Exterro Forensic Agent

This remote digital forensics and incident response platform lets an AI client investigate live Windows endpoints through the Model Context Protocol. It runs in three tiers: a stateless MCP server exposing the tools, an Agent Hub managing WebSocket connections, and an endpoint agent installed as a Windows service, with Redis routing between them.

The MCP server registers 76 tools covering host state, filesystem, event logs, registry, browser artefacts, memory, and forensic artefact parsing. Filesystem queries use a DuckDB-backed NTFS index kept current from the USN journal, so large volumes respond in milliseconds. Collectors cover prefetch, shellbags, USB history, persistence, shadow copies, thumbcache, SAM accounts, and PowerShell history. Evidence streams as AES-encrypted, segmented archives into cloud or NAS storage with resumable jobs. Authentication uses a self-hosted OAuth 2.0 and PKCE server issuing per-user JWTs, with optional SAML SSO and tenant scoping. It deploys to GCP, AWS, and Azure, and a Google ADK agent on Vertex AI Agent Runtime connects it to Gemini with each user’s own token for attributable audit records.