How calebevans/mulder works
Mulder is an autonomous digital-forensics investigation orchestrator and MCP server. An investigator starts a case from the CLI; the orchestrator runs cataloging, extraction, cross-system analysis, adversarial review, and reporting, using gated agent sessions and typed MCP tools. Evidence and findings are indexed in a per-case database and validated against an append-only audit trail before report and IOC/ATT&CK exports. The README documents the phase pipeline and security boundaries; sampled source confirms orchestration, MCP dispatch, database, review, and rendering details, but not every tool-to-storage call.
Main entry points: app.py MCP server · cli.py CLI · db.py Case database · runner.py Phase runner
Components 20
Investigation orchestration
- CLI
src/mulder/cli.py - Phase runner
src/mulder/orchestrator/runner.py - Phase definitions
src/mulder/orchestrator/phases.py - Quality gates
src/mulder/orchestrator/gates.py - Agent sessions
src/mulder/orchestrator/session.py
MCP analysis tools
- Forensic extraction
src/mulder/server/tools/extract - MCP server
src/mulder/server/app.py - Cross-system analysis
src/mulder/index/correlator.py - ATT&CK mapping
src/mulder/server/tools/attack.py - Alternative narrative
src/mulder/server/tools/review.py
Evidence and case state
- Evidence catalog
src/mulder/extractors/classifier.py - Case database
src/mulder/db.py - Case data models
src/mulder/models.py
Reports and audit
- Audit trail
src/mulder/audit.py - Report renderer
src/mulder/report/renderer.py - IOC export
src/mulder/report/ioc_export.py - Navigator export
src/mulder/report/navigator.py
Other components
- Investigator
- Agent model
- Forensic utilities
Connections 21
- Investigator → CLI: starts case
- CLI → Phase runner: starts investigation
- Phase runner → Phase definitions: loads phases
- Phase runner → Agent sessions: runs phases
- Phase runner → Quality gates: checks phase results
- Agent sessions → Agent model: sends prompts
- Agent model → MCP server: calls MCP tools
- Agent sessions → MCP server: configures MCP
- MCP server → Evidence catalog: classifies evidence
- MCP server → Forensic extraction: dispatches tools
- Forensic extraction → Forensic utilities: uses utilities
- Cross-system analysis → Case database: queries time ranges
- Alternative narrative → Case database: checks coverage
- MCP server → Audit trail: records tool calls
- MCP server → Case database: validates and stores findings
- Case database → Case data models: returns case data
- CLI → Report renderer: renders reports
- CLI → IOC export: exports IOCs
- CLI → Navigator export: exports ATT&CK layers
- Report renderer → Case database: reads findings
- Report renderer → Audit trail: resolves evidence citations