16 tagged cti, measured the same way as everything else here.
Browse within: ai-security 9bug-bounty 9bugcrowd 9claude-ai 9cybersecurity 7cyber-security 6cyber-threat-intelligence 6cyber-threat-tool 6cyber-threats 6
Agent
Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scopechecker.py for deterministic scope safety on every outbound request. Logs all requests to audit.jsonl.…
Agent
Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs without prompts) then HARD STOPS before /spray (live attack stage requires human go/no-go). Designed so the user only types the target once instead of orchestrating four separate commands.…
Agent
Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve exploits, authority retention, fake renounce, sandwich/MEV amplification). Runs tokenscanner.py for automated red flag detection. Covers EVM (Solidity) and Solana…
Agent Claude Code
Core intelligence analyst. Applies structured analytic techniques, performs threat actor profiling, campaign tracking, and produces analytical judgments. The analytical brain of the platform.
Agent Claude Code
Conducts open-source intelligence research using web search and web fetch. The ONLY agent with WebSearch and WebFetch access.
Agent Claude Code
Peer reviews intelligence products for accuracy, analytical rigor, proper sourcing, TLP compliance, and tradecraft quality. The quality gate before dissemination.
kevinmhorvath/threat-intel-toolkit
Agent
Defensive threat-intelligence analyst for IOC and vulnerability triage. Use PROACTIVELY whenever the user drops one or more indicators — an IP, domain, URL, or CVE — and wants to know if it's malicious, who's flagging it, how weaponized a CVE is, or how to prioritize it. Also use to build or refresh a local blocklist…