Command Reference

Command Reference

OSINT Forge has four command families: framework management, single-adapter execution, batch execution, and durable case management.

Global

osint --help
osint --version

Framework management

osint forge list [--installed | --available] [--json]
osint forge search QUERY
osint forge info TOOL [--json]
osint forge categories
osint forge install TOOL... [--dry-run] [--yes] [--force]
osint forge update TOOL... [--dry-run] [--yes] [--force]
osint forge remove TOOL... [--dry-run] [--yes] [--force]
osint forge doctor [TOOL...]
osint forge validate [--json]
osint forge version

Unknown tools and invalid plugin contracts are rejected. Lifecycle dry-runs preview commands without executing them.

Run one adapter

osint run PLUGIN {domain,email,file,image,ip,username} TARGET \
  [--output PATH] [--dry-run]

Adapter availability depends on the plugin's declared target types. Targets are validated and passed as argument-array elements, not interpolated shell strings.

Batch processing

osint batch [INPUT] [--name NAME] [--output-root PATH] \
  [--plugins TOOL...] [--jobs 1-8] [--dry-run]

The default input is ~/.config/osint-forge/targets.txt. See Batch Workflows.

Case management

osint case create CASE --purpose TEXT --authorization TEXT
osint case add CASE {address,domain,email,file,image,ip,name,phone,username} TARGET
osint case plan CASE --workflow PROFILE [--json] [-o PATH]
osint case run CASE [--plugins TOOL... | --workflow PROFILE] [--jobs 1-8] [--rerun] [--dry-run]
osint case search CASE ADAPTER
osint case observe CASE PROVIDER INPUT
osint case intelligence CASE [--json]
osint case integrity {create,verify} CASE [--json]
osint case export CASE --mode {full,redacted} -o PATH
osint case inspect BUNDLE [--json]
osint case import BUNDLE
osint case status CASE [--json]
osint case entities CASE [--json]
osint case report CASE [--format {markdown,json,html,csv,all}] \
  [--shareable] [--output PATH] [--force]
osint case findings CASE [--json]
osint case annotate CASE FINDING_ID [--confidence {unverified,low,medium,high}] \
  [--note TEXT | --clear-note]

Name, phone, address, and osint case entities are stable features. In v0.5, the entity projection combines canonical seeds with deterministic candidate entities emitted by schema-2 plugin contracts while preserving every source reference. They are valid case seeds, but the single-adapter osint run command accepts only target types supported by released adapters. Normalized reports, findings, annotations, and shareable redaction are documented in Reporting. See Case Management.

Exit behavior

Commands return nonzero status for validation failures, unknown tools, failed lifecycle operations, malformed case data, and failed jobs. Dry-run output is a preview and does not mark case jobs successful.

Roadmap note

v0.8 delivers versioned provider execution and ingestion, evidence-backed correlation, scoped confidence, verification and temporal states, and deterministic intelligence inspection. v0.9 is the next committed waypoint: bounded recursive discovery, dynamic next-action selection, budgets, approvals, stopping rules, benchmarks, and v1 contract freeze. See Roadmap.

Guided interface and advanced commands

At v1.0:

osint

launches the complete guided interface.

All explicit advanced commands remain available for experienced users, scripts, automation, and AQAD, including:

osint case ...
osint run ...
osint batch ...
osint forge ...

Bare launch is additive; it does not replace, hide, or deprecate the advanced CLI. Both interfaces coordinate the same internal operations. See Interactive UI for the full guided-workflow contract.