Spaces:
Runtime error
Runtime error
Update README.md
Browse files
README.md
CHANGED
|
@@ -19,4 +19,122 @@ datasets:
|
|
| 19 |
- John6666/knowledge_base_md_for_rag_1
|
| 20 |
---
|
| 21 |
|
| 22 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 19 |
- John6666/knowledge_base_md_for_rag_1
|
| 20 |
---
|
| 21 |
|
| 22 |
+
# Parrot OSINT MCP Console
|
| 23 |
+
|
| 24 |
+
A multi-mode OSINT analysis console built for structured intelligence workflows, streaming LLM analysis, and direct MCP tool access. Designed for investigation, enrichment, correlation, and report generation, all within a single Gradio interface.
|
| 25 |
+
|
| 26 |
+
---
|
| 27 |
+
|
| 28 |
+
## 🔹 Mode B — OSINT Dashboard
|
| 29 |
+
|
| 30 |
+
Interactive panels for:
|
| 31 |
+
|
| 32 |
+
- IP Lookup
|
| 33 |
+
- Domain Lookup
|
| 34 |
+
- Hash Lookup
|
| 35 |
+
- IOC Correlation
|
| 36 |
+
- Quickscan
|
| 37 |
+
- MITRE ATT&CK Mapping
|
| 38 |
+
- STIX / SARIF / JSON Output
|
| 39 |
+
|
| 40 |
+
Each panel calls a corresponding MCP task and renders:
|
| 41 |
+
|
| 42 |
+
- Summary
|
| 43 |
+
- Markdown report
|
| 44 |
+
- Raw JSON
|
| 45 |
+
- MITRE mappings
|
| 46 |
+
- STIX bundles
|
| 47 |
+
|
| 48 |
+
This is the structured-intelligence layer: deterministic, reproducible, and machine-readable.
|
| 49 |
+
|
| 50 |
+
---
|
| 51 |
+
|
| 52 |
+
## 🔹 Mode D — MCP Raw Bridge
|
| 53 |
+
|
| 54 |
+
Direct JSON-based invocation of any registered MCP task.
|
| 55 |
+
|
| 56 |
+
Example input:
|
| 57 |
+
|
| 58 |
+
```json
|
| 59 |
+
{
|
| 60 |
+
"ip": "8.8.8.8",
|
| 61 |
+
"enrich": true,
|
| 62 |
+
"map_mitre": true
|
| 63 |
+
}
|
| 64 |
+
|
| 65 |
+
Output is shown as:
|
| 66 |
+
• Raw JSON
|
| 67 |
+
• Rendered Markdown (if returned by the tool)
|
| 68 |
+
|
| 69 |
+
This mode is ideal for debugging, development, automation, and power-user workflows.
|
| 70 |
+
|
| 71 |
+
⸻
|
| 72 |
+
|
| 73 |
+
🔹 Mode C — Analyst Copilot (LLM)
|
| 74 |
+
|
| 75 |
+
A streaming threat-intelligence assistant backed by the HuggingFace Inference API.
|
| 76 |
+
|
| 77 |
+
Capabilities include:
|
| 78 |
+
• Interpreting OSINT task results
|
| 79 |
+
• Drafting threat summaries
|
| 80 |
+
• Identifying TTPs, clusters, and adversary patterns
|
| 81 |
+
• Guiding step-by-step investigations
|
| 82 |
+
• Injecting dashboard/bridge results directly into conversation context
|
| 83 |
+
|
| 84 |
+
The copilot does not replace deterministic tasks — it explains them, contextualizes them, and synthesizes intelligence narratives.
|
| 85 |
+
|
| 86 |
+
⸻
|
| 87 |
+
|
| 88 |
+
🏗️ Architecture
|
| 89 |
+
|
| 90 |
+
OSINT Tasks → Correlation/Enrichment → MITRE Mapping → Outputs → Analyst Copilot
|
| 91 |
+
|
| 92 |
+
This separation keeps intelligence deterministic until you explicitly enter the interpretive layer.
|
| 93 |
+
|
| 94 |
+
⸻
|
| 95 |
+
|
| 96 |
+
🚀 Running Locally
|
| 97 |
+
|
| 98 |
+
Install dependencies:
|
| 99 |
+
|
| 100 |
+
pip install -r requirements.txt
|
| 101 |
+
|
| 102 |
+
Run the app:
|
| 103 |
+
|
| 104 |
+
python app.py
|
| 105 |
+
|
| 106 |
+
|
| 107 |
+
⸻
|
| 108 |
+
|
| 109 |
+
🔐 API Tokens
|
| 110 |
+
|
| 111 |
+
The Analyst Copilot uses the HuggingFace Inference API.
|
| 112 |
+
|
| 113 |
+
You can provide your token securely through the Gradio OAuthToken input inside the UI.
|
| 114 |
+
|
| 115 |
+
⸻
|
| 116 |
+
|
| 117 |
+
📦 Repository Structure
|
| 118 |
+
|
| 119 |
+
app.py
|
| 120 |
+
requirements.txt
|
| 121 |
+
README.md
|
| 122 |
+
runtime.txt (optional)
|
| 123 |
+
hf.yaml (optional)
|
| 124 |
+
.gitignore
|
| 125 |
+
tasks/ (your MCP tools)
|
| 126 |
+
|
| 127 |
+
|
| 128 |
+
⸻
|
| 129 |
+
|
| 130 |
+
📝 Notes
|
| 131 |
+
• Do not commit .mcp/secrets.json or any API keys.
|
| 132 |
+
• If MCP tasks depend on network-based OSINT sources (Shodan, Censys, VT, etc.), ensure rate limits and caching are configured.
|
| 133 |
+
• The UI is modular — you can add new tools to the registry without changing the interface.
|
| 134 |
+
|
| 135 |
+
⸻
|
| 136 |
+
|
| 137 |
+
Parrot OSINT MCP Console is built for analysts, builders, and anyone who needs intelligence workflows that scale across data sources, formats, and models.
|
| 138 |
+
|
| 139 |
+
---
|
| 140 |
+
|