# Flowsint: a self-hosted graph OSINT tool for reconnaissance work

> Flowsint is an Apache-2.0 OSINT graph exploration platform built from Python enrichers, a FastAPI server and a TypeScript front end. It runs as a Docker Compose stack on your own machine, and this review covers what it does, how to install it, and where it stops being the right tool.

**reconurge/flowsint** — A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.

- Repository: https://github.com/reconurge/flowsint
- Website: https://flowsint.io
- Stars: 9,061 · Forks: 1,110
- Language: TypeScript
- License: Apache-2.0
- Published: 2026-09-21 · Updated: 2026-09-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/reconurge-flowsint

## What Flowsint solves and who it is built for

Most OSINT work starts as a pile of tabs. You resolve a domain, look up its WHOIS record, pull the ASN, enumerate subdomains, and then try to remember which IP belonged to which host three hours later. Flowsint's answer is to make the graph the workspace. The README describes it as a graph-based investigation tool focused on reconnaissance and OSINT, where you explore relationships between entities through a visual graph interface and automated enrichers.

The audience is narrow and clearly stated: cybersecurity analysts and investigators. The repository topics list investigation, osint, python and recon. If your work is threat research, brand protection, due diligence on a company, or tracing a cryptocurrency wallet, the entity types line up with what you already do. If you are a developer looking for an enrichment API to embed in a product, the shape of the project is wrong for you, because the graph interface is the product, not a side effect.

The privacy framing matters here. The README states that OSINT investigations need a high level of privacy and that everything is stored on your machine. That is the design constraint the whole deployment story follows from, and it is the main reason to pick this over a hosted tool.

## How the enricher pipeline and graph model fit together

The repository is split into autonomous Python and TypeScript modules. flowsint-types holds Pydantic models and type definitions, which is where the entity vocabulary lives. flowsint-core carries core utilities, the orchestrator, the vault and Celery tasks. flowsint-enrichers holds the enricher modules, scanning logic and tools. flowsint-api is a FastAPI server with API routes and schemas only, and flowsint-app is the frontend. The README's dependency diagram puts the frontend above the API server, so the browser talks to FastAPI rather than to Neo4j directly.

Enrichers are typed by the entity they consume. A domain can be resolved to IPs, expanded to subdomains, looked up in WHOIS, converted to a website entity, reduced to a root domain, mapped to an ASN, or checked against historical domain data. An IP becomes geolocation and network details or an ASN. An ASN yields CIDRs, and CIDRs enumerate into IPs. Organizations map to ASNs and domains, individuals map to organizations and domains, wallets map to transactions and NFTs, websites crawl into links, trackers and text, emails resolve to Gravatars, breaches and domains, and phone numbers are checked against breach data. There is also an N8n connector for pushing work into external workflows.

Persistence is Neo4j, configured through NEO4J_URI_BOLT, with PostgreSQL and Redis alongside it. Redis backs Celery and cache, which is the hint that enrichment is asynchronous rather than a blocking request per click. Neo4j runs with the APOC plugin enabled and with APOC import and export file access switched on, which is what lets graph data move in and out of the container. The vault in flowsint-core is where stored API keys live, encrypted with MASTER_VAULT_KEY_V1.

## Installing Flowsint with Docker Compose and running a first enrichment

On Linux or macOS the README's short path needs Docker and Make. Clone the repository and run the production target, which pulls pre-built images rather than building locally.

```bash
git clone https://github.com/reconurge/flowsint.git
cd flowsint
make prod
```

On Windows the README says no Make is needed and the setup works in both Command Prompt and PowerShell. Docker Desktop must be running first. After cloning, copy the environment template into each module's directory, then start the production compose file.

```bat
git clone https://github.com/reconurge/flowsint.git
cd flowsint

copy .env.example .env
copy .env.example flowsint-api\.env
copy .env.example flowsint-core\.env
copy .env.example flowsint-app\.env
```

```bat
docker compose -f docker-compose.prod.yml up -d
```

Once the containers are up, the README points you at http://localhost:5173/register to create an account. There are no credentials and no account by default, so registration is the first thing you do. From there, create an entity in the graph and attach an enricher to it; the enrichment runs through the Celery worker and the resulting nodes and edges appear in the interface.

For anything beyond a single machine, the README gives a server recipe. The frontend serves the UI and proxies all API calls internally, so clients need no extra configuration, and only port 5173 is exposed. PostgreSQL, Redis, Neo4j and the API are bound to 127.0.0.1 on the server and are reachable only through that proxy. Before exposing the stack, the README says to change AUTH_SECRET, MASTER_VAULT_KEY_V1 and NEO4J_PASSWORD in .env. It gives the generation commands directly.

```bash
openssl rand -hex 32
python3 -c "import os, base64; print('base64:' + base64.b64encode(os.urandom(32)).decode())"
```

The first produces a value for AUTH_SECRET, the second for MASTER_VAULT_KEY_V1. You also have to add your server hostname or IP to the Host-header allowlist in flowsint-app/nginx.conf, in the map block keyed on $http_host. The default allowlist accepts only localhost, 127.0.0.1 and [::1], which the README frames as defence against DNS rebinding on single-user installs. The file contains two commented-out template lines showing the format. To pin a release instead of tracking latest, set FLOWSINT_VERSION in .env.

## Where Flowsint gets in your way

The most honest limitation is in the README itself: Flowsint is still in early development and, in the project's own words, needs the help of the community. That is a statement about API and interface stability, not a marketing caveat. If you build automation against the FastAPI routes, expect them to move between releases.

