Skip the afternoon of digging — fifteen OSINT tools already researched, 
and whatever you add 
goes with the file to whoever opens it next.
Skip the afternoon of digging — fifteen OSINT tools already researched, and whatever you add goes with the file to whoever opens it next.OSINT — open-source intelligence: finding out about a person, company or domain from public data. This is a registry of the tools that do it.
Download
↓
Open HTML
↓
Use it
BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.zip — 12.7 KB · MIT · nothing to install
What's in the file
──────────────────
15 tools already researched — site, docs, repo, licence, auth, alive-or-dead, evidence link
a lifecycle for each: NEW → REVIEW → TESTING → APPROVED / REJECTED / DEPRECATED
edit anything, add your own, then EXPORT — the new file carries everything you added
Below, three lanes — open the one you came for
──────────────────────────────────────────────
📦 THE FILE what it is · what a record holds · the 15 inside · search/edit
· why edits travel with the file · runs offline
🧠 THE THINKING evidence ≠ interpretation · privacy & authorization
· correlation ≠ proof · where this fits
🤝 WHAT'S NEXT what he wants from you · status · MIT · what's in the zip
I have been doing a lot of research lately into OSINT tools, APIs, agents, scanners, data providers, and the rapidly growing number of AI-assisted investigation projects appearing everywhere.
After looking at enough of them, I realized something:
We probably do not need another giant OSINT scanner.
We need a better way to evaluate, organize, compare, document, and eventually integrate the good tools that already exist.
So I built this.
THE FILE
THE FILE📋 What it is — the evaluation flow
➜ What is the BCBC OSINT Tools Evaluation Registry?
The BCBC OSINT Tools Evaluation Registry is a completely standalone HTML application designed to help researchers evaluate OSINT tools and providers before integrating them into a larger workflow.
It is not a scanner.
It does not automatically investigate anyone.
It does not phone home to BCBC.
It is essentially an evidence-oriented research and engineering notebook that runs in your browser.
The idea is simple:
OSINT tool discovered
↓
Identify what it actually does
↓
Find the OFFICIAL project
↓
Find the documentation / API
↓
Find the source repository
↓
Check license / terms
↓
Determine authentication requirements
↓
Check whether the project is still alive
↓
Record evidence
↓
Evaluate it
↓
TEST
↓
APPROVE / REJECT / DEPRECATE
↓
Only THEN consider integration
That last part became very important to me.
There are a tremendous number of excellent projects available already.
Instead of constantly rebuilding mature plumbing, I want BCBC projects to sit above proven tools, preserve their evidence, and make their output easier for humans and AI systems to understand.
🗂️ What every record holds, and the lifecycle
➜ What v3 Includes
The current release contains 15 researched provider/tool records.
Each record can contain:
→ Tool / provider name
→ Current evaluation status
→ Intended role
→ BCBC integration decision
→ Official website
→ Documentation / API link
→ Source repository
→ License / terms information
→ Authentication / access requirements
→ Project activity / maintenance notes
→ Evidence/reference URL
→ Last verified date
→ Free-form evaluation notes
→ Searchable tags
➜ Current Evaluation States
Every tool can move through a simple lifecycle:
NEW
│
▼
REVIEW
│
▼
TESTING
│
├──────────────► REJECTED
│
├──────────────► DEPRECATED
│
▼
APPROVED
This keeps “interesting project I found on the Internet” separate from:
“We actually evaluated this and are comfortable depending on it.”
🔍 The 15 tools inside — and why the dead ones stay
➜ Some of the Tools Currently in the Registry
The release currently contains research records covering projects/providers such as:
Orchestration / Automated OSINT
→ OpenOSINT
→ SpiderFoot
→ Taranis AI
Social / Identity Supporting Evidence
→ OWASP SocialOSINTAgent
Phone Research
→ PhoneInfoga
Domain / DNS / Infrastructure
→ SecurityTrails
→ RIPEstat
→ BGPView — retained as a deprecated historical entry
Exposure / Breach Information
→ Have I Been Pwned
Graph / Correlation
→ Maltego
Network Discovery
→ Nmap
Tool Discovery / Taxonomy
→ OSINT Framework
Domain / Company Recon
→ theHarvester
Website Technology Evidence
→ BuiltWith
Internet-Facing Asset Context
→ Shodan
➜ An Important Example: Dead Projects Matter Too
One thing I specifically wanted this registry to handle is tool decay.
An OSINT list from two years ago may point you toward something that no longer exists.
That is exactly the kind of thing that wastes hours when building automation.
For example:
BGPView
↓
Previously useful BGP / ASN provider
↓
Service discontinued
↓
Registry status = DEPRECATED
↓
Replacement candidate = RIPEstat
Instead of quietly deleting BGPView, I intentionally preserve the record.
Why?
Because this tells the next developer or AI agent:
We already investigated this. Do not waste another afternoon rediscovering why it doesn’t work.
