Welcome to the CoSINT documentation wiki. Use the sections below to find what you need — whether you're getting started for the first time, tuning an investigation, or integrating CoSINT into your own workflow.

CoSINT is an AI-powered OSINT (Open Source Intelligence) investigation tool. It accepts a target — a domain, email address, username, IP, phone number, person name, company, or crypto wallet — and runs a structured, multi-stage investigation using 50+ tools. A subagent system splits complex investigations into focused workstreams, and a Report Synthesizer compiles all findings into a structured Markdown report with a machine-readable .case.json sidecar.

python cosint.py <target> [options]

# Domain investigation (quick scan, default)
python cosint.py example.com

# Deep scan of an email address
python cosint.py user@example.com --depth deep

# Person by name, passive only
python cosint.py "Jane Smith" --type person --passive-only

# Open-ended investigation with explore scope
python cosint.py @handle --open --scope-mode explore

Scope enforcement controls whether a tool call is on-target before it executes. Four modes are available, from fully deterministic to fully AI-driven:

See Scope Modes for the full pipeline breakdown and a mode comparison table.

CoSINT splits investigations into focused workstreams via a subagent system. The root agent dispatches specialized subagents — Infrastructure, Social, Email, Person, Leaks, Finance, and more — each with its own directive and toolset. At the end of every scan, the Report Synthesizer subagent assembles all findings into the final report.

See Subagents for the full reference, including reasoning-only subagents (Entity Resolution, Validator, Budget Guard, etc.) and the report structure the synthesizer always produces.

Every scan writes two files to reports/:

• report_<target>_<timestamp>.md — human-readable investigation report
• report_<target>_<timestamp>.case.json — full structured evidence record with per-tool-call metadata, artifact observations, scope decisions, and evidence IDs (EV-xxxx) that trace back to the Markdown report

See Reports & Evidence for the full field reference.

CoSINT can run as a standalone MCP server, exposing all tools directly to any MCP-compatible client — including Claude Desktop — without running a full CLI scan. Start it with:

python server.py

See MCP Server for Claude Desktop integration instructions, the full tool list by category, and session tracking details.