xiry.

Development · GitHub repo

Robin

AI-powered dark web OSINT tool for automated querying and summaries

From the Xiry library · Updated 3 October 2026

Visit github.com ↗

Robin is an open-source OSINT investigation tool that searches dark web engines and aggregates findings using large language models. It refines queries, scrapes onion links over Tor, and returns organized markdown summaries and suggested pivot topics. It can run as a standalone Streamlit web UI or act as an MCP server for AI coding assistants.

What it's for

  • Investigate ransomware forum mentions and dark web data leaks safely
  • Summarize search engine results across .onion sites without manual Tor browsing
  • Connect dark web OSINT capabilities directly to Claude Code or Codex via MCP

Features

  • Automated query refinement and dark web search aggregation
  • Streamlit web interface for interactive investigations
  • Model Context Protocol (MCP) server support for AI agent integrations
  • Support for cloud LLMs (OpenAI, Anthropic, Gemini, Mistral) and local models via Ollama
  • Grounded follow-up questioning based on previous investigation data
  • One-click pivots suggested directly from findings
  • Sanitized page scraping over Tor to isolate untrusted content

Pricing

Open source. Free (MIT License); users provide their own LLM API keys or local models

Details

Type
GitHub repo
Category
Development
Topic
Cybersecurity & OSINT
Open source
Yes
Platforms
Self-hosted, Linux, macOS, Windows
For
OSINT researchers, threat intelligence analysts, and cybersecurity professionals
Tags
osint, darkweb, tor, cybersecurity, investigation, mcp, llm

Why it was saved

  • @carterperez.dev, 6 June 2026: Allows users to search and analyze ransomware forums and dark web content without needing to configure or browse through the Tor browser directly.

Related

  • AIMap

    Discovery and security testing platform for exposed internet-facing AI endpoints.

  • OpenOSINT

    AI OSINT agent, MCP server, and framework chaining intelligence tools

  • VoidAccess

    Self-hosted dark web OSINT tool for automated threat intelligence.

  • Firecrawl

    Turn websites and documents into clean, LLM-ready markdown or structured data.

  • AI/ML API

    Single API and playground for hundreds of multimodal AI models

  • Argus

    Python interactive CLI toolkit for automated OSINT, network reconnaissance, and security checks

Updated