That is institutional memory.
✏️ Search it, edit it, it's yours
➜ Search and Filtering
The registry can be searched instantly.
You can search things such as:
DNS
API
social
graph
open-source
authorized-only
You can also filter the complete registry by status:
→ New
→ Review
→ Testing
→ Approved
→ Rejected
→ Deprecated
➜ Every Record is Editable
The supplied entries are not intended to be a sacred database.
They are starting research.
You can:
→ Edit existing records
→ Add providers
→ Delete providers
→ Change status
→ Add notes
→ Add evidence
→ Update links
→ Add tags
→ Record new licensing information
→ Change architectural decisions
It becomes your own research registry.
➜ It Saves Locally
Edits can be stored locally by the browser.
There is no BCBC server required.
No account.
No database.
No installation.
Open the HTML file.
Use it.
📤 Why your edits travel with the file
➜ But There Was a Problem With Browser-Local Storage…
This is something I specifically fixed before releasing it.
Originally the registry stored edits using browser localStorage.
That is great while working locally…
…but terrible if you spend hours editing the registry and then email the original HTML file to somebody.
Your changes stay in YOUR browser.
They do not magically travel with the file.
So v3 now includes:
➜ EXPORT STANDALONE HTML
This is probably my favorite feature in the release.
You can edit the registry…
Original Registry
↓
Add tools
↓
Change statuses
↓
Add research
↓
Add evidence
↓
Add notes
↓
CLICK:
Export Standalone HTML
↓
New HTML file generated
↓
CURRENT REGISTRY DATA IS EMBEDDED
↓
Give that file to somebody else
Now the research actually travels with the document.
That makes this useful as a portable research artifact rather than merely a browser application.
➜ Other Export Options
The registry also supports:
JSON Export
Useful for:
→ automation
→ scripts
→ databases
→ APIs
→ AI agents
→ future BCBC Workbench integration
Markdown Report Export
Useful for:
→ Discourse
→ GitHub
→ documentation
→ project handoff
→ research notes
Standalone HTML Export
Useful for:
→ sharing
→ archiving
→ offline use
→ transferring your current registry state
Useful for:
→ PDF
→ hard-copy review
→ audit trail
→ project documentation
🔌 Runs offline, nothing to install
➜ It Is Designed To Work Offline
The application itself is just HTML + CSS + JavaScript.
No framework.
No npm install.
No Docker container.
No server.
No database.
No cloud account.
No login.
Download
↓
Open HTML
↓
Use it
That is the deployment procedure. 
THE THINKING
THE THINKING📐 Evidence is not interpretation — the core rule, and why
➜ The Core Design Rule
The most important rule in this project is:
Evidence production and AI interpretation are two different things.
A tool may tell us:
Domain registered: 2012-04-18
An AI might interpret that as:
The domain has existed for more than a decade,
which is generally more consistent with an established organization.
Those are NOT the same thing.
The original evidence should remain intact.
So the BCBC model looks more like:
┌──────────────────────┐
│ OSINT PROVIDER │
│ API / TOOL / DATA │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ RAW EVIDENCE │
│ │
│ Provider │
│ Timestamp │
│ Version │
│ Result │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ BCBC EVIDENCE LAYER │
│ │
│ VERIFIED │
│ CONTRADICTED │
│ UNKNOWN │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ AI INTERPRETATION │
│ │
│ Explanation │
│ Correlation │
│ Suggested next check │
└──────────────────────┘
The AI should never silently replace the original evidence.
➜ Why I Built It
One of the problems I keep seeing with AI-assisted research is that a system can produce an extremely convincing answer while hiding where the underlying facts came from.
That becomes dangerous very quickly.
I want a research system where somebody can ask:
“Why did the system say that?”
And the answer can actually be shown.
CLAIM
↓
SOURCE
↓
PROVIDER
↓
RAW RESULT
↓
TIME COLLECTED
↓
INTERPRETATION
That chain matters.
Especially when OSINT is eventually used for things like:
→ recruiter verification
→ company verification
→ domain research
→ infrastructure research
→ fraud detection
→ security work
→ threat intelligence
→ technical due diligence
🛡️ Privacy · authorization · correlation is not proof
➜ Privacy
The registry itself does not investigate targets.
It is an evaluation database for tools.
That distinction is intentional.
REGISTRY
│
├── Stores research
├── Stores evaluation decisions
├── Stores links
├── Stores evidence references
└── DOES NOT automatically investigate targets
If you later launch or integrate one of the listed third-party tools, then that tool has its own behavior, privacy implications, licenses, and terms.
Those should be evaluated separately.
➜ Authorization Matters
Some OSINT tools are passive.
Some are not.
Some query third-party datasets.
Some perform active network discovery.
So the registry deliberately includes an authorization boundary.
