In short:
ak-cti-experttells you what your domain, IPs, work emails or software expose in public sources, or whether a strange indicator is worth worrying about. It collects withak-agent-browser, web fetch, then dorks, and builds the HTML version withak-frontend-designandak-diagram. It only does passive OSINT: no port scans, no password attempts, no exploitation.
Disclosure: I maintain AgentKit and have an affiliate relationship with it: the AgentKit link in this post is an affiliate link; buying through it gets you 30% off.
Summary
Use it when you need to review your organization's exposure, check a strange IP or hash from your logs, or hand someone a sourced intel report. Do not use it when you need active penetration testing, or when the target is not an asset you are allowed to check.
flowchart LR
A["Target you are allowed to check"] --> B["ak-cti-expert"]
B --> C["Single IOC lookup: short answer"]
B --> D["Case: .md + .docx report"]
D --> E["Plus .html with --format html"]
C --> F["Stop"]
E --> FFour things to know before you type a command:
| Concept | Question | Example |
|---|---|---|
| The four phases of a case | Which step is your task in? | /subdomain is Collect, /timeline is Enrich, /exposure is Assess, /report is Deliver |
| Single IOC or a case | Do you need a quick answer or a full file? | Ask about a strange IP in a log and you get sources, when it was seen, confidence and open doubts, with no case and no report file |
| Passive OSINT only | What may the skill do, and what not? | Reading a domain's public certificate logs is fine. Port scans, brute force, credential stuffing and exploitation are not |
| Confidence levels | Which findings are solid, which are only hypotheses? | CONFIRMED with 2 or more independent reliable sources, PROBABLE with one good source, POSSIBLE for an indirect link only |
When a tool is missing, it does not stop the case: it records a collection gap in the report. Credentials, internal IP ranges and private personal data are masked before export.
Sample prompt (reviewing your own domain's exposure):
/ak-cti-expert /case <your organization's domain>
Context: I own security and have been asked to check this domain.
Scope: public sources only, no scanning or login attempts.
Need: exposure score, sourced list of findings, what to fix first.| Flag | What it is for | Since ak |
|---|---|---|
--yolo | Skips the first-run walkthrough | 1.0.0 |
--case, --sweep, --query, --flow | Declared in the argument hint only, behavior not described | 1.0.0 |
--format html|md | Adds an HTML version you can view offline | 2.13.0 |
--no-antv, --no-diagram-design, --no-editorial-visuals | Declared in the argument hint only, behavior not described | 2.13.0 |
--mermaid | Draws diagrams in Mermaid instead of ASCII | 1.0.0 |
Below is the detailed version: the run flow, 6 situations with prompts, each flag explained, the change history by ak release, and common pitfalls. The detailed version and the interactive page are for subscribers. Your agent can also search them through the portal's MCP.
Opens when your account has subscriber access
This guide is for subscribers
Once your account has access, the full piece, the interactive visual and the agent call all open.
- Sign in or create a modernEngineer accountReading access belongs to your account email.
- Choose a plan on the pricing page1, 3 or 12 months, paid by VietQR bank transfer. Access opens about a minute after the money arrives.
- Or redeem a Facebook subscriber codePeople supporting the page on Facebook get an activation code by message each month.
Already a subscriber? Sign in to read.
Use this piece in your agent
Get an API keyCopy the text below and paste it into Claude Code, Codex or whichever agent you use. The agent reads the piece and checks it against the repo you have open.
Read "ak-cti-expert: passive OSINT lookups packaged as intel reports" on modernEngineer and apply it to this repo.
1. Call the content_get tool of the modernengineer MCP server with locale "en", slug "ak-cti-expert". If the modernengineer MCP server is not connected, stop and walk me through connecting it from https://modernengineer.dev/en/mcp.
2. Summarize the main steps of the piece and point out which apply to this repo.
3. Propose concrete changes and ask me before editing any file.Connect MCP in Claude Code (once)
claude mcp add --transport http modernengineer \
https://api.modernengineer.dev/mcp \
--header "Authorization: Bearer <API key>"Reading the full piece over MCP needs an API key from a subscriber account or one that bought this guide. Without access, the agent only gets the opening.
- Version
- v1.0.0
- Updated
- 22/10/2026
- Licence
- All rights reserved
- Slug
- ak-cti-expert
