Investigation toolkit for Claude Code. Case management, OSINT, structured analytic techniques, chain-of-custody evidence capture, and bundled MCP servers for infrastructure recon and threat intel.
Not just a scraper wrapper. A full investigation workflow — from case intake to evidence-grade dossier.
Use it for: OSINT, due diligence, threat intelligence, incident response, digital forensics, journalistic research, competitive intel, security research, CTF challenges.
flowchart LR
Start([New case]) --> NewCase[/q-new-case/]
NewCase --> Scope[/q-scope/]
Scope --> Begin[/q-begin/]
Begin --> Collect{Collection}
Collect --> Intake[/q-intake<br/>client docs/]
Collect --> OSINT[/q-osint<br/>platform-targeted/]
Collect --> Sweep[/q-collect<br/>broad sweep/]
Collect --> Target[/q-target<br/>profile/]
Intake --> Evidence[(EV-NNNN<br/>evidence items<br/>Wayback + archive.today<br/>+ Chrome PDF + SHA-256)]
OSINT --> Evidence
Sweep --> Evidence
Target --> Evidence
Evidence --> Analyze{Analysis}
Analyze --> Timeline[/q-timeline/]
Analyze --> Link[/q-link<br/>graph edges/]
Analyze --> ACH[/q-analyze<br/>Heuer's ACH/]
Analyze --> Challenge[/q-challenge<br/>red team/]
Analyze --> Reality[/q-reality-check/]
Timeline --> Report{Report}
Link --> Report
ACH --> Report
Challenge --> Report
Reality --> Report
Report --> Brief[/q-brief<br/>evidence-cited/]
Report --> Debrief[/q-debrief<br/>internal/]
Brief --> Export[/q-export/]
Debrief --> Export
Export --> End([Dossier delivered])
style Evidence fill:#fef3c7,stroke:#d97706,stroke-width:2px
style Start fill:#dbeafe,stroke:#2563eb
style End fill:#dcfce7,stroke:#16a34a
Every URL routes through capture-evidence.sh. Every finding cites [EV-NNNN]. Every claim has an A-F reliability grade.
graph TB
subgraph Claude[Claude Code]
CC[/Claude Code session/]
end
subgraph huntkit[huntkit plugin]
direction TB
subgraph Skills
OSINT_S[osint<br/>6-phase workflow]
SA_S[structured-analysis<br/>Heuer's ACH + tradecraft primer]
end
subgraph Commands[22 commands]
CM[case mgmt]
CL[collection]
AN[analysis]
RP[reporting]
end
subgraph Rules[Enforced rules]
EC[evidence-capture-protocol]
QI[q-investigation]
TD[token-discipline]
SY[sycophancy]
end
subgraph Templates
NI[new-investigation]
SS[sec-stack-case]
end
end
subgraph MCP[Bundled MCP servers]
OI[osint-infra<br/>whois, dns, wayback]
TI[threat-intel<br/>VT, URLhaus, ThreatFox, crt.sh]
end
subgraph External[Optional external APIs]
PPL[Perplexity]
EXA[Exa]
TAV[Tavily]
APF[Apify<br/>55+ scrapers]
JIN[Jina]
BD[Bright Data]
end
subgraph Case[Case workspace]
EVD[(investigations/case/<br/>evidence/ findings/<br/>targets/ timelines/)]
end
CC --> huntkit
huntkit --> MCP
huntkit --> External
huntkit --> Case
Rules -.enforces.-> Commands
Commands -.uses.-> Skills
style Case fill:#fef3c7,stroke:#d97706
style MCP fill:#e0e7ff,stroke:#6366f1
style Rules fill:#fee2e2,stroke:#dc2626
osint— 6-phase investigation: tooling check → seed collection → optional internal intel → platform extraction → cross-reference → psychoprofile → completeness scoring → dossier.structured-analysis— CIA tradecraft primer library (Heuer's ACH, key assumptions check, quality of information check, red team, premortem, 66-technique taxonomy). Apache 2.0, upstream Blevene/structured-analysis-skill.
