OSINT toolkits · Rank #8
cti-expert
Grade B: derived only from the two verdicts below. How grades work
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
Why this verdict
How we check →- 143 commits by 4 contributors in the last 90 days (14 in the last 30). receipt ↗
- NumPy 1 declared; latest is 2 (1 major behind). receipt ↗
- On current major: Pydantic. receipt ↗
Snapshot: commit a7ca9b7 on main, checked 2026-10-19 07:52 UTC. Receipts link to files at this exact commit.
- No license detected: check terms before commercial use.
Dependency freshness
Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.
What's in the stack
- Database / ORM
- PostgreSQL (psycopg)
- API layer
- Pydantic
Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.
What the README says you get
- DataPersistent knowledge base
a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment
- DeployBundled installer
the bundled installer (`scripts/install.{sh,ps1}`) provisions the deep layer automatically
- OtherMulti-vector reconnaissance
Multi-vector reconnaissance on any target type — person, domain, organization, username, email, IP, WiFi
- OtherStructured report bundle
the base bundle (Markdown + JSON + CSV + IOC bundle) always saves
- OtherPresentation report formats
you pick a presentation report: PDF, DOCX, HTML, or all
- OtherKeyless core techniques
Every core technique runs with zero API keys
- OtherAuto-detected API keys
Add any free or paid keys to `.env` (or run `/apikeys set `) and the skill auto-detects them
- OtherAutomated finding validation
with automated finding validation, exposure scoring, and structured intelligence delivery
- OtherCross-type auto-pivot loop
Every selector type is a frontier node; metered spend stays behind one digest-bound approval
- OtherWHOIS history eras
the house report renders a **Registrant eras** table
- Otherurlscan Pro lifecycle
urlscan **Pro** supplies the hostname lifecycle index
- OtherSandbox detonation
submits each complete file through the private-by-default sandbox client
Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 19, 2026. Every item is checked against an exact README quote; 2 unverifiable items were discarded. A README claim is the maker's description, not something we tested.
Watch cti-expert
Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.
History
Oct 1, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.
Show as a table
| Date | Maintenance | Dependencies | Commits (90d) |
|---|---|---|---|
| Oct 19, 2026 | Active | 1 major behind | 143 |
| Oct 12, 2026 | Active | 1 major behind | 142 |
| Oct 1, 2026 | Active | 1 major behind | 142 |
Sources
Every claim on this page comes from these public records, checked . Open them to verify.
- Commit history ↗ default branch (main) at the checked commit: pulse, contributors, last commit
- Releases ↗ latest release
- requirements.txt ↗ declared dependency versions and stack (at commit a7ca9b7)
- README ↗ quoted features at the checked commit
- PyPI ↗ latest versions of Python packages (each linked in the table above)