Command Reference

Command Reference

OSINT Forge has four command families: framework management, single-adapter execution, batch execution, and durable case management.

Global

osint --help
osint --version

Framework management

osint forge list [--installed | --available] [--json]
osint forge search QUERY
osint forge info TOOL [--json]
osint forge categories
osint forge install TOOL... [--dry-run] [--yes] [--force]
osint forge update TOOL... [--dry-run] [--yes] [--force]
osint forge remove TOOL... [--dry-run] [--yes] [--force]
osint forge doctor [TOOL...]
osint forge validate [--json]
osint forge version

Unknown tools and invalid plugin contracts are rejected. Lifecycle dry-runs preview commands without executing them.

Run one adapter

osint run PLUGIN {domain,email,file,image,ip,username} TARGET \
  [--output PATH] [--dry-run]

Adapter availability depends on the plugin's declared target types. Targets are validated and passed as argument-array elements, not interpolated shell strings.

Batch processing

osint batch [INPUT] [--name NAME] [--output-root PATH] \
  [--plugins TOOL...] [--jobs 1-8] [--dry-run]

The default input is ~/.config/osint-forge/targets.txt. See Batch Workflows.

Case management

osint case create CASE --purpose TEXT --authorization TEXT
osint case add CASE {address,domain,email,file,image,ip,name,phone,username} TARGET
osint case run CASE [--plugins TOOL...] [--jobs 1-8] [--rerun] [--dry-run]
osint case status CASE [--json]
osint case entities CASE [--json]
osint case report CASE [--format {markdown,json,html,csv,all}] \
  [--shareable] [--output PATH] [--force]
osint case findings CASE [--json]
osint case annotate CASE FINDING_ID [--confidence {unverified,low,medium,high}] \
  [--note TEXT | --clear-note]

Name, phone, address, and osint case entities are stable v0.4 features. They are valid case seeds, but the single-adapter osint run command accepts only target types supported by released adapters. Normalized reports, findings, annotations, and shareable redaction are documented in Reporting. See Case Management.

Exit behavior

Commands return nonzero status for validation failures, unknown tools, failed lifecycle operations, malformed case data, and failed jobs. Dry-run output is a preview and does not mark case jobs successful.

Roadmap note

Later committed releases add entity-aware extraction and planning; they do not silently change today's adapters. New execution and recursion behavior will be versioned, bounded, auditable, and documented before release. See Roadmap.