Case management: /q-new-case, /q-scope, /q-begin, /q-status, /q-checkpoint, /q-handoff, /q-end
Collection: /q-intake, /q-collect, /q-osint, /q-target, /q-screenshots
Analysis: /q-analyze, /q-challenge, /q-reality-check, /q-client-questions, /q-timeline, /q-link
Reporting: /q-brief, /q-debrief, /q-export
Specialized: /q-sec-stack (SaaS security stack intel)
osint-infra— WHOIS, DNS, reverse DNS, Wayback snapshots / fetch.threat-intel— VirusTotal, URLhaus, ThreatFox, crt.sh certificate transparency.
evidence-capture-protocol— every URL routes throughcapture-evidence.sh(Wayback + archive.today + Chrome PDF + SHA-256 + metadata). AtomicEV-NNNN-<slug>/folders. Reports cite by ID.q-investigation— fail-stop on errors, token discipline, state-vs-session file authority, source reliability A-F scale.token-discipline— stop conditions, retry limits.sycophancy— anti-RLHF drift, decision origin tagging.
new-investigation/— full case scaffold (canonical/,investigation/evidence|findings|targets|timelines/,memory/,output/).sec-stack-case/— SaaS security stack investigation template.
# In Claude Code
/plugin install assafkip/huntkitOr clone:
git clone https://github.com/assafkip/huntkit.gitcp .mcp.json.template .mcp.jsoncd mcp-servers/osint-infra
python3.13 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txtGet free keys:
- VirusTotal: https://virustotal.com/gui/join-us (500 req/day)
- abuse.ch (URLhaus + ThreatFox): https://auth.abuse.ch
export VT_API_KEY=...
export ABUSE_CH_AUTH_KEY=...All optional — the skill degrades gracefully. Run bash skills/osint/scripts/diagnose.sh to see what's active.
| Env var | Service | Get key |
|---|---|---|
PERPLEXITY_API_KEY |
Perplexity Sonar / Deep | https://perplexity.ai |
EXA_API_KEY |
Exa semantic search | https://exa.ai |
TAVILY_API_KEY |
Tavily agent search | https://tavily.com |
APIFY_TOKEN |
Apify scrapers (LinkedIn, IG, TikTok, YouTube, FB pages) | https://apify.com |
JINA_API_KEY |
Jina reader / deepsearch | https://jina.ai |
PARALLEL_API_KEY |
Parallel AI search | https://parallel.ai |
BRIGHTDATA_MCP_URL |
Bright Data MCP (Facebook, LinkedIn, geo-blocked) | https://brightdata.com |
Not bundled — install separately if needed:
git clone https://github.com/Darksight-Analytics/tgspyder.git
cd tgspyder && pip install -r requirements.txt && pip install -e ./q-new-case acme-breach
/q-scope # define question, targets, constraints
/q-begin # resume session
/q-intake <file> # ingest client-provided docs
/q-osint linkedin https://linkedin.com/in/someone
/q-collect domain acme.com
/q-target acme-ceo
/q-timeline # reconstruct event sequence
/q-analyze ach # analysis of competing hypotheses
/q-challenge # red team own conclusions
/q-brief # generate evidence-grounded report
/q-export # final package
Every URL captured routes through the evidence protocol. Every report cites [EV-NNNN]. Every claim has an A-F reliability grade.
For:
- Authorized security testing and due diligence
- Journalistic and academic research on public figures
- Defensive threat intelligence and incident response
- CTF / educational contexts
Do not use on private individuals without consent, for harassment, doxxing, or stalking. You are responsible for compliance with local laws and platform terms of service.
Issues and PRs welcome. Backward-compatible additions preferred.
See llms.txt for a machine-readable capability summary with a decision matrix for when to use each skill, command, and MCP server.
MIT. See LICENSE.
The skills/structured-analysis/ subdirectory is Apache 2.0 (see skills/structured-analysis/LICENSE and NOTICE.md).