References:

analyze_downloads

Inputs: browser history + filesystem (Mark-of-the-Web on Windows / quarantine xattrs on macOS) Purpose: Downloaded-file provenance + MOTW analysis (T1553.005 — Mark-of-the-Web Bypass). MITRE: TA0005, TA0009 References: MITRE ATT&CK T1553.005, Microsoft Smart App Control docs

correlate_download_to_execution

Inputs: download records × execution evidence (Amcache / Prefetch / unified-log / auditd) Purpose: "User downloaded X at T+0; X executed at T+N" correlation. Bridges Initial Access → Execution. MITRE: TA0001 → TA0002 chain References: SANS FOR508 case-study chapter on download-to-execution

detect_exfiltration

Inputs: filesystem events (FSEvents / MFT) + network event log Purpose: Bulk-archive creation followed by outbound transfer. Tunable thresholds. MITRE: TA0010 (T1041 C2 Channel Exfil, T1567 Exfil Over Web Service) References: MITRE ATT&CK Exfiltration tactic, Mandiant M-Trends report (annual exfil pattern catalog)

detect_credential_access

Inputs: processes + Sysmon events Purpose: LSASS-dumping (Mimikatz, comsvcs.dll LOLBin, ProcDump), SAM/NTDS extraction, registry credential paths. MITRE: TA0006 (T1003.001 LSASS Memory, T1003.003 NTDS, T1003.002 Security Account Manager) References:

detect_ransomware_behavior

Inputs: processes + filesystem Purpose: Mass-rename pattern, shadow-copy deletion (vssadmin delete shadows), ransom note write. MITRE: TA0040 (T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery) References:

detect_defense_evasion

Inputs: events + processes + MFT Purpose: Event-log clearing (1102 / 104), timestomping ($SI/$FN), security-tool disable. MITRE: TA0005 (T1070.001 Clear Logs, T1070.006 Timestomp, T1562.001 Disable Tools) References: MITRE ATT&CK Defense Evasion tactic

detect_discovery

Input: processes Purpose: Burst detection of recon commands (whoami / net user / nltest / Get-ADUser etc.) within a small time window — flags scripted enumeration. MITRE: TA0007 (T1087 Account Discovery, T1018 Remote System Discovery) References: BloodHound team — BloodHound attack-graph corpus

detect_privilege_escalation

Inputs: logons + privilege events Purpose: Cross-platform PrivEsc — Windows token manipulation (4672, 4674), Linux setuid syscall correlation. MITRE: TA0004 (T1068, T1134, T1548)

analyze_web_access_log

Input: Apache / Nginx / IIS access log (CLF or combined log format) Purpose: SQLi, LFI, SSRF, Log4Shell, RCE, webshell-call signature matching. MITRE: TA0001 (T1190 Exploit Public-Facing App) References:

detect_webshell

Inputs: webroot directory listing + content heuristics Purpose: Webshell detection via filename heuristics + content patterns + age anomaly (file written long after deployment). MITRE: TA0003 (T1505.003 Web Shell) References:

correlate_events

Purpose: Hypothesis-tied cross-source proximity join (USB insertion ↔ logon ↔ process spawn). Surfaces contradictions as UNRESOLVED rather than smoothing them over. Reference: dart-corr design doc (dart_corr/README.md) + Architecture deep dive

correlate_timeline

Purpose: Multi-source time-proximity correlation engine. Joins N artifact streams within a configurable window. Reference: DuckDB for in-process analytics + correlation rule pack (dart_corr/correlation-rules.yaml)

What is not on the surface

To make the boundary explicit, here are functions a general-purpose agent might want, that do not exist on the Agentic-DART surface:

Forbidden function Why excluded
execute_shell Architectural — destructive verb
eval / exec Architectural — code-execution escape
write_file / delete_file Architectural — evidence-tampering risk
mount / umount Architectural — modifies host state
network_egress / curl / wget Out-of-scope — agent does not touch network
kill_process / terminate Out-of-scope — Phase 3 (agentic SOC) with human approval gate
volatility_summary Phase 2 — memory analysis sidecar deferred
parse_evtx (raw EVTX) Phase 2 — requires libevtx; current path is analyze_event_logs on pre-extracted JSON
duckdb_timeline_correlate (raw SQL) Replaced by typed correlate_timeline for safety

The forbidden set is asserted as a test (tests/test_mcp_bypass.py::test_destructive_functions_are_not_exposed). If any of the above appear on the surface, that test fails.

Operator notes

  • All functions accept paths relative to DART_EVIDENCE_ROOT. Absolute paths or .. traversal are rejected by _safe_resolve.
  • Output is JSON-serializable. Cursors / pagination via cursor + limit arguments where the underlying artifact can be huge.
  • Every successful call appends an entry to audit/<case>.jsonl with SHA-256 chaining (see Architecture deep dive).
  • Functions that hit a missing artifact return {"error": "file_not_found", "hint": "..."} instead of raising — this lets the agent revise its hypothesis rather than crash.

For extending the surface, see CONTRIBUTING.md. New functions must be (1) typed (Pydantic / JSON schema), (2) read-only (_safe_resolve for any path arg), (3) covered by a bypass test, and (4) referenced to a published source.

Additional native functions (v0.6.1–v0.7.1)

Added after the original catalog above. All are in the live registry (test_mcp_surface.py::test_registered_tools_are_exact_set asserts the exact set), bringing the native total to 47.

parse_registry_hive (Windows)

Read-only registry hive value extraction. Opens a hive (SOFTWARE, SYSTEM, SAM, NTUSER.DAT, etc.) via the python-registry parser and extracts a single value or all values under a key. Never writes; path canonicalized via _safe_resolve.

grep_shell_history_for_c2 (Linux + macOS)

Searches shell history (.zsh_history, .bash_history, .python_history) for known C2 domains and supply-chain post-install reconnaissance / exfiltration commands. ATT&CK: T1071, T1059.

detect_credential_file_access (Cross-platform)

Reports atime/mtime/ctime for credential files (SSH / AWS / GCP / Azure / kubeconfig) under a user home directory — sudden access right after a suspicious package install is a strong supply-chain exfiltration signal. ATT&CK: T1552.

scan_pth_files_for_supply_chain_iocs (Cross-platform)

Scans a Python site-packages tree for .pth files with known-malicious basenames or suspicious content (the litellm 2026-03 pattern and generic .pth-based persistence). ATT&CK: T1195.002, T1547.

detect_nodejs_install_hooks (Cross-platform)

Walks a directory tree for package.json and extracts preinstall / postinstall / install scripts — a primary npm supply-chain vector (eslint-scope 2018, ua-parser-js 2021, node-ipc 2022). ATT&CK: T1195.002, T1059.007.

detect_pypi_typosquatting (Cross-platform)

Flags site-packages entries whose names are Levenshtein distance 1–2 from high-value PyPI packages, indicating possible typosquatting. ATT&CK: T1195.002.

detect_python_backdoor_persistence (Cross-platform)

Checks known backdoor persistence locations across home directories (the litellm sysmon.py pattern, systemd user services, macOS LaunchAgents, Linux cron) abused by supply-chain attacks. ATT&CK: T1547, T1053.003, T1543.

Agentic-DART — autonomous DFIR agent · architecture-first, not prompt-first · MIT license · github.com/Juwon1405/agentic-dart

Agentic-DART

Concepts

The 5 packages

Reference

Running it

Case studies

Project

Project links

Clone this wiki locally