ai-dfir-toolkit
MCP server scanning
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
Contribute
Spot an error, or know a record we should add? Members can propose additions and submit corrections.