reconurge/flowsint: Self-Hosted OSINT Graph Tool for Ethical Investigations

Cybersecurity analysts and OSINT investigators face a persistent tooling dilemma: commercial intelligence platforms demand steep subscriptions and store sensitive case data on vendor infrastructure, while cobbling together open-source scripts lacks the visual relationship mapping that makes complex investigations tractable. The risk of leaking investigation targets or proprietary findings to third-party clouds is often unacceptable for sensitive reconnaissance work.

reconurge/flowsint addresses this directly. With 7,288 GitHub stars and 909 forks, this Apache 2.0-licensed TypeScript project offers a self-hosted, graph-based investigation platform designed for ethical open-source intelligence gathering. Everything runs on your own infrastructure—no external data exfiltration, no SaaS lock-in. The project's explicit ETHICS.md framework and "ethical software" badge signal its positioning for lawful, transparent investigations rather than surveillance abuse.

This article examines what reconurge/flowsint offers technically, how to deploy it, and where it fits in the OSINT tooling landscape.

What is reconurge/flowsint?

reconurge/flowsint is an open-source OSINT (Open Source Intelligence) graph exploration tool built around a modular, service-oriented architecture. Developed under the reconurge organization, it reached 7,288 stars and 909 forks as of its last commit on July 1, 2026—substantial traction for a specialized security tool. The project is primarily TypeScript with Python^{↗ Bright Coding Blog} components in its backend modules, and carries an explicit ethical-use framework rare in this tooling category.

The platform's core value proposition is visual relationship mapping: investigators start with seed entities (domains, IPs, emails, cryptocurrency wallets, individuals) and expand the graph through automated "enrichers" that discover connected assets. Unlike static report generators, Flowsint renders these relationships as an interactive graph where analysts can pivot between entities, trace attack surfaces, or document fraud networks visually.

The architecture separates concerns into five autonomous modules: flowsint-types (Pydantic models), flowsint-enrichers (data collection logic), flowsint-core (orchestration, vault, Celery task queue), flowsint-api (FastAPI server), and flowsint-app (frontend). This modularity matters for teams that need to extend capabilities—new entity types or enrichers plug in without touching the API or UI layers.

The project's self-hosted nature is architecturally deliberate. PostgreSQL^{↗ Bright Coding Blog} stores relational data, Neo4j handles graph queries, Redis manages caching and task queues, and all components bind to localhost by default. For teams conducting sensitive investigations—law enforcement, corporate threat intelligence, investigative journalism—this eliminates data residency concerns and vendor trust assumptions entirely.

Key Features

Visual Graph Exploration at Scale

The frontend is explicitly optimized for performance "even on thousands of nodes"—a critical claim for investigators working with large attack surfaces or expansive social networks. The graph interface allows direct manipulation: zoom, filter, and pivot between entity types without re-querying or waiting for page loads.

Modular Enricher Ecosystem

Flowsint ships with 25+ built-in enrichers across 10 categories, each implemented as a discrete module:

• Domain intelligence: Reverse DNS, forward resolution, subdomain enumeration, WHOIS, historical data, root domain extraction, ASN mapping
• Network infrastructure: IP geolocation, ASN-to-CIDR expansion, CIDR-to-IP enumeration
• Social media^{↗ Bright Coding Blog}: Maigret integration for username correlation across platforms
• Organizational: Company-to-ASN mapping, domain ownership, corporate intelligence
• Cryptocurrency: Wallet transaction history, NFT ownership tracing
• Web presence: Site crawling, link extraction, tracker identification, text extraction
• Contact vectors: Email breach checks (via Gravatar and breach databases), phone number breach correlation
• Person-to-asset: Individual organizational affiliations, associated domains
• Workflow integration: N8n connector for custom automation pipelines

Privacy-First Deployment

All data stores locally by default. The Docker^{↗ Bright Coding Blog} Compose configuration exposes only port 5173; PostgreSQL, Redis, Neo4j, and the API bind to 127.0.0.1. The frontend proxies all API calls internally, eliminating CORS complexity and reducing attack surface. A host-header allowlist in nginx.conf defaults to localhost/127.0.0.1, with explicit opt-in required for LAN or public deployment—defense against DNS rebinding attacks.

Vault Architecture for API Keys

The MASTER_VAULT_KEY_V1 encrypts stored third-party API credentials. This matters for teams using paid enrichment sources: keys aren't plaintext in environment files or database dumps.

Celery-Based Async Processing

Long-running enrichers (subdomain enumeration, site crawling, breach database queries) execute asynchronously via Celery tasks, preventing API timeouts and keeping the UI responsive during intensive operations.

Use Cases

Corporate Attack Surface Management

A security team seeds Flowsint with their organization's registered domains. Subdomain discovery and IP resolution expand the graph; ASN and CIDR enrichers map upstream infrastructure. The team identifies forgotten subdomains hosting outdated services—common breach vectors—without sending proprietary asset lists to external SaaS platforms.

