pip install requests[socks] beautifulsoup4 python-dotenv stem
apt install tor && tor &
cp .env.example .env   # add one API key (or use Ollama — no key needed)
python sicry.py check  # → CONNECTED via Tor  |  exit IP: 185.220.101.5

apt install tor
tor &

brew install tor
tor &

cat > /tmp/sicry_tor.conf << 'EOF'
SocksPort 9050
ControlPort 9051
CookieAuthentication 1
DataDirectory /tmp/tor_data
EOF

tor -f /tmp/sicry_tor.conf &

pip install -r requirements.txt

pip install requests[socks] beautifulsoup4 python-dotenv stem

# Optional — only needed if using the MCP server
pip install mcp

# Optional — only needed if using OpenAI/Anthropic/Gemini LLM backends
pip install openai          # for OpenAI
pip install anthropic       # for Anthropic/Claude
pip install google-generativeai  # for Gemini

cp .env.example .env

# No-key option (local inference):
LLM_PROVIDER=ollama
OLLAMA_MODEL=llama3.2

# OpenAI:
LLM_PROVIDER=openai
OPENAI_API_KEY=sk-...

# Anthropic:
LLM_PROVIDER=anthropic
ANTHROPIC_API_KEY=sk-ant-...

# Gemini:
LLM_PROVIDER=gemini
GEMINI_API_KEY=AIza...

# Verify Tor is running
python sicry.py check
# → CONNECTED via Tor  |  exit IP: 185.220.101.5  |  error: None

# Search the dark web
python sicry.py search "ransomware data leak" --max 10

# Fetch a .onion page
python sicry.py fetch http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion

# Print tool schemas for your framework
python sicry.py tools                     # Anthropic format (default)
python sicry.py tools --format openai     # OpenAI format
python sicry.py tools --format gemini     # Gemini format

# Rotate Tor identity
python sicry.py renew

# Start MCP server (for Claude Desktop / Cursor / Zed)
python sicry.py serve

import sicry

# Verify Tor
print(sicry.check_tor())
# → {"tor_active": True, "exit_ip": "185.220.101.5", "error": None}

# Search
results = sicry.search("credential dump")
# → [{"title": "...", "url": "http://...onion/...", "engine": "Ahmia"}, ...]

# Fetch
page = sicry.fetch("http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion")
# → {"url": "...", "is_onion": True, "status": 200, "title": "Ahmia", "text": "...", "links": [...]}

r = sicry.check_tor()
# {"tor_active": True, "exit_ip": "185.220.101.5", "error": None}
# {"tor_active": False, "exit_ip": None, "error": "connection refused"}

r = sicry.renew_identity()
# {"success": True, "error": None}

r = sicry.fetch("http://somemarket.onion/listings")
# {
#   "url":      "http://somemarket.onion/listings",
#   "is_onion": True,
#   "status":   200,
#   "title":    "Market Listings",
#   "text":     "Plain text, HTML stripped, up to 8000 chars",
#   "links":    [{"text": "Link label", "href": "http://..."}, ...],  # up to 80 links
#   "error":    None
# }

# All 18 engines in parallel
results = sicry.search("leaked database credentials")
# [{"title": "...", "url": "http://...onion/...", "engine": "Ahmia"}, ...]

# Specific engines only
results = sicry.search("ransomware", engines=["Ahmia", "Tor66", "Ahmia-clearnet"])

# More results
results = sicry.search("bitcoin mixer", max_results=50)

pages = sicry.scrape_all(search_results[:10])
# {
#   "http://site1.onion/page": "Page Title - full page text...(truncated)",
#   "http://site2.onion/page": "Page Title - full page text",
#   ...
# }
combined = "\n\n".join(pages.values())

q = sicry.refine_query("I want to find ransomware groups that targeted hospitals in 2026")
# → "hospital ransomware 2026 leak"

q = sicry.refine_query("has acme.com appeared in any data breaches")
# → "acme.com breach credentials"

best = sicry.filter_results("hospital ransomware 2026", raw_results)
# Returns at most 20 results, selected by the LLM for relevance

report = sicry.ask(
    content="\n\n".join(pages.values()),
    query="hospital ransomware groups",
    mode="ransomware",
)
print(report)  # Structured report: indicators, TTPs, threat actor profile, next steps

