interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
osintbrazuca / osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
OpenOSINT / OpenOSINT
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
mukul975 / cve-mcp-server
Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
marc-shade / world-intel-mcp
160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs, geofences, SSE dashboard. MIT, no paid API keys.
Bert-JanP / Open-Source-Threat-Intel-Feeds
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
KatrielMoses / voidaccess
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
mitre-attack / attack-stix-data
STIX data representing MITRE ATT&CK
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
RansomLook / RansomLook
Yet another Ransomware gang tracker
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
MISP / misp-galaxy
Clusters and elements to attach to MISP events or attributes (like threat actors)
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
OpenCTI-Platform / connectors
OpenCTI Connectors
google / mcp-security
—
s4ntrx / Cybersecurity-Threats-Guide
Cybersecurity Threats & Vulnerabilities Guide is a comprehensive educational resource that provides detailed documentation, detection scripts, and prevention strategies for various cybersecurity threats.
Tcotl / AgentCapture
新一代反制型蜜罐平台：通过反向代理在真实业务系统中无损植入蜜饵与虚拟路由，利用功能性伪装与反向提示词注入反控 AI 渗透 Agent，实现攻击捕获、画像溯源与上线反制。
aaravshah1311 / Agent-2
An autonomous AI agentic harness built to code anything, automate terminals, perform cybersecurity tasks, and execute complex real-world workflows with minimal human intervention. From writing and debugging code to analyzing systems, managing files, running commands, and orchestrating tools, Agent-2 turns simple prompts into autonomous execution.
Ethan-Andrews / ThreatIntel-Aggregator
Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs standalone or fully Azure-integrated.
yankywilson / kyber-ransomware-analysis
Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.
kaifcodec / phonsint
🕵️♂️ Advanced phone number OSINT suite engineered for silent reconnaissance. Extracts masked emails, profile avatars and uncovers cross-platform account registrations, and enriches identity footprints with zero SMS alerts.