# bongoknight/cyberclip architecture

> Architecture diagram of the GitHub repository bongoknight/cyberclip, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bongoknight/cyberclip
- Repository: https://github.com/bongoknight/cyberclip

## Overview

Cyberclip is a cybersecurity text investigation tool: analysts provide text, Cyberclip detects and extracts observable types, then presents matching actions for transformation or enrichment. Its Textual TUI also supports recipes, configuration, and clipboard input; README-described optional interfaces include a Flask web UI and Qt radial menu. The README documents integrations such as UrlScan, OpenCTI, and VirusTotal. Some subsystems are represented by their exact enclosing directory because their implementation was not sampled; those relationships are left unverified where evidence is unavailable.

Main entry points: [`src/cyberclip/clipParser.py`](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/clipParser.py) (Parse and dispatch), [`src/cyberclip/app.py`](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/app.py) (Terminal UI), [`src/cyberclip/userAction/actionInterface.py`](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/actionInterface.py) (Action contract), [`src/cyberclip/userAction/CTIQueryAction.py`](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/CTIQueryAction.py) (CTI query builder)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interfaces["User interfaces"]
  node_tui["Terminal UI<br/>[app.py]"]
  node_web["Web interface<br/>[flask_app.py]"]
  node_radial["Radial menu<br/>[radialUI.py]"]
  node_content["Content view<br/>[ContentView.py]"]
  node_type_panel["Type panel<br/>[DataTypePannel.py]"]
  node_action_panel["Action panel<br/>[ActionPannel.py]"]
  node_recipe_panel["Recipe editor<br/>[RecipesPannel.py]"]
end

subgraph group_analysis["Text analysis"]
  node_dispatcher["Parse and dispatch<br/>[clipParser.py]"]
  node_parser_catalog["Observable parsers"]
  node_domain_parser["Domain parser<br/>[domainParser.py]"]
  node_parser_contract["Parser contract<br/>[ParserInterface.py]"]
end

subgraph group_operations["Actions and recipes"]
  node_action_catalog["Action modules"]
  node_action_contract["Action contract<br/>[actionInterface.py]"]
  node_recipes["Recipe execution<br/>[RecipesPannel.py]"]
end

subgraph group_integrations["External enrichment"]
  node_cti_queries["CTI query builder<br/>[CTIQueryAction.py]"]
end

subgraph group_runtime["Runtime support"]
  node_clipboard["Clipboard input"]
  node_data_paths["Data paths<br/>[data_paths.py]"]
  node_utilities["Shared utilities<br/>[utilities.py]"]
end

node_analyst(("Analyst"))
node_urlscan{{"UrlScan"}}
node_opencti{{"OpenCTI"}}
node_virustotal{{"VirusTotal"}}

node_analyst -->|"uses"| node_tui
node_analyst -.->|"uses optionally"| node_web
node_analyst -.->|"uses optionally"| node_radial
node_tui -->|"loads and applies"| node_dispatcher
node_tui -->|"composes"| node_content
node_content -->|"composes"| node_action_panel
node_content -->|"composes"| node_type_panel
node_tui -->|"composes"| node_recipe_panel
node_clipboard -.->|"supplies text"| node_tui
node_type_panel -->|"reads clipboard"| node_clipboard
node_dispatcher -->|"discovers parsers"| node_parser_catalog
node_dispatcher -->|"discovers actions"| node_action_catalog
node_domain_parser -->|"implements"| node_parser_contract
node_action_catalog -->|"implements"| node_action_contract
node_action_contract -->|"uses parser interface"| node_parser_contract
node_action_panel -->|"applies action"| node_dispatcher
node_recipe_panel -->|"runs recipe steps"| node_dispatcher
node_recipe_panel -->|"configures actions"| node_action_contract
node_dispatcher -->|"loads configuration"| node_data_paths
node_parser_catalog -->|"uses helpers"| node_utilities
node_cti_queries -->|"extends"| node_action_contract
node_cti_queries -.->|"formats queries for"| node_urlscan
node_cti_queries -.->|"formats queries for"| node_opencti
node_action_catalog -.->|"enriches via"| node_virustotal

