# SIFT Workstation (required for forensic tools)
docker pull sansdfir/sift
# OR native install:
# curl -L https://raw.githubusercontent.com/teamdfir/sift-saltstack/master/bootstrap.sh | sudo bash

# Python 3.10+
python3 --version

# Groq API Key (get one free at https://console.groq.com)
export GROQ_API_KEY='gsk_your_key_here'

# 1. Clone and install
git clone https://github.com/yourname/findevil-agent
cd findevil-agent
python3 -m venv venv
source venv/bin/activate
pip install -e ".[dev]"

# 2. Create test evidence
truncate -s 50M /evidence/cases/test.raw
mkfs.ext2 -F /evidence/cases/test.raw
# Populate with files using debugfs
debugfs -w -R "mkdir /Users" /evidence/cases/test.raw
debugfs -w -R "mkdir /Users/Admin/Downloads" /evidence/cases/test.raw
echo "Hello from Find Evil!" | debugfs-w -R "write /dev/stdin /hello.txt" /evidence/cases/test.raw

# 3. Run the MCP server
python -m src.server

# 4. In another terminal, run the full agent workflow
bash scripts/run_agent.sh /evidence/cases/test.raw

docker build -t findevil-agent .
docker run --rm -it \
  -v /evidence:/evidence \
  -v /results:/results \
  -e GROQ_API_KEY=$GROQ_API_KEY \
  findevil-agent

# Unit tests for tool wrappers
pytest tests/ -v

# Manual tool tests via MCP protocol
python tests/test_server.py

# Agent workflow integration test
python tests/test_workflow.py

┌─────────────┐     ┌──────────────────┐     ┌──────────────────┐
│   MCP Client │────►│  FindEvil MCP    │────►│  SIFT Workstation │
│  (Claude     │     │  Server          │     │  (200+ tools)     │
│   Code/CLI)  │◄────│  (21 typed tools)│◄────│                   │
└─────────────┘     └──────────────────┘     └──────────────────┘
                           │
                    ┌──────┴──────┐
                    ▼             ▼
           ┌──────────────┐ ┌──────────────┐
           │  Groq AI     │ │  Audit Trail │
           │  (Reasoning, │ │  (JSON Logs) │
           │  Reports)    │ │               │
           └──────────────┘ └──────────────┘

findevil-agent/
├── src/
│   ├── server.py              # MCP Server — 21 tools
│   ├── models.py              # Pydantic data models
│   ├── agent/
│   │   ├── loop.py            # Self-correcting workflow
│   │   ├── groq_client.py     # Groq AI integration
│   │   ├── prompts.py         # DFIR system prompts
│   │   └── output_parser.py   # Structured result parsing
│   └── tools/
│       ├── filesystem.py      # TSK wrappers (fls, icat, mmls, fsstat, istat)
│       ├── memory.py          # Volatility 3 wrappers
│       ├── timeline.py        # Plaso timeline wrappers
│       ├── carving.py         # foremost, bulk_extractor, binwalk
│       ├── registry.py        # regipy registry analysis
│       ├── network.py         # tshark PCAP analysis
│       ├── hashing.py         # sha256sum, hashdeep
│       └── patterns.py        # YARA scanning + built-in rules
├── config/
│   ├── server.toml            # Server settings
│   └── tools.toml             # Tool definitions
├── tests/
│   ├── test_server.py         # 9 MCP integration tests
│   └── test_workflow.py       # 2 workflow tests
├── docs/
│   ├── accuracy_report.md     # Self-assessment
│   ├── architecture.svg       # Architecture diagram
│   ├── demo-script.md         # 5-min video script
│   └── dataset_documentation.md  # Evidence sources
├── scripts/
│   ├── setup.sh               # Environment setup
│   └── run_agent.sh           # Full agent execution
├── Dockerfile                 # Reproducible deployment
└── .env.example               # Environment template