# Forensics MCP Server - Python requirements  (Python 3.10-3.13)
# Installed automatically by install.ps1

# --- Core MCP integration ---
# Pin to the 1.x line: the server uses the low-level Server decorator API
# (@server.list_tools / @server.call_tool), which changed in mcp 2.x.
mcp<2
pydantic

# --- Config / system ---
pyyaml
psutil
requests
anyio

# --- Forensic parsers ---
python-registry          # Windows registry
lz4                      # macOS Unified Logs (tracev3) decompression
biplist                  # macOS Unified Logs / binary plists
pefile                   # Volatility3 (PE parsing)

# NOTE: two dependencies are NOT plain PyPI packages and are installed by
# install.ps1 separately:
#   - chainbreaker (macOS keychain)      : pip install git+https://github.com/n0fate/chainbreaker.git
#   - volatility3 deps (bundled in Tools) : pip install -e Tools/volatility3
#
# Bundled external tools live in Tools/ (KAPE/EZ, SleuthKit, Arsenal, Volatility3,
# UnifiedLogReader) - no download needed. Optional/host-provided: Hashcat, and for
# macOS APFS an Ubuntu WSL distro with apfs-fuse (install.ps1 -MacOS sets this up).
