OSINT-OA

The problem

An OSINT investigation means ten open tabs: search engines, domain records, DNS, social networks, leaks. Every tool returns its own format, evidence gets copied by hand, and in the end nobody can reconstruct where each finding came from. Indicators of compromise (IOCs) end up scattered across notes.

Approach

A multi-agent platform on LangChain/LangGraph following the ReAct pattern, where each agent owns one phase of the intelligence cycle:

• ControlAgent: plans the investigation and delegates to the specialised agents.
• 10 OSINT agents: search, scraping, threat analysis, IOCs, identities and domains.
• ConsolidatorAgent: publishes the formatted report to Telegram channels.
• Every agent returns IOCs, entities and MITRE ATT&CK techniques with structured evidence, and every action and decision is logged so the investigation can be reconstructed later.

Status

Not a script: Python 3.12+, 222 passing tests, MIT licence and a documented catalogue of agents and tools in the repository.

How to reproduce

The repository includes the README with installation, the agent list with their tools and the test suite.

Limits

Ethical and legal use, spelled out in the README itself: authorised audits and research. Quality depends on the orchestrator’s plan and on external sources: rate-limited APIs, incomplete results and a per-investigation token cost. Structured evidence helps audit the investigation; it does not replace human verification of it.