v0.3.8 — Zero-Dependency MCP Server & Broader Triage Scenarios

starshield-forensics v0.3.8 — Zero-Dependency MCP Server & Broader Triage Entry Scenarios

Highlights

• Privacy-by-Default MCP Server (starshield mcp / starshield.mcp_server):
  • Pure Python >= 3.10 standard-library JSON-RPC 2.0 (stdio, newline-delimited & Content-Length framed) Model Context Protocol server (0 external runtime dependencies, 0 network sockets).
  • Mount in 5 lines across Claude Desktop, Cursor, Google Antigravity, and Windsurf via uvx --from starshield-forensics starshield mcp.
  • Exposes 4 deterministic read-only tools: starshield_demo, starshield_precheck_leveldb, starshield_inspect_image_tamper, and starshield_validate_financial_iocs.
  • Enforces ephemeral per-session HMAC-SHA256 pseudonymization by default so cloud LLMs never receive raw PII, filenames, OS paths, or raw SHA-256 hashes.
• High-Frequency Scenarios Documented:
  1. FinTech, e-commerce & expense-audit screenshot container pre-screening (PNG iCCP + JPEG APP2 ICC_PROFILE / APP13 8BIM);
  2. Developer & IT offline diagnostics/recovery for corrupted local Electron (VS Code, Slack, Microsoft Teams, Discord, WhatsApp Desktop) & Chrome LevelDB caches;
  3. UK FSR Statutory Code (FSA – DIG 100) & ISO/IEC 17025 aligned DFIR triage.

Canonical SHA-256 Checksums (KEYS.pub Ed25519 Signed)

394f8e0208aae3e87751c8dd8e6c820ea13c5d896b62e39315c24018ad573c99  starshield.pyz
6f1e045be023b7acd4b3e6f4bf4e4cfce392639bb8b88f1e351369daf13ed817  starshield_forensics-0.3.8-py3-none-any.whl
87afc0617eedd5a760a5ddfb7ab5ba002dc930ff25db7ad7cd2d8bd115e19325  starshield_forensics-0.3.8.tar.gz
61e0de66364937b010f8abc600c1733d8a847ff07e68b5005025892cae1abf0f  starshield-forensics-0.3.8.spdx.json

starshield-forensics v0.3.7 — Cryptographically Signed & Reproducible Release

Highlights in v0.3.7

• Cryptographically Signed Releases & Tags (KEYS.pub + SHA256SUMS.sig): Detached OpenSSH Ed25519 signatures verifiable offline via ssh-keygen -Y verify.
• Bit-for-Bit Reproducible starshield.pyz: scripts/build_reproducible.py --verify enforces deterministic ZIP framing and SHA-256 digests across CI.
• Cryptographic Agility & External Key Separation: Added --hmac-digest {sha256,sha384,blake2b} and --hmac-key-file PATH.
• Governance & NIST IR 7608 Security Assurance Case: Added SECURITY_ASSURANCE_CASE.md, SECURITY.md, GOVERNANCE.md, CONTRIBUTING.md (DCO 1.1), and CODE_OF_CONDUCT.md, with >=80% coverage.py, Ruff, and Bandit CI gates.

starshield-forensics v0.3.6 — Multi-Schema LevelDB Carver, Zero-PII Precheck Gate & Single-File Zipapp

Highlights in v0.3.6

• Multi-Schema Chromium LevelDB .log Carving (--schema auto|chatsvc|generic-json): Expands deterministic JSONDecoder.raw_decode WAL extraction beyond chatsvc (Teams/Skype) to cover Slack Web, WhatsApp / Web Messengers, and B2B Supplier/Invoice Portals, with per-record ISO-13616 IBAN Mod-97, Luhn, BIC, and intra-message UK Sort Code extraction.
• Zero-PII Local Feasibility Gate (starshield precheck <path>): Offline pre-screening of Chromium IndexedDB/LevelDB directories and .log/.ldb files (verifying 8-byte SSTable footer magic 0xdb4775248b80fb57, .blob directories, and Blink 0xFF headers) emitting GO / PARTIAL / NO_GO_COMPACTED_OR_UNSUPPORTED with zero plaintext or path leakage.
• Zero-Install Single-File Zipapp (starshield.pyz): Run python3 starshield.pyz demo or python3 starshield.pyz precheck <dir> on air-gapped forensic VMs and law-firm workstations with zero package installation.
• Official PyPI OIDC Trusted Publisher Workflow (.github/workflows/publish-pypi.yml) & aligned requires-python >= 3.10.
• Verification: 24/24 adversarial & privacy canary unit tests passing + 24/24 (1.0000) on StarShield-Bench-24.

starshield-forensics v0.3.5 & StarShield-Bench-24 v1.0.0

Initial clean-room public release (MIT, Python >= 3.9 stdlib only, zero PyPI runtime dependencies, zero network/LLM calls): 32KiB Castagnoli CRC32C LevelDB .log carver, RFC 2083 PNG & ISO 10918 JPEG ICC/8BIM container inspector, 89-country ISO-13616 IBAN Mod-97 + 250-code ISO-9362 BIC + Luhn validator, per-run keyed HMAC-SHA256 pseudonymization, 22 unit/canary tests, and 24-case StarShield-Bench-24 suite.