A fast, modular, terminal-based OSINT framework — built entirely on lawful, publicly available sources.
IntelCLI aggregates WHOIS, DNS, TLS, HTTP-header, geolocation, and public-platform data into a single, attractive terminal experience. It is designed for security researchers, developers, and analysts who need quick, structured reconnaissance without leaving the command line.
Lawful by design. IntelCLI only ever talks to publicly documented protocols and endpoints — the standard WHOIS protocol (port 43), public DNS, a site's own HTTPS endpoint, and free/public geolocation and lookup APIs. It never scrapes in violation of a site's terms of service, brute-forces credentials, or attempts any form of unauthorized access.
| Area | What it does |
|---|---|
| Domain | WHOIS, DNS records (A/AAAA/MX/NS/TXT/CNAME/SOA), SSL/TLS certificate inspection, HTTP security-header grading, lightweight technology detection |
| IP | Reverse DNS, geolocation (city/region/country/ISP/ASN), private-range detection |
| Syntax validation, MX/DNS deliverability signals, disposable-domain flagging | |
| Username | Concurrent presence checks across a dozen public platforms (GitHub, GitLab, Reddit, PyPI, Docker Hub, and more) |
| Company | Public company/organization lookup via Clearbit Autocomplete and (optionally) OpenCorporates |
| Report | Auto-detects the target type and runs the appropriate unified investigation |
| History | Every investigation is logged locally to SQLite and browsable/searchable |
| Export | JSON, CSV, and HTML export for every command |
| Config | TOML-based configuration for optional API keys, stored with restrictive file permissions |
All output renders as polished Rich tables with progress spinners, colored status indicators, and graceful error handling — a single failed data source never aborts the whole investigation.
pip install intelcli
intelcli domain example.com
intelcli ip 8.8.8.8
intelcli email user@example.com
intelcli username torvalds
intelcli report example.com # auto-detects the target typeSee docs/installation.md for full setup instructions
and docs/usage.md for detailed examples of every command.
$ intelcli domain python.org
WHOIS - python.org
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Field ┃ Value ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ domain_name │ PYTHON.ORG │
│ registrar │ MarkMonitor Inc. │
│ creation_date │ 1995-03-27 05:00:00 │
│ name_servers │ ns-1134.awsdns-13.org, ns-2046.awsdns-63.co.uk │
└───────────────────┴────────────────────────────────────────────────────┘
DNS Records - python.org
┏━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ A ┃ 151.101.0.223, 151.101.64.223, 151.101.128.223, 151.101.192.223┃
┃ MX ┃ 50 mail.python.org ┃
┗━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
...
IntelCLI follows a strict layered architecture (cli → commands → services → models/storage/utils) so that business logic never depends on the presentation
layer. See docs/architecture.md for the full design
rationale, module map, and extension points.
git clone https://github.com/intelcli/intelcli.git
cd intelcli
pip install -e ".[dev]"
pytest --cov=intelcli --cov-report=term-missing # 172 tests, 93%+ coverage
ruff check .
black --check .
mypy srcSee CONTRIBUTING.md for coding standards, the PR process,
and how to add a new command or service.
IntelCLI is an aggregator of information that is already public. You are responsible for using it in compliance with all applicable laws and the terms of service of any site or API it queries on your behalf. Do not use IntelCLI to harass, stalk, or harm any individual.
MIT — see the LICENSE file for details.