How ammu-yuu/kyther works
Kyther is a plugin-based OSINT aggregation service and CLI. An investigator submits an entity; the API or CLI normalizes it, the orchestrator dispatches compatible analyzers concurrently, and discovered entities are pivoted through a depth-limited scan. Findings form a correlated dossier, which the API enriches with confidence and risk assessment for the workspace or a generated PDF. The README documents additional Reddit, threat-actor, attack-feed, and scan-history capabilities. Several API and frontend excerpts are incomplete, so uncertain internal wiring for those features is omitted.
Main entry points: api.py FastAPI Service · registry.py Plugin Registry · index.html Workspace UI · orchestrator.py Pivot Orchestrator
Components 25
Investigator Entry
- Workspace UI
kyther/web/index.html - Command Line
kyther/cli.py - FastAPI Service
kyther/api.py
Scan Engine
- Entity Model
kyther/core/entities.py - Pivot Orchestrator
kyther/core/orchestrator.py - Plugin Registry
kyther/core/registry.py - SSRF Guard
kyther/core/netguard.py
Intelligence Sources
- Username Checks
kyther/analyzers/username.py - Profile Enrichment
kyther/analyzers/profile.py - Reddit OSINT
kyther/analyzers/reddit.py - Email Intel
kyther/analyzers/email.py - Domain IP Intel
kyther/analyzers/dns.py - Phone Intel
kyther/analyzers/phone.py - Person Company Leads
kyther/analyzers/search_dorks.py
Results Workspace
- Dossier and Risk
kyther/api.py - PDF Reports
kyther/report.py - Search History
kyther/api.py - Threat Actors and Timeline
kyther/api.py - Cyber Attacks Feed
kyther/api.py - Reddit View
kyther/web/index.html
Other components
- Investigator
- Public OSINT Sources
- Reddit Archives
- Threat Data Sources
- News Sources
Connections 35
- Investigator → Workspace UI: uses workspace
- Investigator → Command Line: runs scans
- Workspace UI → FastAPI Service: requests service
- Command Line → Entity Model: creates seed
- Command Line → Pivot Orchestrator: runs scan
- FastAPI Service → Entity Model: accepts entity
- FastAPI Service → Pivot Orchestrator: runs scan
- Pivot Orchestrator → Plugin Registry: selects plugins
- Plugin Registry → Username Checks: dispatches
- Plugin Registry → Profile Enrichment: dispatches
- Plugin Registry → Reddit OSINT: dispatches
- Plugin Registry → Email Intel: dispatches
- Plugin Registry → Domain IP Intel: dispatches
- Plugin Registry → Phone Intel: dispatches
- Plugin Registry → Person Company Leads: dispatches
- Pivot Orchestrator → Entity Model: records findings
- Username Checks → Public OSINT Sources: queries sources
- Profile Enrichment → Public OSINT Sources: queries sources
- Email Intel → Public OSINT Sources: queries sources
- Domain IP Intel → Public OSINT Sources: queries sources
- Phone Intel → Public OSINT Sources: queries sources
- Reddit OSINT → Reddit Archives: queries archives
- FastAPI Service → Dossier and Risk: builds and scores
- Pivot Orchestrator → Dossier and Risk: returns scan data
- FastAPI Service → PDF Reports: generates PDF
- FastAPI Service → Search History: serves scan logs
- FastAPI Service → Threat Actors and Timeline: serves threat data
- FastAPI Service → Cyber Attacks Feed: serves attack feed
- FastAPI Service → Reddit View: serves Reddit data
- Workspace UI → Search History: opens saved scans
- Workspace UI → Threat Actors and Timeline: displays dossiers
- Workspace UI → Cyber Attacks Feed: displays feed
- Workspace UI → Reddit View: displays profiles
- Threat Actors and Timeline → Threat Data Sources: fetches threat data
- Cyber Attacks Feed → News Sources: fetches articles