cti-case
Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case <CASE-ID> <seed>…
Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status
$ npx -y skills add 7onez/cti-expert --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
/cti-statusContext preview
What this command does when you run it.
Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status
name: cti-status description: "Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status"
Load the `cti-expert` skill, then report the runtime state.
python3 scripts/backend/backend.py status # tier + $INTEL_HOME resolution python3 scripts/backend/intel.py list # every dispatchable op python3 scripts/backend/intel.py cases # what is in the case store python3 scripts/backend/intel.py api-usage # metered credits spent python3 scripts/proxy/proxy.py status # egress proxy / rotation pool (if configured)
Expected: `Tier 2 (CLI) — $INTEL_HOME=<repo>/intel_engine (via in-repo (self-contained))`.
Check in order:
1. **Backend resolves?** If not, `$INTEL_HOME` is wrong or the vendored engine is missing. 2. **MCP server live?** `/mcp` should list the `intel` server. If it is absent, generate the registration with `python3 scripts/backend/intel.py mcp --write` — `.mcp.json` is git-ignored and per-machine by design. 3. **One case store?** Everything lives in `$INTEL_HOME/cases/`. A `cases/` directory at the repo root is always a mistake and makes ingestion silently find nothing. 4. **Credits?** WhoisXML bills Whois History and Reverse WHOIS to the **Domain Research Suite** balance, not the WHOIS API balance. Zero DRS returns 200 for current WHOIS and 403 for both of those — a valid key that looks broken.
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
Repo: 7onez/cti-expert
Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case <CASE-ID> <seed>…
False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check <indicator>
Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>
Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage: /cti-pivot <url|domain|ip>…
Manage the egress proxy / rotation pool for the skill's HTTP(S) requests (keyless crt.sh, Wayback, urlscan, CLD, WHOIS, /apikeys test; raw TLS/JARM probes need…
Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>