Map a domain's public technical footprint with provenance, confidence, and explicit uncertainty. Passive by default, machine-readable, and built to report evidence, not guesses.
This repository also configures its own agents. See what recon tells them →
Skill Claude CodeCodex
Triage recon fingerprint candidates across the bounded DNS catalog surface. Reads private single-domain discovery output, aggregate catalog baselines, or candidate queues, then classifies candidates as pending, promoted, rejected, or deferred under the v2.14 catalog-quality gates. Use when the user asks to find…
Skill Claude CodeCodex
Public-metadata domain intelligence - Microsoft 365 / Google Workspace tenant identification, email security configuration (DMARC, DKIM, SPF, MTA-STS, BIMI), SaaS fingerprinting from DNS, certificate-transparency findings, related-domain discovery. Use when a domain name appears alongside phrases like "what does use"…
Skill Claude CodeCodex
Run or evaluate a bounded recon catalog-maintenance round from a frozen private corpus and manifest, preserving source availability, holdout separation, and promotion evidence. Use for maintainer collection and validation, not ordinary lookup or automatic catalog expansion.
Skill Claude CodeCodex
Plan a private, reproducible domain corpus for recon catalog development, an independent holdout, or a drift round. Use for maintainer sampling and corpus design, not ordinary domain lookups or live collection.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: