Data / Repositories / Threat intelligence
Threat intelligence repositories on GitHub: 10 ranked by stars
10 public repositories tagged Threat intelligence are on GitHub, with 16,252 stars between them; 6 had a push in the last 30 days. Most are written in Python (6), TypeScript (2), C (1). The most starred: kaifcodec/user-scanner (5,395), mikeroyal/Digital-Forensics-Guide (3,181), OpenOSINT/OpenOSINT (1,753).
SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.
Every repository, most starred first
| Repository | What it is | Language | Stars | Forks | License | Last push | Read |
|---|---|---|---|---|---|---|---|
| kaifcodec/user-scanner | (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors… | Python | 5,395 | 542 | MIT | Oct 14 | Oct 14 |
| mikeroyal/Digital-Forensics-Guide | Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics. | Python | 3,181 | 400 | Jan 4, 2024 | Oct 11 | |
| OpenOSINT/OpenOSINT | AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only. | Python | 1,753 | 278 | MIT | Oct 13 | Oct 14 |
| mukul975/cve-mcp-server | Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more. | Python | 1,624 | 269 | Apache-2.0 | Oct 1 | Oct 14 |
| jacobdjwilson/awesome-annual-security-reports | A curated list of annual cyber security reports | 1,213 | 145 | MIT | Oct 13 | Oct 14 | |
| aw-junaid/Hacking-Tools | This Repository is a collection of different ethical hacking tools and malware's for penetration testing and research purpose written in python, ruby, rust, c++, go and c. | C | 1,034 | 261 | Aug 19 | Oct 11 | |
| marc-shade/world-intel-mcp | 139-tool MCP server for real-time global intelligence from free public APIs: markets, SEC filings, conflict, military, aircraft-cohort early warning, refugee and migration flows… | Python | 944 | 153 | MIT | Oct 12 | Oct 14 |
| google/mcp-security | Python | 532 | 146 | Apache-2.0 | Oct 6 | Oct 14 | |
| badchars/darknet-mcp-server | 66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logs | TypeScript | 514 | 72 | MIT | Sep 22 | Oct 14 |
| badchars/osint-mcp-server | OSINT intelligence MCP server for AI agents — 37 tools, 12 sources. Shodan, VirusTotal, Censys, SecurityTrails, DNS reconnaissance, WHOIS, certificate transparency, BGP routing… | TypeScript | 62 | 8 | MIT | Mar 17 | Oct 14 |
By language
- Python 6
Related topics
- Cybersecurity 7
- Osint 6
- MCP 6
- Model Context Protocol 6
- Security 5
- Python 4
- AI agents 4
- Claude 3
- Network security 2
- Anthropic 2
- MCP server 2
- Reconnaissance 2
Read from GitHub by SpecStream between October 11, 2026 and October 14, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.