click node_tui "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/app.py"
click node_web "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/flask_app.py"
click node_radial "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/radialUI.py"
click node_content "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/ContentView.py"
click node_type_panel "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/DataTypePannel.py"
click node_action_panel "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/ActionPannel.py"
click node_recipe_panel "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/RecipesPannel.py"
click node_clipboard "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/clipboardHandler.py"
click node_dispatcher "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/clipParser.py"
click node_parser_catalog "https://github.com/bongoknight/cyberclip/tree/main/src/cyberclip/userTypeParser"
click node_domain_parser "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userTypeParser/domainParser.py"
click node_parser_contract "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userTypeParser/ParserInterface.py"
click node_action_catalog "https://github.com/bongoknight/cyberclip/tree/main/src/cyberclip/userAction"
click node_action_contract "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/actionInterface.py"
click node_cti_queries "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/CTIQueryAction.py"
click node_recipes "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/RecipesPannel.py"
click node_data_paths "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/data_paths.py"
click node_utilities "https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/utilities.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_tui,node_web,node_radial,node_content,node_type_panel,node_action_panel,node_recipe_panel toneBlue
class node_dispatcher,node_parser_catalog,node_domain_parser,node_parser_contract toneAmber
class node_action_catalog,node_action_contract,node_recipes toneMint
class node_cti_queries toneRose
class node_clipboard,node_data_paths,node_utilities,node_analyst,node_urlscan,node_opencti,node_virustotal toneIndigo
```

## Components

### User interfaces

- [Terminal UI](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/app.py): `src/cyberclip/app.py`
- [Web interface](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/flask_app.py): `src/cyberclip/flask_app.py`
- [Radial menu](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/radialUI.py): `src/cyberclip/radialUI.py`
- [Content view](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/ContentView.py): `src/cyberclip/tui/ContentView.py`
- [Type panel](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/DataTypePannel.py): `src/cyberclip/tui/DataTypePannel.py`
- [Action panel](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/ActionPannel.py): `src/cyberclip/tui/ActionPannel.py`
- [Recipe editor](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/RecipesPannel.py): `src/cyberclip/tui/RecipesPannel.py`

### Text analysis

- [Parse and dispatch](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/clipParser.py): `src/cyberclip/clipParser.py`
- [Observable parsers](https://github.com/bongoknight/cyberclip/tree/main/src/cyberclip/userTypeParser): `src/cyberclip/userTypeParser`
- [Domain parser](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userTypeParser/domainParser.py): `src/cyberclip/userTypeParser/domainParser.py`
- [Parser contract](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userTypeParser/ParserInterface.py): `src/cyberclip/userTypeParser/ParserInterface.py`

### Actions and recipes

- [Action modules](https://github.com/bongoknight/cyberclip/tree/main/src/cyberclip/userAction): `src/cyberclip/userAction`
- [Action contract](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/actionInterface.py): `src/cyberclip/userAction/actionInterface.py`
- [Recipe execution](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/tui/RecipesPannel.py): `src/cyberclip/tui/RecipesPannel.py`

### External enrichment

- [CTI query builder](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/userAction/CTIQueryAction.py): `src/cyberclip/userAction/CTIQueryAction.py`

### Runtime support

- [Clipboard input](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/clipboardHandler.py): `src/cyberclip/clipboardHandler.py`
- [Data paths](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/data_paths.py): `src/cyberclip/data_paths.py`
- [Shared utilities](https://github.com/bongoknight/cyberclip/blob/main/src/cyberclip/utilities.py): `src/cyberclip/utilities.py`

### Other components

- **Analyst**
- **UrlScan**
- **OpenCTI**
- **VirusTotal**

## Connections

- Analyst → Terminal UI: uses
- Analyst → Web interface: uses optionally
- Analyst → Radial menu: uses optionally
- Terminal UI → Parse and dispatch: loads and applies (evidence: `src/cyberclip/app.py`)
- Terminal UI → Content view: composes (evidence: `src/cyberclip/app.py`)
- Content view → Action panel: composes (evidence: `src/cyberclip/tui/ContentView.py`)
- Content view → Type panel: composes (evidence: `src/cyberclip/tui/ContentView.py`)
- Terminal UI → Recipe editor: composes (evidence: `src/cyberclip/app.py`)
- Clipboard input → Terminal UI: supplies text (evidence: `src/cyberclip/app.py`)
- Type panel → Clipboard input: reads clipboard (evidence: `src/cyberclip/tui/DataTypePannel.py`)
- Parse and dispatch → Observable parsers: discovers parsers (evidence: `src/cyberclip/clipParser.py`)
- Parse and dispatch → Action modules: discovers actions (evidence: `src/cyberclip/clipParser.py`)
- Domain parser → Parser contract: implements (evidence: `src/cyberclip/userTypeParser/domainParser.py`)
- Action modules → Action contract: implements (evidence: `src/cyberclip/userAction/__init__.py`)
- Action contract → Parser contract: uses parser interface (evidence: `src/cyberclip/userAction/actionInterface.py`)
- Action panel → Parse and dispatch: applies action (evidence: `src/cyberclip/app.py`)
- Recipe editor → Parse and dispatch: runs recipe steps (evidence: `src/cyberclip/tui/RecipesPannel.py`)
- Recipe editor → Action contract: configures actions (evidence: `src/cyberclip/tui/RecipesPannel.py`)
- Parse and dispatch → Data paths: loads configuration (evidence: `src/cyberclip/clipParser.py`)
- Observable parsers → Shared utilities: uses helpers (evidence: `src/cyberclip/userTypeParser/CSVParser.py`)
- CTI query builder → Action contract: extends (evidence: `src/cyberclip/userAction/CTIQueryAction.py`)
- CTI query builder → UrlScan: formats queries for
- CTI query builder → OpenCTI: formats queries for
- Action modules → VirusTotal: enriches via