Flowsint turns scattered OSINT leads, like a domain, a username, an email, or a crypto wallet, into one interactive graph that you expand with a right click. Drop an entity on the canvas, run an enricher, and the results appear as new nodes with their relationships already drawn in. Over 30 built-in enrichers cover subdomain discovery, WHOIS and historical records, DNS and ASN lookups, IP geolocation, username searches with Maigret and Sherlock, breach checks for emails and phone numbers, Gravatar profiles, website crawling for contacts and tracking codes, and Ethereum wallet transactions and NFT transfers. Chain enrichers into flows so each output feeds the next step, then replay the same flow on any entity of that type. Missing a source? Write an enricher template in YAML, or describe the API in plain language and let the built-in AI draft it, with API keys kept in an encrypted vault instead of config files. Custom entity types, aliases, tags, JSON import and export, and basic role-based access control make it workable for small teams, and an n8n connector pipes findings into alerts and reports. Double-click the canvas to add items fast, or alt-drag between nodes to link them. Every graph stays on your own server, and no default accounts exist. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

SpiderFoot is an open-source OSINT automation platform, replacing hours of manual reconnaissance with automated intelligence gathering across more than 200 data collection modules. The platform accepts ten distinct target types including IP addresses, domains, hostnames, network subnets, ASNs, email addresses, phone numbers, usernames, person names, and Bitcoin addresses, then feeds them through a publisher-subscriber event bus where each module's findings trigger downstream analysis automatically. SpiderFoot queries Shodan, VirusTotal, HaveIBeenPwned, AlienVault OTX, Censys, crt.sh, WHOIS databases, social media platforms, breach databases, and dozens more sources, with most modules requiring no API keys and many offering free tiers for those that do. The YAML-configurable correlation engine applies 37 pre-defined rules to identify relationships between discovered data points, flagging patterns like shared infrastructure, credential exposure, and domain reputation anomalies. Results export in CSV, JSON, and GEXF graph formats for integration with external analysis tools. TOR integration enables dark web searching, and SpiderFoot can invoke external tools including DNSTwist, Whatweb, Nmap, and CMSeeK for deeper technical assessment. The embedded web server delivers an intuitive dashboard for scan management, data visualization, and result exploration alongside a full command-line interface for scripted automation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Agentic SOC Platform compresses hours of manual security analysis into seconds by deploying specialized AI agents that autonomously triage, investigate, and enrich security alerts. The Python/Django backend processes SIEM webhooks through Redis Streams into a modular pipeline where LangGraph-orchestrated agents extract IOCs, correlate signals, and generate Cases with severity, confidence, impact, priority, and structured verdicts. The built-in SIRP provides full case management with Alerts, Artifacts, Enrichments, Tickets, and a Knowledge base that accumulates institutional memory for both human analysts and LLM agents. Native Splunk and Elasticsearch/Kibana integrations deliver unified log search through a standardized interface so agents and analysts share identical security context. The playbook engine combines traditional SOAR automation with AI-powered investigation — launching threat hunting agents, knowledge extraction, threat intelligence enrichment, and CMDB lookups from a single orchestration layer. MCP Plugin support exposes ASP capabilities to Claude Code, Codex, and OpenCode, enabling external AI agents to operate cases, search logs, query threat intelligence, and write custom modules directly. Python Modules adapt new alert sources while Playbooks orchestrate LLM analysis and automated response actions, scaling the platform with your security scenarios. Deploy via Docker Compose with all data staying inside your network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

IRONSIGHT fuses over 50 publicly available intelligence sources into a single real-time dashboard that requires zero API keys and zero configuration. The Live Intel Feed aggregates 20+ RSS news sources with keyword relevance filtering from outlets including Reuters, Al Jazeera, and Kyiv Post. The Telegram OSINT module scrapes 27 channels every 60 seconds with automatic translation from Hebrew, Arabic, and Farsi. The interactive Leaflet Theater Map plots military aircraft positions via ADS-B transponder data, naval vessel locations in the Persian Gulf and Eastern Mediterranean, strike markers extracted from news and Telegram, missile trajectory arcs with range rings, and country-border overlays with a distance measurement tool. A header toggle switches the entire dashboard between Iran/Israel and Russia/Ukraine theaters, re-pointing every panel, map layer, and data feed to the selected conflict. The Israel Alert module streams live Pikud HaOref missile alerts with audio notifications, while the Conflict Monitor categorizes events into strikes, defense, diplomatic, and nuclear. Financial panels track defense contractor stocks, S&P 500, VIX, gold, Bitcoin, Ethereum, energy commodities via Yahoo Finance, and Polymarket prediction odds on conflict outcomes. NASA FIRMS satellite thermal detection flags fire and explosion signatures. The Next.js 16 App Router handles server-side data fetching for RSS and API endpoints while client-side React state management drives real-time polling updates. On RepoCloud, deploy IRONSIGHT on a dedicated VPS with persistent storage, root SSH access, and full control over your intelligence monitoring environment, all under the MIT license.