shamus — an OSINT agent that lives in your terminal

One command. The agent picks the tools, runs them and writes the case file.

shamus "question" [--depth 1-5] [--ask always|never] [--out case.md]

Windows 10 and 11 · PowerShell or cmd · Public sources only

It is an agent, not a script.

Shamus is trained for open-source intelligence. It reads what each tool returns, decides what that means and picks the next tool itself.

▸a tool call·a note to itself

It asks before it widens the search.

New people, new accounts, a hundred more transfers: it stops and waits for your answer.

?(Y/n)--ask always|never

Tools

Twelve tools ship with it. The agent decides which to call.

whois: who registered a domain, and when
dns: where a domain points and what it shares
certs: every certificate issued for a name
archive: what a page said before it changed
handles: where a nickname is registered
mentions: where a nickname was written
people: public profiles behind a name
registry: company filings and the people in them
ledger: transfers on public blockchains
exif: what a photo says about itself
geo: where a photo was taken
report: writes case.md, a source on every line

Examples

Pick one. It runs in the terminal above.

It ends with a file.

The run is written to case.md: findings in order, a source on every line, and what it could not find.

--out case.md

case.md — what the run leaves behind.

# Who is behind johndoe.example?

1. Registered 11 days ago through a privacy service. [whois]
2. Shares a mail host with two shops that closed in 2025. [dns] [archive]
3. Both shops name one company in their terms. [archive] [registry]
4.  [registry]

Not found: a phone number, a street address.

Questions

Does it act on its own?

Inside the question you asked, yes. Before it brings in new people or accounts it asks. With --ask always it asks before every step.

Can it get things wrong?

Yes. Every line in case.md names the tool output it came from. Read the ones that matter before you rely on them.

What does it read?

Public sources only: sites, public profiles, registries, archives and blockchains. Nothing behind a password or a paywall.

Is this allowed?

Reading public information is what anyone can do by hand. Follow each source’s terms and your local law, and do not use it to harass anyone.

Give it a question.

shamus "your question"

Download for Windows