Every OSINT query has two audiences: you, and whoever operates the resolver, the API, and the log pipeline behind it.
If collection runs in someone else's cloud, your target list is shared. That can be acceptable, but it is an OPSEC choice that must be intentional. The industry default is convenience: analysts paste a domain into a web form, then debate TTPs in the final report. The primary TTP—where the query actually executed—gets ignored.
A local toolkit keeps the first hop honest. DNS, WHOIS, certificate transparency, and passive IP enrichment rely on public data. There is no technical reason this data must transit a third-party vendor before reaching your notes.
spy runs these checks locally:
python3 s.py run dns_deep example.com
python3 s.py run whois_osint example.com
python3 s.py run cert_transparency example.com
python3 s.py intel 1.2.3.4 --json
Active probes are gated. Without a defined scope, execution is blocked. This applies the same principle used in senior agent harnesses: no tool call without limits.
Use a hosted scanner like mago.team when you need broad coverage without managing infrastructure. Use a local pipeline when target lists are sensitive or when methodologies must survive vendor lock-in.
Convenience is not a strategy. Choose your approach deliberately.
spy
OSINT and reconnaissance. The method is the pipeline.
spy encodes DNS, WHOIS, certificate transparency, identity correlation, and public threat feeds as named passes that run on your machine. No account No SaaS hop unless you choose one.
Authorized targets only.
Why spy
Most OSINT is still a shopping list in someone's head. Open this registrar. Query that CT log. Remember SPF. The sequence dies when the analyst is tired.
A checklist that cannot be executed the same way twice is folklore.
spy treats collection as a pipeline: stable order, stable output, inspectable steps. You can drop a stage. You can rerun last quarter and diff the JSON. You can refuse to send the target to a third party.
That last point is OPSEC, not preference. Every query has two audiences: you, and whoever logs the resolver.
Install
Python 3.11+.
git clone https://github.com/rxkov/spy.git
cd spy
python3 -m venv .venv
…