# Add custom focus to any mode
report = sicry.ask(
    content,
    mode="threat_intel",
    custom_instructions="Focus on cryptocurrency wallets and mixer services",
)

results = sicry.check_search_engines()
# [
#   {"name": "Ahmia",  "status": "up",   "latency_ms": 1240, "error": None},
#   {"name": "Kaizer", "status": "down", "latency_ms": None, "error": "timeout"},
#   ...
# ]

live = [r for r in results if r["status"] == "up"]
print(f"{len(live)}/18 engines alive")
fastest = min(live, key=lambda x: x["latency_ms"])
print(f"Fastest: {fastest['name']} ({fastest['latency_ms']}ms)")

import sicry

sicry.TOOLS         # Anthropic / Claude format (input_schema)
sicry.TOOLS_OPENAI  # OpenAI function-calling format (type: "function")
sicry.TOOLS_GEMINI  # Google Gemini function declarations

python sicry.py tools                   # Anthropic (default)
python sicry.py tools --format openai
python sicry.py tools --format gemini

result = sicry.dispatch(tool_name, tool_input)
# Returns: dict | list | str  (matches the tool's documented return type)
# Raises:  ValueError if tool_name is unknown

import anthropic, sicry, json

client = anthropic.Anthropic()
messages = [{"role": "user", "content": "Search dark web for recent credential leaks from banks"}]

while True:
    resp = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=4096,
        system="You are a dark-web OSINT analyst. Always verify Tor before searching.",
        tools=sicry.TOOLS,              # <- Anthropic format
        messages=messages,
    )

    if resp.stop_reason != "tool_use":
        print(next(b.text for b in resp.content if hasattr(b, "text")))
        break

    tool_results = []
    for block in resp.content:
        if block.type == "tool_use":
            result = sicry.dispatch(block.name, block.input)
            tool_results.append({
                "type": "tool_result",
                "tool_use_id": block.id,
                "content": json.dumps(result, default=str),
            })

    messages.append({"role": "assistant", "content": resp.content})
    messages.append({"role": "user",      "content": tool_results})

from openai import OpenAI
import sicry, json

client = OpenAI()
messages = [
    {"role": "system", "content": "You are a dark-web OSINT analyst."},
    {"role": "user",   "content": "Has acme.com appeared in any dark web leaks?"},
]

while True:
    resp = client.chat.completions.create(
        model="gpt-4o",
        tools=sicry.TOOLS_OPENAI,       # <- OpenAI format
        messages=messages,
    )
    msg = resp.choices[0].message
    messages.append(msg)

    if not msg.tool_calls:
        print(msg.content)
        break

    for call in msg.tool_calls:
        result = sicry.dispatch(
            call.function.name,
            json.loads(call.function.arguments),
        )
        messages.append({
            "role": "tool",
            "tool_call_id": call.id,
            "content": json.dumps(result, default=str),
        })

import google.generativeai as genai
import sicry, json

genai.configure(api_key="YOUR_GEMINI_API_KEY")

model = genai.GenerativeModel(
    "gemini-2.5-flash",
    tools=[{"function_declarations": sicry.TOOLS_GEMINI}],   # <- Gemini format
    system_instruction="You are a dark-web OSINT analyst.",
)

chat = model.start_chat()
resp = chat.send_message("Find mentions of acme.com on dark web forums")

while True:
    fn_calls = [p.function_call for p in resp.parts
                if hasattr(p, "function_call") and p.function_call.name]
    if not fn_calls:
        for part in resp.parts:
            if hasattr(part, "text"):
                print(part.text)
        break

    tool_responses = []
    for fn_call in fn_calls:
        result = sicry.dispatch(fn_call.name, dict(fn_call.args))
        tool_responses.append(
            genai.protos.Part(
                function_response=genai.protos.FunctionResponse(
                    name=fn_call.name,
                    response={"result": json.dumps(result, default=str)},
                )
            )
        )
    resp = chat.send_message(tool_responses)

from langchain.tools import StructuredTool
from langchain.agents import initialize_agent, AgentType
from langchain_openai import ChatOpenAI
import sicry

tools = [
    StructuredTool.from_function(name="sicry_check_tor",
        func=sicry.check_tor,
        description="Verify Tor is active. Call before any dark web operation."),
    StructuredTool.from_function(name="sicry_renew_identity",
        func=sicry.renew_identity,
        description="Rotate Tor circuit — new exit node and identity."),
    StructuredTool.from_function(name="sicry_fetch",
        func=sicry.fetch,
        description="Fetch any URL or .onion hidden service via Tor."),
    StructuredTool.from_function(name="sicry_search",
        func=lambda query, max_results=20: sicry.search(query, max_results=max_results),
        description="Search 18 dark web engines. Returns title/url/engine list."),
    StructuredTool.from_function(name="sicry_ask",
        func=sicry.ask,
        description="Analyse dark web content. mode: threat_intel|ransomware|personal_identity|corporate"),
    StructuredTool.from_function(name="sicry_check_engines",
        func=sicry.check_search_engines,
        description="Ping all 18 search engines. Returns status + latency per engine."),
]

