IncidentDocket

The description states IncidentDocket is a "privacy-bounded Windows evidence collector for developers and first-line technical support who maintain Windows applications or drivers." It runs locally as a stdio MCP server and exposes four tools:

• plan_collection
• collect_incident_window
• inspect_evidence
• export_support_report

It collects only requested synthetic or Windows evidence, masks sensitive identifiers, assigns stable evidence IDs, and validates cited IDs before exporting reports. The tool does not repair machines, execute recommendations, or autonomously declare root causes.

The description states the product was built to address a concern about "as agents gain access to operating-system tools and sensitive data, guardrail design becomes as important as model capability." It positions itself as placing "a controlled, inspectable evidence layer between Windows and the reasoning model—one that gives the model enough context to help without treating the whole machine as its context window."

The author frames this as both a technical challenge ("how far could a first-time hackathon participant take a real developer tool") and a product design question ("how far could a first-time hackathon participant take a real developer tool when Codex was used as an implementation and review partner").

The description states IncidentDocket is for "developers and first-line technical support who maintain Windows applications or drivers." It's specifically designed for Windows incident investigation where the usual next step is to gather more data but broad diagnostic dumps can expose sensitive information.

Not evidenced. The description makes no claims about pricing, revenue streams, or business model beyond its own self-reporting.

The tool is described as an ESM TypeScript application with Windows PowerShell 5.1 collectors. It uses the Model Context Protocol SDK and Zod as runtime dependencies. It implements no network client or direct OpenAI API integration. The server runs locally on Windows 11 as current user without automatic elevation.

Not evidenced. The description states this was a hackathon submission by a single developer, with no claims about customers, revenue, or traction beyond its own self-reporting.

Not evidenced. The description does not mention competitors or competitive positioning beyond its own stated approach to privacy controls in Windows incident investigation.

• Single-person development team (1 member)
• Self-reported only, no independent verification
• No evidence of customers, revenue, or traction
• Limited to Windows 11 environment
• Hackathon submission context with no indication of post-hackathon development
• Relies heavily on AI-assisted development process rather than traditional product development

1. What is the actual development timeline and whether this was a one-off hackathon effort or ongoing project?
2. Has there been any real-world testing beyond the synthetic fixture?
3. Are there plans for expansion beyond Windows 11 or additional evidence sources?
4. How does the team plan to scale beyond single-person development?
5. What is the actual privacy boundary enforcement mechanism and how is it tested?