Loading ToolBench
A multi-tier research skill system for Claude that performs OSINT, web scraping, and synthesis across L1-L5 research levels with optional Codex cross-model integration
Deep Research is a bash-based OSINT toolkit with 16 tools. While tool names follow verb_noun patterns (osint-research, entity-classifier, crtsh, wayback, etc.), descriptions are present but often lack LLM-optimized clarity. Most critically, input schemas are visible in the provided documentation but lack formal JSON Schema structure in the actual tool definitions, they appear as informal parameter lists. Parameter descriptions exist but are often terse (10-30 chars), below the 50-200 char baseline for A+ tools. No output schemas are documented. Error handling is minimal, tools exit silently on missing data rather than guiding recovery. The codebase shows defensive bash practices (set -uo pipefail, fixture support for testing) but does not expose structured error messages to the MCP client.
Fault-tolerant wrapper around Codex CLI for cross-model research synthesis. Handles timeouts, auth failures, rate limits, and disabled state gracefully. Writes output to file with status/log sidecars
Queries Certificate Transparency (crt.sh) for SSL/TLS certificate entries to discover subdomains. Accepts domain/company targets and optional fixture for testing
Generates Google dork queries for reconnaissance. Emits one dork per line. Validates targets against a blocklist to prevent abuse
Classifies a raw input string into one of: domain, ip, email, person, company, github. Handles quoted strings, IPv4/IPv6, email regex, domain detection, and explicit --company flag
Assigns CRITICAL/HIGH/MEDIUM/LOW priority levels to OSINT findings based on channel type, record type, and content patterns (e.g., leaked secrets, critical ports, suspicious subdomains)
Searches GitHub code for leaked credentials, API keys, and sensitive data matching a target. Uses GitHub CLI (gh) if available, with secret redaction
No formal JSON Schema definitions visible in source code. Tool parameters documented informally (target, type, fixture) but lack explicit type, required, enum, and constraint declarations. Cannot verify schema compliance.
Output schemas not documented. Tools return NDJSON, JSON, or plaintext but no structured schema is provided to LLMs. Agents cannot plan downstream calls or extract fields reliably.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2026-07-28+ | v2 |
Filters OSINT findings by blocklist (default + user-supplied via OSINT_EXTRA_BLOCKLIST). Drops results from blocklisted hosts (pastebin, breach forums, leak databases, etc.). Reports filtered count on stderr
Syncs L5 ultra-research knowledge vault to user's Obsidian vault with wiki-links, YAML frontmatter, tags, and graph-view integration. Optional — skips silently if OBSIDIAN_VAULT not set
Shared utility functions for OSINT skill: slug generation (sanitized + timestamp) and artifact directory resolution
OSINT research skill that classifies entities (domain, IP, email, person, company, github) and runs parallel OSINT channels (crtsh, wayback, shodan-idb, github-leaks, subfinder, theHarvester, whois-dns, dorks) with findings extraction and blocklist filtering
Queries Shodan's free InternetDB endpoint for open ports, CVEs, and hostnames on an IP address. No authentication required
Wraps the optional subfinder CLI tool to discover subdomains via passive DNS and certificate data. Silent no-op if CLI not installed
Wraps the optional theHarvester CLI tool to discover emails and subdomains via DuckDuckGo. Silent no-op if CLI not installed
Shared verification library for L1-L5 research skills. Validates artifact structure, citation traceability, source counts, word counts, and checkpoint progression across research tiers
Queries Wayback Machine (archive.org) for historical snapshots and CDX availability data. Accepts domain/company targets and optional fixture
Queries WHOIS and DNS records (A, AAAA, NS, MX, TXT, SOA, PTR) for domains and IPs. Uses whois and dig CLI tools if available
Parameter descriptions are terse (10-30 chars). Baseline for A+ tools is 50-200 chars. E.g., 'The entity to research' lacks format, constraints, and examples. LLMs cannot infer valid inputs.
No error handling guidance. Tools exit silently on missing data (e.g., 'empty crt.sh produces no output'). LLMs receive no recovery hints, should return 'No certificates found. Try a different domain or check domain validity.'
Tool composition risk: osint-research orchestrates 8 parallel channels (crtsh, wayback, shodan-idb, github-leaks, subfinder, theHarvester, whois-dns, dorks) but no documented contract for channel output format or failure modes. If one channel fails, unclear how osint-research handles it.