Flowsint: A Graph-Based Platform for OSINT Analysts

TL;DR: Flowsint is an open-source investigation platform that visualizes OSINT reconnaissance as a graph of entities and relationships. It is aimed at cybersecurity analysts and investigators who need to make sense of sprawling artifact sets — domains, IPs, emails, social handles — without juggling spreadsheets and disconnected tools.

Source and Accuracy Notes

• Repository: reconurge/flowsint
• License: Apache-2.0
• Stars: 8,360 (as of September 2026)
• Language: TypeScript
• Topics: investigation, osint, python
• Homepage: flowsint.io

What It Is

Flowsint is a visual, extensible platform for open-source intelligence work. It models an investigation as a graph: nodes are entities (people, domains, IPs, email addresses, cryptocurrency wallets, social accounts, organizations) and edges are the relationships between them.

Where most OSINT tooling stops at “here are the tools you can run,” Flowsint focuses on what to do with the results. After running recon modules that pull data from public sources, the platform lays the artifacts out as an interactive graph that you can query, pivot from, and annotate. The workflow becomes “investigate one node, see what connects to it, follow the thread.”

The platform is built in TypeScript with a Python backend for the data-collection modules. The Python piece handles the actual lookups (DNS, WHOIS, breach corpora, social scraping); the TypeScript piece handles the visualization, graph storage, and analyst UI.

Why It Matters

The classic OSINT workflow involves a dozen different tools — theHarvester, SpiderFoot, Maltego, custom scripts — and a mess of CSV exports that have to be reconciled by hand. Flowsint takes a different approach: bring the tools to one place, normalize the output, and let the graph be the interface.

A few things stand out about the design:

• Graph-first. The default mental model is “what connects to what” rather than “what tool produced what row.” This is what professional investigators actually want.
• Extensible. New recon modules can be added in Python without touching the UI. The platform ships with a starter set and is designed to grow with your workflow.
• Open source, open data. Apache-2.0 means analysts can self-host, audit, and customize. Sensitive investigations stay on the operator’s infrastructure.
• Modern UX. The frontend is a current web app, not a desktop binary. You can run it on a server and access it from any browser, which is friendlier for team use than the typical single-operator tool.

For analysts who have felt the friction of stitching together disparate OSINT outputs, Flowsint offers a more cohesive operational picture.

Practical Trade-Offs

A few honest constraints:

• Still maturing. At ~8k stars and an active development cadence, Flowsint is not yet a polished enterprise product. Expect rough edges and a smaller community than Maltego or SpiderFoot.
• Coverage is uneven. The Python module library covers common recon sources well (DNS, WHOIS, social profiles, breach data) but does not yet match the breadth of long-established OSINT frameworks.
• Performance at scale. Graph visualizations get unwieldy beyond tens of thousands of nodes. For very large investigations, careful filtering and subgraph extraction are necessary.
• Legal and ethical responsibility is yours. Like all OSINT tools, Flowsint can be used to collect publicly available information about people and organizations. The operator is responsible for staying within legal and ethical bounds.

These are normal caveats for an active open-source project in the security tooling space. None of them are reasons to avoid the platform; they are reasons to plan for them.

Who Should Care

Flowsint is a strong fit for:

• Cybersecurity analysts doing reconnaissance, threat intelligence, or breach investigation.
• Fraud investigators tracing digital identities across services.
• Journalists running background checks on sources and verifying claims.
• Academic researchers studying digital traces and network structures.
• CTF players and security hobbyists who want a more powerful workflow than ad-hoc scripts.

If you’ve been building your own graph of investigations in a spreadsheet, Flowsint is worth a serious look. If you’re a Maltego power user, it’s a useful open-source complement for collaboration-sensitive investigations.

Summary

Flowsint is one of the more interesting open-source OSINT platforms to ship in recent memory. Its graph-first approach, extensibility, and modern web-based UX address real friction in the day-to-day work of investigation. The project is still maturing, but the foundation is solid and the architectural choices line up with what professional analysts actually need.