Fraud and Financial Crime Investigation

Investigators trace cryptocurrency wallets from suspicious transactions. The wallet-to-transaction and wallet-to-NFT enrichers map fund flows and asset holdings. Cross-referenced with email breach data and social media presence, analysts build comprehensive actor profiles while maintaining chain-of-custody control over all data.

Journalistic Source Protection

Investigative journalists examining corporate networks or political actors can operate entirely offline after initial setup. No investigation metadata leaks to commercial platform logs; no subpoena-exposed third parties hold query records. The self-hosted model aligns with source protection protocols that prohibit cloud-based analysis tools.

Incident Response and Threat Intelligence

During active incidents, analysts pivot from IOCs (IPs, domains) to infrastructure. Reverse DNS and ASN enrichment reveal shared hosting or bulletproof provider patterns. Historical domain data identifies campaign duration. The graph format makes TTP (tactics, techniques, procedures) correlations visible that tabular data obscures.

Compliance and Due Diligence

Third-party risk teams assess vendor security postures by mapping their external infrastructure, checking for exposed services, and correlating organizational affiliations. All findings remain internal, supporting audit requirements that prohibit external data processing.

Installation & Setup

Flowsint deploys via Docker with minimal host dependencies. Two paths exist: production deployment with pre-built images, or development builds from source.

Linux / macOS (Production)

Prerequisites: Docker, Make, Git.

# Clone repository
git clone https://github.com/reconurge/flowsint.git
cd flowsint

# Deploy with pre-built images
make prod

The make prod command orchestrates docker-compose.prod.yml, pulling images from GitHub Container Registry. No local build occurs.

Windows (Production)

Prerequisites: Docker Desktop (running), Git.

:: Clone repository
git clone https://github.com/reconurge/flowsint.git
cd flowsint

:: Create environment files from template
copy .env.example .env
copy .env.example flowsint-api\.env
copy .env.example flowsint-core\.env
copy .env.example flowsint-app\.env

:: Start services with pre-built images
docker compose -f docker-compose.prod.yml up -d

Windows deployment intentionally avoids Make dependency, using direct docker compose commands.

First Access

Navigate to http://localhost:5173/register and create an initial account. No default credentials exist—this prevents locked-out scenarios and forces credential generation.

Network Deployment (Team/Server)

The same compose file works for shared access:

git clone https://github.com/reconurge/flowsint.git
cd flowsint
cp .env.example .env
# Edit .env — see security notes below
docker compose -f docker-compose.prod.yml up -d

Clients access via http://<server-ip>:5173. Critical security steps before network exposure:

1. Rotate secrets in .env:

   # Authentication token signing key
   openssl rand -hex 32
   
   # API key encryption master key
   python3 -c "import os, base64; print('base64:' + base64.b64encode(os.urandom(32)).decode())"
   
   # Neo4j database password
   

2. Update host allowlist in flowsint-app/nginx.conf. The default map $http_host $is_flowsint_host accepts only localhost variants. Uncomment and modify template lines for your hostname/IP.

3. Pin version via FLOWSINT_VERSION in .env (e.g., 1.2.10) rather than using latest for reproducible deployments.

4. Enable HTTPS for untrusted networks. Example Caddy configuration:

   flowsint.example.com {
       reverse_proxy 127.0.0.1:5173
   }
   

   Bind Docker port to localhost ("127.0.0.1:5173:8080") to enforce reverse proxy usage.

Development Setup

Linux/macOS with Make:

make dev

Windows (cmd/PowerShell, after creating .env files):

docker compose -f docker-compose.dev.yml up -d --build
docker compose -f docker-compose.dev.yml logs -f

Access at http://localhost:5173. Development mode builds images locally and streams logs.

Real Code Examples

The README provides explicit commands for operational tasks. Below are reproduced exactly with contextual explanation.

Production Deployment (Linux/macOS)

git clone https://github.com/reconurge/flowsint.git
cd flowsint
make prod

This three-line sequence is the complete production path. git clone retrieves the compose definitions and nginx configuration; cd flowsint positions for relative path resolution; make prod executes the Makefile target that wraps docker compose -f docker-compose.prod.yml up -d with any additional environment validation. The brevity reflects the project's container-first design philosophy—no language runtime installation, no dependency resolution, no database schema migrations run manually.

Windows Environment File Initialization

copy .env.example .env
copy .env.example flowsint-api\.env
copy .env.example flowsint-core\.env
copy .env.example flowsint-app\.env

Windows lacks symlinks in the same manner as Unix; the README explicitly duplicates the example file to each module directory. This ensures each service container receives its own environment context without cross-directory file sharing complications. The .env.example contains all configurable variables with safe defaults; production deployments require editing at minimum the secrets noted above.

