Threat Intelligence Python Packages

pycti

Open Cyber Threat Intelligence Platform

dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

bbot

The recursive internet scanner for hackers. 🧡

vulners

Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.

ail-typo-squatting

Generate list of potential typo squatting domains with domain name permutation engine to feed AIL and other systems.

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

flare-capa

The FLARE team's open-source tool to identify capabilities in executable files.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

anyrun-sdk

Simplify integration with ANY.RUN REST API services

user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

ftagent

Flowtriq DDoS Detection Agent. Real-time traffic monitoring, incident detection, PCAP capture, and auto-mitigation

pysafebrowsing

Python 3 Google Safe Browsing library

greynoise

Python3 library and command line for GreyNoise

stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-utils

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

openosint

AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.

stix-shifter-modules-splunk

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

google-secops-mcp

Google SecOps MCP server

ethicore-engine-selfhost

Ethicore Engine® is an AI safety, ethics, and compliance platform. This repo consists of the open-source components of Ethicore Engine™ - Guardian SDK; designed to protect your AI applications from prompt injection, jailbreaks, role hijacking, system-prompt extraction, and 100+ additional threat categories through a multi-layer analysis pipeline

stix-shifter-modules-elastic-ecs

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

vt-mcp

Official VirusTotal MCP server for AI agents: threat intelligence, file analysis, and recovery through VTAI.

stix-shifter-modules-azure-sentinel

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

firepit

Firepit - STIX Columnar Storage