Repository navigation
Roadmap
OSINT Forge is moving from a governed OSINT tool orchestrator into a search-first, evidence-preserving intelligence engine with a complete guided operator interface.
Commitment boundary: v0.9 through v1.0 is the remaining committed delivery plan. v0.8.0 is released. The complete interactive UI is a firm v1.0 release gate and will be delivered as one cohesive implementation, not as partial v0.9.x UI releases. Post-v1.0 ideas remain tentative.
Simply run:
osintThe interface must guide a user through creating or opening a case, adding and reviewing starting information, running the investigation, monitoring recursive discovery, resolving ambiguous matches, reviewing findings, generating reports, and safely pausing, saving, resuming, or exiting.
The governing usability principle is:
If you can read, you can run OSINT Forge.
Users of the guided interface must not need to memorize commands or plugin names, edit JSON/YAML/text files, manage directories, or possess prior OSINT knowledge.
The advanced command interface remains fully supported for experienced operators, scripts, automation, and AQAD:
osint case create CASE
osint case add CASE TYPE VALUE
osint case run CASE
osint batch ...
osint run ...The guided UI and advanced CLI coordinate the same application services and investigation engine. The UI is not a separate implementation, and advanced users are never required to enter the menus.
- Search providers discover candidate pages, identities, accounts, contact points, organizations, and relationships.
- Forge preserves source evidence and extracts structured observations.
- Correlation evaluates source independence, agreement, contradiction, and temporal consistency.
- Existing OSINT plugins verify or enrich candidates when a compatible tool exists.
- If no verifier exists, Forge bypasses that step, scores the remaining evidence, and labels the finding tool-unverified.
- Confidence and verification status remain separate.
- The planner queues the next highest-value authorized action.
- The loop stops when no viable lead remains or a scope, budget, approval, or confidence boundary is reached.
- v0.1–v0.3.1: modular plugins, lifecycle management, batch processing, private cases, provenance, reporting, and security hardening.
- v0.4.0: normalized multi-format reports, analyst annotations, and canonical seed entities.
- v0.5.0: entity-aware plugin contracts, deterministic candidate extraction, theHarvester, and exact-commit QA.
- v0.6 planning layer: shipped inside v0.7.0 with versioned workflows, deterministic multi-seed plans, explainable selection, and bounded execution.
- v0.7.0: SHA-256 integrity manifests, deterministic full/redacted exports, independent inspection, safe import, provenance bindings, and comprehensive release validation.
- v0.8.0: explicit provider execution and offline ingestion, deterministic intelligence graph, evidence-backed relationships, source-independence analysis, contradictions, temporal assessment, scoped confidence, and verification-status logic.
| Release | Status | Committed outcome |
|---|---|---|
| v0.9 | Planned | Bounded recursive lead enumeration, dynamic next-action selection, budgets, approvals, stopping rules, benchmarks, hardening, and v1 contract freeze |
| v1.0 | Planned | Stable seed → search → correlate → verify when possible → recurse → report workflow, plus the complete guided interactive UI as a mandatory release gate while preserving the advanced CLI |
v1.0 is not complete until the guided interface provides:
- One-question-at-a-time case creation and seeding with immediate validation
- Create, open, recent, resume, recovery, and safe-exit case navigation
- Add, review, edit, remove, deduplicate, and bulk-import starting information
- Plain-language investigation planning, settings, plugin compatibility, and bounded safety controls
- Recursive progress monitoring with truthful pause, resume, stop, cancellation, and recovery behavior
- Ambiguous-match accept, reject, and defer workflows
- Findings, source evidence, confidence, contradictions, and verification displays
- Final report browsing and generation
- Keyboard-only, narrow-terminal, no-color, EOF, invalid-input, and first-run usability coverage
- Registry-driven extensibility so ordinary new targets and plugins do not require bespoke menu surgery
- Full regression compatibility for all existing advanced commands and automation
Internal engineering checkpoints may be used for development and QA, but they are not partial public releases or claims of completion.
Forge will distinguish verified, contradicted, inconclusive, tool_unavailable, tool_failed, not_applicable, and not_attempted.
Tool absence is not a failed verification; tool failure is neither confirmation nor contradiction.