Network Deployment with Secret Generation

git clone https://github.com/reconurge/flowsint.git
cd flowsint
cp .env.example .env
# Edit .env — see "Before exposing to a network" below
docker compose -f docker-compose.prod.yml up -d

The comment placeholder # Edit .env is intentional documentation—users must manually intervene. The subsequent sections in the README specify exactly which variables require rotation (AUTH_SECRET, MASTER_VAULT_KEY_V1, NEO4J_PASSWORD) and provide generation commands. This pattern of "clone, configure, deploy" with explicit security checkpoints is common in self-hosted security tools but often poorly documented; Flowsint's explicitness reduces misconfiguration risk.

Version Pinning and HTTPS Binding

# In docker-compose.prod.yml, modify:
"127.0.0.1:5173:8080"

This localhost binding, combined with external reverse proxy termination, implements defense-in-depth: even if the TLS proxy is bypassed, the application port isn't directly reachable from the network. The README notes this as recommended practice rather than default, acknowledging that trusted LAN deployments may accept direct exposure.

Advanced Usage & Best Practices

Module Development Workflow

The architecture supports extension through established patterns: add Pydantic models to flowsint-types, implement collection logic in flowsint-enrichers, expose via flowsint-api endpoints, and render in flowsint-app. The dependency graph (app → api → core → enrichers → types) prevents circular imports and enforces interface contracts. Teams building custom internal enrichers should follow this hierarchy rather than bypassing layers, as the orchestrator in flowsint-core handles task queueing, error retry, and vault access that direct enricher calls would miss.

Testing Strategy

Each module maintains independent test suites using pytest:

cd flowsint-core && uv run pytest
cd ../flowsint-types && uv run pytest
cd ../flowsint-enrichers && uv run pytest
cd ../flowsint-api && uv run pytest

The README candidly notes these are "incomplete"—a realistic assessment for an early-stage project. Contributors should prioritize enricher tests, as these interact with external services and are most prone to breakage from API changes.

Performance Considerations

The Neo4j graph database handles relationship queries; PostgreSQL stores entity properties and user data. For investigations exceeding thousands of nodes, monitor Neo4j memory configuration and consider the dbms.memory.heap.max_size setting. The frontend's claimed performance at scale depends on server-side graph pruning—avoid unbounded expansion from high-degree nodes (e.g., popular IP addresses shared by many domains).

Operational Security

The ethical use framework isn't merely decorative. Organizations deploying Flowsint should establish internal access controls, audit logging, and investigation authorization workflows that complement the technical controls. The tool's capability for personal data correlation (email breaches, social media, organizational affiliations) triggers GDPR and similar privacy regulations in many jurisdictions—legal review of use cases is advisable before operational deployment.

Comparison with Alternatives

Flowsint occupies a distinct niche: graph-native visualization with self-hosted data sovereignty, without Maltego's pricing. Compared to SpiderFoot, it prioritizes interactive exploration over automated scanning breadth. For teams needing visual relationship analysis without commercial licensing, Flowsint's 7,000+ stars suggest community validation of this positioning.

FAQ

Is reconurge/flowsint free to use?

Yes, Apache 2.0 licensed. No commercial tier or feature gating exists.

What infrastructure is required?

Any Docker-capable host. The stack includes PostgreSQL, Neo4j, Redis, and the application services—adequate RAM (4GB+) recommended for Neo4j with large graphs.

Can I use this without Docker?

The README documents only Docker deployment. Manual installation would require reverse-engineering compose files and environment setup.

Is there a managed/cloud version?

No. The project's architecture assumes self-hosting; no SaaS offering is mentioned.

How do I add custom enrichers?

Extend flowsint-enrichers following existing module patterns, add types to flowsint-types, and expose via flowsint-api. The modular dependency structure enforces clean separation.

What about performance with large investigations?

The frontend claims optimization for thousands of nodes. For larger scales, Neo4j tuning and selective graph expansion are recommended.

Is this tool legal to use?

The project includes explicit ethical use guidelines and disclaims authorization for surveillance or harassment. Legality depends on jurisdiction and use case; the ETHICS.md provides a framework, not legal advice.

Conclusion

reconurge/flowsint delivers a credible open-source alternative for teams requiring visual OSINT investigation capabilities without surrendering data control. Its modular architecture supports extension, its Docker-native deployment minimizes operational friction, and its explicit ethical framework addresses legitimate concerns about misuse in the intelligence tooling space.

The project is best suited for: cybersecurity teams conducting internal threat intelligence, investigative journalists protecting sources, law enforcement with appropriate authorization frameworks, and compliance functions requiring data residency. It is less appropriate for users seeking turnkey SaaS convenience or those unwilling to operate their own infrastructure.

With 7,288 stars and active development through mid-2026, the project has demonstrated traction. The "early development" caveat in the README suggests API stability isn't guaranteed—production deployments should pin versions and monitor releases.

Explore the repository, review the ethical use guidelines, and evaluate whether self-hosted graph investigation fits your operational model: https://github.com/reconurge/flowsint

For teams evaluating broader OSINT toolchain integration, consider how Flowsint complements [INTERNAL_LINK: self-hosted security infrastructure] strategies.