Skip to content
Security
Command

/cti-status

Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status

From plugin
cti-expert
6249 skills9 commands2 hooks
$ npx -y skills add 7onez/cti-expert --agent claude-code

Command definition

cti-status.md
name: cti-status
description: "Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status"

/cti-status — health check

Load the `cti-expert` skill, then report the runtime state.

python3 scripts/backend/backend.py status      # tier + $INTEL_HOME resolution
python3 scripts/backend/intel.py list          # every dispatchable op
python3 scripts/backend/intel.py cases         # what is in the case store
python3 scripts/backend/intel.py api-usage     # metered credits spent
python3 scripts/proxy/proxy.py status          # egress proxy / rotation pool (if configured)

Expected: `Tier 2 (CLI) — $INTEL_HOME=<repo>/intel_engine (via in-repo (self-contained))`.

Check in order:

1. **Backend resolves?** If not, `$INTEL_HOME` is wrong or the vendored engine is missing. 2. **MCP server live?** `/mcp` should list the `intel` server. If it is absent, generate the registration with `python3 scripts/backend/intel.py mcp --write` — `.mcp.json` is git-ignored and per-machine by design. 3. **One case store?** Everything lives in `$INTEL_HOME/cases/`. A `cases/` directory at the repo root is always a mistake and makes ingestion silently find nothing. 4. **Credits?** WhoisXML bills Whois History and Reverse WHOIS to the **Domain Research Suite** balance, not the WHOIS API balance. Zero DRS returns 200 for current WHOIS and 403 for both of those — a valid key that looks broken.

Read more
@7onez
Ships withcti-expert

CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.

Stars on GitHub

Momentum

stars in total
624
Star history of 7onez/cti-expert on GitHub, a chart by star-history.com

Other commands on cti-expert.

cti-case

cti-case

Command

Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment.…

@7onez@7onezInstall Command
cti-check

cti-check

Command

False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage:…

@7onez@7onezInstall Command
cti-cluster

cti-cluster

Command

Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>

@7onez@7onezInstall Command
cti-pivot

cti-pivot

Command

Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage:…

@7onez@7onezInstall Command
cti-proxy

cti-proxy

Command

Manage the egress proxy / rotation pool for the skill's HTTP(S) requests (keyless crt.sh, Wayback, urlscan, CLD, WHOIS, /apikeys…

@7onez@7onezInstall Command
cti-recall

cti-recall

Command

Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall…

@7onez@7onezInstall Command

More commands from other plugins.

deslop-reborn

deslop-reborn

Command

One iteration of the IronClaw Reborn de-slop loop — take ONE Reborn crate, fan out parallel review sub-agents (thermo-nuclear…

ironclaw13d13k
@nearai@nearaiInstall Command
audit

audit

Command

Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…

@trailofbits@trailofbitsInstall Command
arsenal

arsenal

Command

Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…

@awarexone@awarexoneInstall Command