agent = initialize_agent(
    tools,
    ChatOpenAI(model="gpt-4o"),
    agent=AgentType.OPENAI_FUNCTIONS,
    verbose=True,
)
agent.run("Search the dark web for ransomware activity targeting the healthcare sector")

from crewai import Agent, Task, Crew
from langchain.tools import StructuredTool
import sicry

sicry_tools = [
    StructuredTool.from_function(name="sicry_check_tor",
        func=sicry.check_tor,
        description="Verify Tor is active."),
    StructuredTool.from_function(name="sicry_search",
        func=lambda query: sicry.search(query, max_results=20),
        description="Search 18 dark web engines."),
    StructuredTool.from_function(name="sicry_fetch",
        func=sicry.fetch,
        description="Fetch any .onion URL via Tor."),
    StructuredTool.from_function(name="sicry_ask",
        func=sicry.ask,
        description="LLM OSINT analysis. mode: threat_intel|ransomware|personal_identity|corporate"),
    StructuredTool.from_function(name="sicry_check_engines",
        func=sicry.check_search_engines,
        description="Ping all 18 search engines. Returns status + latency."),
]

analyst = Agent(
    role="Dark Web OSINT Analyst",
    goal="Investigate dark web threats and produce structured intelligence reports",
    backstory="Expert in dark web monitoring and threat intelligence",
    tools=sicry_tools,
    verbose=True,
)

task = Task(
    description="Search for ransomware groups targeting hospitals. Fetch top results and produce an intelligence report.",
    expected_output="Structured OSINT report with threat actors, TTPs, indicators, and next steps.",
    agent=analyst,
)

Crew(agents=[analyst], tasks=[task]).kickoff()

python sicry.py serve

{
  "mcpServers": {
    "sicry": {
      "command": "python",
      "args": ["/absolute/path/to/sicry.py", "serve"]
    }
  }
}

"mcp.servers": {
  "sicry": {
    "command": "python /absolute/path/to/sicry.py serve"
  }
}

mkdir -p ~/.openclaw/workspace/skills/sicry
cp sicry.py openclaw_skill/SKILL.md ~/.openclaw/workspace/skills/sicry/

python sicry.py <command> [options]

python sicry.py check
python sicry.py renew
python sicry.py search "ransomware healthcare" --max 15
python sicry.py search "bitcoin mixer" --engine Ahmia --engine Tor66
python sicry.py fetch http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion
python sicry.py tools --format openai | python -m json.tool
python sicry.py serve

import sicry

# Step 1: Verify Tor
status = sicry.check_tor()
if not status["tor_active"]:
    raise RuntimeError(f"Tor not active: {status['error']}")
print(f"Tor active. Exit IP: {status['exit_ip']}")

# Step 2: Health-check engines (skip dead ones)
engine_status = sicry.check_search_engines()
live = [e for e in engine_status if e["status"] == "up"]
live_names = [e["name"] for e in live]
print(f"{len(live)}/18 engines alive: {', '.join(live_names[:5])}...")

# Step 3: Refine query (Robin quality pattern)
raw_query = "ransomware groups targeting hospital systems 2026"
query = sicry.refine_query(raw_query)
print(f"Refined: '{raw_query}' -> '{query}'")

# Step 4: Search (query only live engines in parallel)
raw_results = sicry.search(
    query,
    engines=live_names,   # skip engines we know are down
    max_results=50,
)
print(f"{len(raw_results)} raw results")

# Step 5: Filter to best 20 (Robin quality pattern)
best = sicry.filter_results(query, raw_results)
print(f"Filtered to {len(best)} most relevant")

# Step 6: Batch scrape concurrently
pages = sicry.scrape_all(best[:10], max_workers=5)
print(f"Scraped {len(pages)} pages")

# Step 7: OSINT analysis
combined = "\n\n".join(f"[{url}]\n{text}" for url, text in pages.items())
report = sicry.ask(
    combined,
    query=query,
    mode="ransomware",
    custom_instructions="Focus on victim organisations and ransom demands.",
)
print(report)

