apurvsinghgautam/robin

Robin – AI‑Powered Dark‑Web OSINT Tool

What it is – Robin is a Python/Streamlit application that helps investigators search the dark web and turn the raw results into a concise, AI‑generated summary. It talks to large language models (OpenAI, Claude, Gemini, Mistral, Ollama, etc.) to:

1. Refine the user’s query.
2. Query dark‑web search engines through Tor.
3. Filter and scrape the returned pages.
4. Produce a short investigation report and allow follow‑up questions without re‑running the search.

Key features

• Multi‑model support – any OpenAI‑compatible API (including local models via Ollama or llama.cpp) can be used.
• Web UI – a Streamlit front‑end that runs on http://localhost:8501.
• MCP integration – the tool can be launched as an MCP server so other LLM‑agents (Claude, Codex, Hermes, OpenClaw, etc.) can call it directly.
• Conversational follow‑ups – ask new questions about the same investigation; Robin answers from the already‑scraped data.
• One‑click pivots – suggested new queries appear based on the current findings.
• Docker ready – official Docker image (apurvsg/robin) with a simple run command; investigations are persisted in a volume.
• Safety checks – scraped text is sanitized (control, zero‑width, bidi characters stripped) before being sent to the LLM.

How to get it running

1. Install Tor (apt install tor, brew install tor, etc.) and make sure the Tor daemon is running.
2. Provide an LLM API key – put OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY, MISTRAL_API_KEY or OPENROUTER_API_KEY in a .env file (copy from .env.example).
3. Run the Docker image (recommended):

   docker pull apurvsg/robin:latest
   docker run --rm \
       -v "$(pwd)/.env:/app/.env" \
       --add-host=host.docker.internal:host-gateway \
       -p 8501:8501 \
       apurvsg/robin:latest
   

   • Mount a named volume (robin-investigations:/app/investigations) or a local folder to keep reports across restarts.
4. Open a browser at http://localhost:8501 and start a new investigation.

Using Robin as an MCP server

• Add a server entry to the MCP configuration of your LLM‑agent (Claude, Codex, Hermes, etc.) that runs the same Docker command with the mcp sub‑command. Example for Claude:

  {
    "mcpServers": {
      "robin": {
        "command": "docker",
        "args": ["run", "-i", "--rm", "-v", "robin-investigations:/app/investigations", "apurvsg/robin", "mcp"],
        "timeout": 600000
      }
    }
  }
  

• The agent can then invoke Robin’s tools directly from a chat, receiving the same investigation data.

Typical use‑cases

• Law‑enforcement or corporate security teams needing a quick, AI‑assisted overview of dark‑web mentions of a brand, credential leak, or illicit product.
• Researchers performing academic OSINT studies on hidden‑service activity.
• Incident‑response analysts who want to ask follow‑up questions on already‑collected evidence without re‑searching.

Limitations & cautions

• Legal risk – accessing certain dark‑web content may be illegal in many jurisdictions; the tool is for educational and lawful investigations only.
• Tor dependency – searches only work while the Tor daemon is running and reachable.
• Model cost & privacy – every query is sent to the chosen LLM provider; sensitive data may be exposed to third‑party APIs.
• Speed – a Tor search can take several minutes; MCP hosts may need to raise their timeout settings.

Disclaimer – The author disclaims responsibility for misuse. Users must ensure compliance with local laws and the terms of service of any LLM API they employ.

---

Acknowledgements – Inspired by Thomas Roccia’s “Perplexity of the Dark Web”, the author’s own dark‑web OSINT tools repo, and the OSINT‑Assistant prompt library.