ZettelForge
An in-process agentic memory system for cyber threat intelligence that extracts CVEs, threat actors and indicators from analyst notes into a STIX knowledge graph and serves past cases back through MCP.
ZettelForge is built to keep a security team's investigation context from leaving with a departing analyst. It extracts CVEs, threat actors, indicators of compromise and MITRE ATT&CK techniques from analyst notes and threat reports, resolves aliases across naming conventions, such as recognizing that several names refer to the same threat actor, and builds a STIX 2.1 knowledge graph connecting them, all running in-process with no API keys, cloud dependency or data leaving the host.
Because it is purpose-built for cyber threat intelligence rather than general-purpose memory, it understands domain-specific concepts a general memory system does not, such as parsing Sigma or YARA rules and recognizing ATT&CK technique identifiers, and retrieves memories through intent-aware blended search rather than plain semantic search over chat history. It serves past investigations back to analysts directly and to Claude Code through an MCP server, installs from pip, and has an optional extra that exposes it as CrewAI tools.