ogi is a self-hostable, open-source visual link analysis and OSINT framework that lets authorized investigators enrich entities with DNS, WHOIS, and SSL transforms on an interactive graph.
| Tool | khashashin/ogi — open-source visual link analysis and OSINT framework, AGPL-3.0, Python/TypeScript |
| Category | OSINT / link-analysis platform |
| Primary Use | Building interactive entity-relationship graphs during authorized investigations, enriching domains, IPs, emails, and hashes via 20+ built-in transforms |
| Safe Use | Intended for authorized security assessments, corporate threat-intel teams, and research labs performing passive OSINT collection against publicly available data |
| Telemetry Note | Ships with installation-level telemetry controlled by OGI_TELEMETRY_ENABLED; self-hosters can set it to false or reduce it to basic. Collection events and query logs on third-party APIs leave external traces; self-hosted instances concentrate investigation data in SQLite/PostgreSQL |
ogi, styled as OpenGraph Intel, positions itself as a free, self-hostable alternative to commercial link-analysis workbenches. At roughly 307 stars on GitHub, it is a young but actively evolving project released under AGPL-3.0, written in Python on the backend and TypeScript on the frontend. The maintainers are candid about maturity: the README carries an explicit heads-up that documentation, hardening, and feature depth are still improving release by release. That honesty matters for operators deciding whether to run it against real case data or keep it in the lab for now.
Architecturally, ogi is a modern split-stack application. The backend is a FastAPI service exposing an API on port 8000, the frontend is a React 19 single-page app, and the heavy lifting of enrichment is delegated to asynchronous workers. A Redis 7 instance backs an RQ job queue, and a dedicated worker process — started via python -m ogi.worker.run_worker — executes transforms out of band, streaming progress back to the browser over WebSocket. This is a deliberate design choice: slow external lookups never block the API server, and the UI can render partial results as they arrive.
The core investigative workflow is a drag-and-drop graph canvas. Investigators add entities — domains, IPs, emails, hashes, social identifiers — and apply what ogi calls transforms: enrichment steps covering DNS, WHOIS, SSL certificate lookups, geolocation, and web/email/hash/social enrichment, with more than twenty built in. The results become new nodes and edges, so the graph grows organically as the investigation proceeds. Built-in graph analytics extend this beyond collection: centrality measures, community detection, and shortest-path algorithms help an analyst decide which node is worth pivoting on next rather than staring at a hairball.
The most interesting design decision is the Transform Hub. Community transforms live in a separate registry repository (opengraphintel/ogi-transforms) and can be browsed and installed from the UI or managed via the bundled CLI (ogi --help after a uv pip install -e .). Plugins are discovered directory-by-directory with YAML manifests, and prebuilt container images will install plugin Python dependencies at boot from plugins/requirements.txt or an auto-generated lockfile. For a team, this means the platform can be extended with internal transforms without forking the core — though it also means every installed plugin is code running inside your investigation environment, so vet community plugins before installing them on sensitive cases.
The AI Investigator is the headline differentiator. It is an optional, provider-backed agentic workflow: you configure a model provider in the settings dialog, store API keys in the dedicated API Keys store, and run a separate agent-worker process (python -m ogi.agent.run_worker) alongside the backend. The agent plans transform sequences, requests approvals before executing steps, streams progress live, and summarizes findings with what the README calls auditability. The approval gate is the right instinct for agentic OSINT — an analyst stays in the loop before the tool fires queries at third-party services, which limits both cost surprises and unintended data exposure.
Deployment flexibility is a strong theme. For a solo analyst, ogi runs in zero-config local mode with SQLite, requiring only Python 3.14+, uv, Node.js 20+, and pnpm. For teams, it scales to PostgreSQL (with Alembic migrations applied automatically at startup when OGI_USE_SQLITE=false) plus Supabase for projects, sharing, and real-time collaboration via Supabase Realtime. Docker is first-class: docker compose up brings the full stack including built-in PostgreSQL 16 and Redis 7, while docker-compose.prod.yml uses prebuilt GHCR images and expects you to supply an external database via OGI_DATABASE_URL. Pin OGI_IMAGE_TAG in .env to avoid surprise upgrades.
One detail in the README deserves operator attention before the first launch: telemetry. ogi collects installation-level product telemetry by default, governed by OGI_TELEMETRY_ENABLED and OGI_TELEMETRY_LEVEL. The full level sends version, a daily active-install ping, aggregate counts of projects, entities, edges, transform and investigator runs, plus installed transform versions. The maintainers state that graph contents, entity values, API keys, and prompts are never transmitted, but for investigative work even aggregate counts can be sensitive metadata — most self-hosters running authorized engagements will want OGI_TELEMETRY_ENABLED=false or at minimum OGI_TELEMETRY_LEVEL=basic from day one.
Resource governance is also thought through. Per-transform caps such as max_results, max_links, max_urls, and max_content_chars are centrally overridable through OGI_TRANSFORM_SETTING_MAX_OVERRIDES, and the override applies both to built-in transforms and to community plugins built on the shared transform runtime. This matters in two directions: cloud or shared deployments can clamp limits to control blast radius and cost, while a local-first analyst can set individual caps to none. It is a small setting, but it reflects that the authors have operated the tool under real constraints.
Those constraints come into focus in the hosting section. A hosted cloud instance at ogi.khas.app has become the most popular way to use the project — over 350 active cloud users — which led the maintainer to introduce a Stripe-backed Supporter subscription at USD 3/month plus a transform-run cooldown for free cloud users. Importantly for defenders and auditors, the billing code is configuration-guarded: it activates only when OGI_DEPLOYMENT_MODE=cloud and OGI_CLOUD_BILLING_ENABLED=true, so self-hosted deployments see no paywalls. The AGPL-3.0 license and the clean separation of the commercial layer from the self-hostable core keep the trust model coherent.
Operationally, there are sharp edges worth knowing. The README is unusually candid that Redis alone is not enough — a separate worker process is required, and errors like Job queue not available are almost always misconfigured OGI_REDIS_URL, a worker that is not running, or using the Docker-only hostname redis outside Compose. The AI Investigator needs its own agent-worker, so a full local setup is three processes plus the database. These are the normal taxes of a queue-based architecture, but anyone automating a lab build should script all of them.
From a defensive perspective, ogi is best understood as a passive-OSINT aggregation and visualization layer. Its transforms consume publicly available records — DNS, WHOIS, certificate transparency-style cert data, geolocation — which means its footprint is a pattern of lookups against third-party APIs rather than direct interaction with a target's infrastructure. That makes it well suited to authorized investigations, due-diligence research, and threat-intel work where the requirement is to correlate public traces without touching the subject's systems. Blue teams should still note that self-hosted instances become repositories of case data; protect the SQLite/PostgreSQL backend and the Supabase configuration accordingly.
For anyone who has wanted Maltego-style link analysis without the licensing friction, ogi is one of the more complete open answers currently emerging. The combination of an interactive graph, a pluggable transform registry, queue-based execution, real-time collaboration, and an approval-gated AI investigator covers most of the workflow a small OSINT team needs. Run it self-hosted with telemetry trimmed, treat the Transform Hub as untrusted extension code until reviewed, and pin your images — then it earns its place in an authorized investigation toolkit.
khashashin/ogi.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.