# SSG REAPER OSINT

**One tool. Full operator kit. Turnkey.**

Local OSINT kit for authorized research, threat intelligence enrichment, and defensive investigations. Native GUI, CLI, and MCP — Python 3.10+ with **zero pip dependencies**.

Public brand: **SSG REAPER**. YouTube: [@SSGReaper](https://www.youtube.com/@SSGReaper).

> Scope: passive / public-source by default. No phishing, malware, C2, credential theft, or exploit execution.

---

## 60-second start (Windows)

1. Install [Python 3.10+](https://www.python.org/downloads/) and enable **Add Python to PATH**.
2. Double-click **`install.bat`** once.
3. Launch the **Legion OSINT** desktop shortcut (or `LegionOSINT.bat`).
4. Browser opens at **http://127.0.0.1:8899**.

```bash
git clone https://github.com/SSGREAPER/mrholmes-osint-suite.git
cd mrholmes-osint-suite
python -m legion gui          # GUI + vault
python -m legion status       # health
python -m legion example.com  # auto-investigate any target
```

---

## What you get

| Surface | Entry | Purpose |
|--------|--------|---------|
| **GUI** | `python -m legion gui` | Tactical dashboard, quick investigate, vault |
| **CLI** | `python -m legion …` | Scriptable JSON tools |
| **MCP** | `python -m legion mcp` | Single agent tool for Grok / local agents |
| **Vault** | `.legion/legion.db` | Targets, sessions, runs, findings, IOCs |

### Built-in kit (native, not third-party clones)

| Tool | Does |
|------|------|
| `investigate` | Detect type → multi-tool pipeline |
| `username` | Public profile presence probes |
| `social` / `people` | Platform maps, name leads |
| `domain` | DNS, TLS, HTTP, RDAP |
| `subdomains` | Passive CT via crt.sh |
| `ip` | PTR, geo hint, HTTP probe |
| `email` / `phone` | Normalize + mail/host leads + dorks |
| `dorks` | Google / Bing / DDG dork generator |
| `hash` | Identify / decode / local wordlist crack |
| `darkweb` | Ahmia onion-index search + blacklist check |
| `url` | Header / title probe |
| `ioc` | Extract IPs, domains, URLs, emails, hashes |
| `knowledge` | Built-in playbooks & checklists |
| `report` | Markdown BLUF skeleton |

---

## CLI examples

```bash
python -m legion tools
python -m legion detect user@example.com
python -m legion investigate example.com --save
python -m legion run domain example.com
python -m legion run username jdoe --save
python -m legion run dorks acme.com --kind domain
python -m legion run hash 5d41402abc4b2a76b9719d911017c592 --mode hash-type
python -m legion run darkweb ransomware --limit 5
python -m legion run ioc "contact admin@evil.test from 203.0.113.8"
python -m legion run knowledge username
```

---

## MCP

```json
{
  "mcpServers": {
    "legion": {
      "command": "python",
      "args": ["-m", "legion", "mcp"],
      "cwd": "/absolute/path/to/mrholmes-osint-suite"
    }
  }
}
```

Send one JSON object per line, for example:

```json
{"action":"run","tool":"domain","target":"example.com"}
```

Actions: `status`, `catalog`, `manifest`, `run`, `runs`.

---

## Safety model

- Loopback-only HTTP server (`127.0.0.1`).
- No shell invocation for kit tools (in-process).
- Passive defaults; no port scans, no mail VRFY, no Tor auto-start.
- Wordlist cracking confined to `.legion/wordlists`.
- Evidence receipts (SHA-256) stored with every saved run.
- See `docs/ETHICS_AND_SCOPE.md` and `SECURITY.md`.

---

## Layout

```
legion/               ← the product
  kit/                ← native tools
  web/                ← GUI
  knowledge/          ← playbooks
  app.py cli.py store.py mcp_server.py
legacy_archive/       ← previous wrapper-suite snapshot (not required)
install.bat           ← one-time Windows setup
LegionOSINT.bat/.vbs  ← launchers
```

---

## Requirements

- Python **3.10+**
- Network access for live modules (domain, username, darkweb, CT, RDAP)
- No `pip install` required for core operation

---

## License

MIT — see `LICENSE`.

Use only with authorization. Public-source intelligence is still subject to law, ToS, and ethics.