# Step 8: Rotate identity when done
sicry.renew_identity()

report = sicry.ask(content, query="acme.com breach", mode="threat_intel")

report = sicry.ask(content, query="LockBit hospital", mode="ransomware")

report = sicry.ask(content, query="john.doe@email.com", mode="personal_identity")

report = sicry.ask(content, query="acme.com corporate leak", mode="corporate")

ss -tlnp | grep 9051

echo "ControlPort 9051" >> /etc/tor/torrc
echo "CookieAuthentication 1" >> /etc/tor/torrc
systemctl restart tor

SocksPort 9050
ControlPort 9051
CookieAuthentication 1
DataDirectory /tmp/tor_data

tor -f /tmp/sicry_tor.conf &

TOR_DATA_DIR=/tmp/tor_data

# Generate a hashed password
tor --hash-password "mypassword"
# -> 16:...hash...

# Add to torrc
HashedControlPassword 16:...hash...

# In .env
TOR_CONTROL_PASSWORD=mypassword

┌─────────────────────────────────────────────────────────────────────┐
│                        AI Agent / Host                              │
│  Claude · GPT-4o · Gemini · Ollama · LangChain · CrewAI · MCP      │
│                 calls tool  →  reads JSON result                    │
└─────────────────────┬───────────────────────────────────────────────┘
                      │  tool_name + args  (dict)
                      ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      SICRY™  (sicry.py)                             │
│                                                                     │
│  dispatch()  ──→  sicry_check_tor      check_tor()                  │
│              ──→  sicry_renew_identity renew_identity()             │
│              ──→  sicry_fetch          fetch(url)                   │
│              ──→  sicry_search         search(query, engines, ...)  │
│              ──→  sicry_ask            ask(content, mode, ...)      │
│              ──→  sicry_check_engines  check_search_engines()       │
│                                                                     │
│  Quality helpers (call directly):                                   │
│    refine_query()  ·  filter_results()  ·  scrape_all()            │
│                                                                     │
│  State:  SQLite DB (watch jobs · engine stats · result cache)       │
└──────────┬──────────────────────────┬───────────────────────────────┘
           │  SOCKS5                  │  stem control socket
           │  127.0.0.1:9050          │  127.0.0.1:9051
           ▼                          ▼
┌──────────────────────┐   ┌──────────────────────┐
│    Tor Daemon (tor)  │   │  Tor Control Port    │
│    (tor / TorPool)   │◄──│  renew_identity()    │
└──────────┬───────────┘   └──────────────────────┘
           │  onion routing  (3 hops)
           ▼
┌─────────────────────────────────────────────────────────────────────┐
│                  Dark Web / Tor Network                             │
│                                                                     │
│   .onion hidden services       Clearnet via Tor exit nodes          │
│   ┌───────────────────┐        ┌──────────────────────────────┐    │
│   │  18 Search Engines│        │  Any clearnet HTTPS/HTTP URL │    │
│   │  Ahmia · Tor66    │        │  (exit node proxied)         │    │
│   │  DuckDuckGo-Tor   │        └──────────────────────────────┘    │
│   │  + 15 more...     │                                             │
│   └───────────────────┘                                             │
└─────────────────────────────────────────────────────────────────────┘

  User query
     │
     ▼
[1] check_tor()            → verify Tor is active (abort if not)
     │
     ▼
[2] check_search_engines() → ping all 18, collect live engine list
     │
     ▼
[3] refine_query()         → LLM: natural language → ≤5 search keywords
     │
     ▼
[4] search()               → query all live engines in parallel over Tor
     │        ┌── Ahmia ──→ results
     │        ├── Tor66 ──→ results
     │        └── ...16 more (concurrent ThreadPoolExecutor)
     │
     ▼
[5] filter_results()       → LLM: pick top 20 most relevant results
     │
     ▼
[6] scrape_all()           → concurrent batch-fetch top pages over Tor
     │
     ▼
[7] ask()                  → LLM OSINT report (threat_intel / ransomware
     │                        / personal_identity / corporate)
     ▼
  Structured report

sicry_search  ─→  TorPool
                    ├── tor[0]  :9050  ← SOCKS5 proxy 0
                    ├── tor[1]  :9052  ← SOCKS5 proxy 1
                    └── tor[N-1]:...   ← SOCKS5 proxy N-1

SICRY_POOL_SIZE=3   # 2–4 recommended; each uses ~50 MB RAM

# Is Tor running?
pgrep tor || tor &
# Is SOCKS port open?
ss -tlnp | grep 9050

# Is control port open?
ss -tlnp | grep 9051
# Does the cookie file exist?
ls /tmp/tor_data/control_auth_cookie   # custom torrc
ls /var/lib/tor/control_auth_cookie    # system Tor
# Set TOR_DATA_DIR=/path/to/DataDirectory in .env