Read-only container, nothing shared
All capabilities dropped, non-root, no new privileges, a memory and CPU cap, and no host folders mounted. Input values are passed as arguments, never through a shell.
Free, public OSINT tool registry
Find, install and run OSINT tools with one command.
Every tool is pinned, signed, scanned and smoke-tested before it is listed. ot runs it in a locked-down container on your own machine, and gives you results other tools can read.
$ ot run dheeraj/holehe-lite --email ada@example.com
✓ signed by github.com/dheeraj/holehe-lite · verified
✓ scans pass · 0 critical · smoke test ok
→ read-only container · no host files · no shell
github.com found
gitlab.com found
spotify.com found
twitter.com not found
✓ 4 sites in 1.8 s · results.json writtenGet started
One file. Windows, macOS and Linux.
The installer checks the SHA-256 and the release signature before anything runs. Then ot doctor tells you whether Docker, Podman and your keychain are ready.
Prefer a package? Every release ships deb, rpm and archives on GitHub Releases, and ot self-update keeps it current.
curl -fsSL https://get.otinstaller.com/ot | shChecks the SHA-256 and the release signature, then installs to /usr/local/bin or ~/.local/bin. Then run ot doctor.
irm https://get.otinstaller.com/ot.ps1 | iexInstalls to %LOCALAPPDATA%\Programs\ot and adds it to your PATH. Then run ot doctor.
brew install --cask otinstaller/tap/otFrom the otinstaller/homebrew-tap cask. Then run ot doctor.
scoop bucket add otinstaller https://github.com/otinstaller/scoop-bucket && scoop install otFrom the otinstaller/scoop-bucket bucket. Then run ot doctor.
go install github.com/otinstaller/otinstaller/cli/cmd/ot@latestBuilds from source with Go 1.25 or newer. Then run ot doctor.
ot doctorchecks your machineot search usernamefinds a toolot run ns/tool --username janeinstalls it once, then runs it
Start from what you have
I have a…
Opening soon
The first tools are being published now
The registry is live and accepting releases. Browse back shortly, or be one of the first publishers: the import wizard turns a GitHub or GitLab repository into a listed, signed tool in minutes.
5checks on every release
0host files a tool can read
Trust, checked by machines and people
How a release gets in
Pinned
Images by digest, wheels by hash. A version can never point at different code later.
Signed
Signed by the repository's own CI with cosign keyless. ot checks the identity before every run.
Scanned
Trivy for vulnerabilities and secrets, GuardDog for Python packages, and an SBOM.
Smoke-tested
Run once with its declared test input, offline, in the same sandbox you will use.
Reviewed
A person reviews every new publisher's first release against the acceptable-use rules.
When you run it
Runs on your machine, inside a box
API keys stay in your keychain
ot keys set NAME stores a key in the OS keychain and hands it to that one container only. Tools that need none are a search filter away.
Results other tools can read
Every run returns the same JSON result envelope, so output pivots into the next tool or an OSINTverse case. --format table when you just want to read it.
For tool authors
Publish from the repository you already have
Point the wizard at a GitHub or GitLab repository. The registry detects what is in it, drafts otinstaller.yaml, and opens a pull request with a release workflow. Merge, tag v1.0.0, and your tool is scanned and live.
- 1Describe
ot initor the import wizard writes the manifest - 2TagYour CI builds, signs and pushes the release
- 3LiveScanned, smoke-tested and listed within minutes
Ready when you are.
Install in seconds, run your first tool a minute later.
curl -fsSL https://get.otinstaller.com/ot | shWindows: irm https://get.otinstaller.com/ot.ps1 | iex · Getting started