Threat intelligence · AI agent
AI OSINT Security Analyzer
An AI agent that investigates IP addresses, domains, CVEs and software versions across several threat-intelligence sources, then writes an evidence-based security assessment. By default, Cohere's Command A+ model decides which tools to run (Command A and Command A Reasoning can also be chosen), and every finding in the report is tied back to the source that produced it.
- Python
- Streamlit
- Cohere Command A+
- Shodan
- VirusTotal
- AbuseIPDB
- NVD
- CISA KEV
- FIRST EPSS
Screenshots
1 / 6
Key facts, summary and findings
A Comprehensive Investigation of scanme.nmap.org with Command A+. The Key facts are computed in code from the data sources, so they are identical on every run. Below them, the AI rates the overall risk and starts a findings table in which every row names the source behind it.
2 / 6
Vulnerabilities sorted by confidence
CVEs are Confirmed only when NVD's affected-version ranges include the exact version found. The rest are Related, Needs review or Ruled out, and exploitation status comes from CISA KEV and EPSS.
3 / 6
Recommendations, limitations and evidence
Prioritized fixes, the analysis's own limitations, Markdown and JSON exports, and every tool call the agent made with its timing.
4 / 6
Looking up a single CVE
Log4Shell (CVE-2021-44228): CVSS 10.0, listed in CISA's Known Exploited Vulnerabilities catalog, and an EPSS exploit probability of 99.99%.
5 / 6
Exploitation status and fixes
When the CVE was added to CISA KEV, its EPSS score, prioritized fixes, the report's own limitations, and the two tool calls behind it.
6 / 6
API keys stay in your session
Keys entered in the app live only in that browser session's server memory. They are never written to disk or shared with other visitors.
Screenshots from a local run against scanme.nmap.org, a server the Nmap project provides for testing security tools, and against CVE-2021-44228 (Log4Shell). Click a screenshot to open it full size. Use the arrows, or select the gallery and press ← →.
How it works
- Classify the input as an IP, domain, CVE or software version, rejecting anything invalid or non-public.
- Baseline lookups in code: for IPs and domains, DNS, Shodan, VirusTotal and AbuseIPDB always run before the AI starts, so core coverage never depends on the model. Shodan results are checked against CISA KEV automatically.
- Investigate: the agent chooses further tools (NVD version check, NVD lookup, CISA KEV, keyword search) within a per-run budget. Duplicate calls are served from cache.
- Verify versions: CVEs come from NVD's CPE match API and are re-checked locally against each affected range, so
nginx 1.20.1isn't reported as vulnerable to a bug fixed in 1.20.1. The minimum safe version is computed from the range ends. - Report: code builds the Key facts, and the model writes the summary, findings, details, recommendations and limitations, citing a source for every claim.
Security decisions
- Per-session API keys. Keys entered in the UI never reach environment variables or disk and are never shared between users. Server keys stay on the server and are only used when sharing is turned on, with hourly caps.
- Safe rendering. Reports contain third-party text such as service banners, so raw HTML is never rendered and remaining
[,]and<are escaped. Hidden links and remote images that could leak a viewer's IP can't survive. - Prompt-injection hardening. Tool output is treated as untrusted data inside escaped data blocks, size-capped before it reaches the model, and the model can't override server-side limits through tool arguments.
- Input validation. Private, loopback, link-local and CGNAT addresses are rejected, and CVE IDs, domains and IPs are validated before any API call.
- No leaks in logs. Error messages are scrubbed of API key values, stack traces are hidden from visitors, usage stats are off, and analyzed targets aren't written to server logs.
- Facts separate from AI text. The Key facts box is computed from the data sources, so the most important numbers don't depend on the model getting them right.