Apache-2.0 local, read-only AI server investigation CLI for Linux and Windows hosts. It collects host evidence across auth logs, accounts, processes, network, persistence, services, web logs, Java clues, recent files, packages, containers, and history, then writes evidence.jsonl, commands.log, report.json, and report.md for first-pass incident triage without remediation authority.