For example:
Public information lookup
↓
Generally passive research
versus
Network scanning
↓
Only systems you own
OR
systems you have explicit authorization to test
Putting everything under the label “OSINT” does not magically make every activity passive or authorized.
➜ Correlation Is NOT Identity Proof
This is another BCBC rule I care about.
Suppose we discover:
Same name
+
Same company
+
Same username
+
Similar photograph
That may be useful evidence.
It is NOT automatically proof that two records represent the same human being.
So BCBC tries to preserve three states:
VERIFIED
CONTRADICTED
UNKNOWN
instead of forcing every result into:
TRUE
FALSE
The real world is usually messier than that.
🏗️ Where this fits — one evidence layer, many tools
➜ Why This Exists Alongside the Recruiter Reality Check
Some people here may remember the BCBC Job & Recruiter Reality Check project I have also been working on.
That project was actually part of what pushed me toward this architecture.
Instead of building:
Recruiter Tool
↓
500 hard-coded OSINT integrations
I would rather eventually have:
BCBC OSINT WORKBENCH
│
┌─────────────┼──────────────┐
│ │ │
▼ ▼ ▼
Domain Data Social Data Phone Data
│ │ │
└─────────────┼──────────────┘
│
▼
EVIDENCE LAYER
│
┌────────────┼─────────────┐
│ │ │
▼ ▼ ▼
Recruiter Security Research
Reality Tools Tools
Check
One evidence architecture.
Many specialized applications.
That is the direction.
➜ The Bigger Idea
I am increasingly convinced that the important part of AI systems is not merely:
“Which model are you using?”
It is the machinery surrounding the model.
TOOLS
↓
EVIDENCE
↓
PROVENANCE
↓
MEMORY
↓
REASONING
↓
HUMAN REVIEW
Models will change.
APIs will change.
Companies will change.
Projects will disappear.
What should survive is the evidence and the reasoning trail explaining:
What did we know, where did we get it, and why did we make that decision?
That is what I am trying to build toward.
WHAT’S NEXT
WHAT’S NEXT🙋 What he wants from you
➜ What I Would Like From the Community
This is being released because I would rather people use it, improve it, and tell me where it is wrong than have it sitting on my drive forever waiting for some imaginary perfect version.
If you know of:
→ a better provider
→ a dead provider I missed
→ a better API
→ an incorrect license entry
→ a free alternative
→ a stronger open-source project
→ a useful OSINT category
→ something that should absolutely NOT be integrated
→ a privacy concern
→ a provenance problem
→ an architectural improvement
Please post it.
That is exactly what the registry is for.
➜ I Especially Want Help Finding Good Deterministic Providers
AI is great at interpretation.
But whenever possible, I want the evidence underneath it to come from something deterministic.
For example:
QUESTION:
"When was this domain registered?"
BAD ARCHITECTURE:
Ask AI to guess from Internet context.
BETTER ARCHITECTURE:
RDAP / WHOIS provider
↓
Raw registration date
↓
Preserve evidence
↓
AI explains what the date may mean
That separation is extremely important to me.
✅ Status · MIT · what's in the zip
➜ Free To Use / Modify / Improve
The registry application code is released under the MIT License.
Use it.
Modify it.
Fork it.
Add your own providers.
Teach with it.
Turn it into something better.
Give it away again.
Third-party tools, APIs, trademarks, documentation, and services naturally remain under their respective licenses and terms.
No third-party binaries are bundled with the registry.
➜ Included With the Release
The downloadable package contains:
BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.html
│
├── Standalone application
│
├── Built-in research registry
│
├── Search / filters
│
├── Record editor
│
├── JSON export
│
├── Markdown export
│
├── Standalone HTML export
│
└── Print / PDF support
│
├── README
│
└── MIT License
➜ Current Status
[✓] Standalone browser application
[✓] Search
[✓] Status filtering
[✓] Editable records
[✓] Local persistence
[✓] JSON export
[✓] Markdown export
[✓] Portable standalone HTML export
[✓] Print / PDF
[✓] Research/provider links populated
[✓] License/access fields added
[✓] Maintenance/activity fields added
[✓] Deprecated-provider tracking
[✓] Public-use warning
[✓] MIT release
[ ] Community testing
[ ] More provider research
[ ] Provider adapter prototype
[ ] OSINT Workbench integration
That last part is where you guys come in.
➜ Download
The BCBC OSINT Tools Evaluation Registry v3 standalone HTML / release package is attached to this post.
Download it.
Open it in your browser.
No installation required.
And if you improve it, please share what you changed so everybody can benefit.
BCBC Technology
Evidence before confidence.
Do not rebuild the plumbing if good plumbing already exists.
Preserve the WHY.
Credits
Built through ongoing BCBC research and development.
Mikey_LikesIT + ChatGPT
Released freely for the community to use, study, modify, test, and improve.
Enjoy it. 
BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.zip (12.7 KB)
!