CTI Expert
CTI Expert is a Cyber Threat Intelligence and OSINT analysis skill for Claude Code and Codex that adds more than 120 investigation commands and case-tracking to turn the agent into an intelligence analyst, with most core functions needing no paid API keys.
CTI Expert packages cyber threat intelligence and open-source intelligence tradecraft as a skill for Claude Code and Codex, with over 120 commands and 57 documented techniques covering reconnaissance, digital forensics and investigation workflows, run through a deterministic case pipeline and reports formatted to the ICD-203 intelligence-community standard.
Its typed tools are reachable both directly and as Model Context Protocol tools, and several are backed by data and services from named intelligence partners, including a URL and threat-intelligence denylist and CVE and known-exploited-vulnerability feeds, infostealer-infection intelligence, dark-web and initial-access-broker monitoring, malware sandboxing, passive DNS, leaked-data and darknet search, internet-host and certificate scanning, and passive website scanning.
It is written in Python, and core functionality does not require any API keys.