Open Investigator is an Apache-2.0 CLI for first-pass Linux and Windows server incident response. It lets an AI investigator collect local host evidence through sealed read-only tools, then writes evidence.jsonl, commands.log, report.json, and report.md. It does not isolate hosts, block IPs, kill processes, delete files, disable accounts, restart services, or change firewall/registry state.