The second constraint is the Host-header allowlist. It is a sensible default, but it means a fresh server deploy is broken until you edit nginx.conf. The failure mode is confusing rather than loud: the UI is served, requests are rejected, and nothing in the compose output tells you the hostname was not on the list. Budget time for that edit before you announce an internal URL to anyone.

The third is enrichment quality. Flowsint orchestrates lookups; it does not perform them itself. Domain history, breach checks, wallet transactions and organization details come from whatever external sources the enrichers call, and the README does not document rate limits, quotas or what happens when a source starts returning errors. A graph built on a source that silently stops answering is worse than no graph, because the absence of edges looks like a finding.

Finally, the resource footprint is real. Neo4j, PostgreSQL, Redis, a Celery worker, the API and the frontend are six moving parts. On a laptop that is tolerable; on a small VPS you will feel it. And the compose files expose database ports in the development configuration, so a dev stack left running is not the same security posture as the production one.

## Flowsint compared with Maltego and the OSINT Framework

The obvious comparison is Maltego, and the difference is not the graph. Both draw entities and relationships on a canvas. The difference is where the transforms run and who can add one. Maltego's transform ecosystem is large and partly commercial, with a client that has long been the default in this space. Flowsint's enrichers are Python modules inside the repository, wired to a Celery worker and a Neo4j store you host. Adding a transform means adding a module to flowsint-enrichers and letting the orchestrator pick it up, not registering with a vendor. That is a genuine advantage for teams with internal data sources, and a genuine disadvantage if you wanted the breadth of a mature marketplace on day one.

The OSINT Framework is a different kind of tool altogether: a curated directory of links, not a data model. It is useful for discovery and useless for correlation, because nothing it points at shares a schema with anything else. Flowsint's value is precisely the shared schema in flowsint-types, which is what lets a domain, an IP and an ASN sit in one graph and be queried together.

If you want a hosted service with someone else's uptime commitment, neither comparison helps, and Flowsint is the wrong category.

## Licence, upgrades and what maintenance actually costs

Flowsint is Apache-2.0, and the repository carries a NOTICE file alongside the LICENSE, which is the standard Apache arrangement for attribution. The README also links an ETHICS.md and badges the project as ethical software, and there is a DISCLAIMER.md at the repository root. Read both before you point the breach and phone enrichers at real people; the licence governs the code, not your lawful basis for processing personal data, and nothing here is legal advice.

Upgrade cost is low if you stay on the published path. The production compose file pulls pre-built images from GitHub Container Registry, and FLOWSINT_VERSION in .env lets you pin a tag such as 1.2.10 instead of tracking latest. Releases have landed on a rough monthly cadence through mid-2026, with v1.2.12 on 2026-08-26, v1.2.11 on 2026-07-01 and v1.2.10 on 2026-06-05. The last push to the default branch was on 2026-09-20.

The cost that is not in the README is schema drift. Neo4j migrations live in neo4j-migrations, and the root package.json exposes a migrate script plus a dry run. If you pin a version and skip several releases, run the dry run before the real one, because graph schema changes are the part of an upgrade you cannot roll back by retagging a container. The README does not document rollback, so treat a version bump as a forward-only operation until you have tested it against a copy of your data.

## Conclusion

Adopt Flowsint if you run reconnaissance on domains, IPs, ASNs, organizations or wallets and want the graph and the raw data to stay on hardware you control; the README is explicit that everything is stored on your machine, and the single exposed port of 5173 makes a laptop or a trusted LAN the natural home. Do not adopt it if you need a stable platform API, a hosted service with an SLA, or a tool whose maintainers describe it as finished: the README says Flowsint is still in early development. Before you commit, verify three things on your own hardware: that your chosen FLOWSINT_VERSION tag exists and pulls, that your server hostname is added to the Host-header allowlist in flowsint-app/nginx.conf, and that your use of the email, phone and breach enrichers is lawful in the jurisdictions you operate in.

## FAQ

### What is Flowsint?

Flowsint is an open-source OSINT graph exploration tool for ethical investigation, transparency and verification, aimed at cybersecurity analysts and investigators. It lets you explore relationships between entities through a visual graph interface and automated enrichers.

### How do I install Flowsint?

On Linux or macOS, install Docker and Make, clone the repository and run make prod. On Windows, clone the repository, copy .env.example into .env and the three module directories, then run docker compose -f docker-compose.prod.yml up -d. After that, create an account at http://localhost:5173/register.

### How do I use Flowsint?

After registering at http://localhost:5173/register, you work in the graph interface: create entities such as domains, IPs or wallets and attach enrichers to them. The enrichers resolve, expand or look up each entity and add the resulting nodes and relationships to the graph.

### Is Flowsint safe?

The README states that everything is stored on your machine, and the production setup exposes only port 5173 while PostgreSQL, Redis, Neo4j and the API stay bound to 127.0.0.1. The README also says to change AUTH_SECRET, MASTER_VAULT_KEY_V1 and NEO4J_PASSWORD before exposing the stack to a network.

### What are the alternatives to Flowsint?

Maltego is the closest comparison, since it also draws entities and relationships on a graph canvas, but its transform ecosystem is largely external and partly commercial. The OSINT Framework is a curated directory of links rather than a correlated data model, so it serves discovery rather than graph analysis.

## Sources

- [License: Apache-2.0](https://github.com/reconurge/flowsint/blob/main/LICENSE)
- [Project website](https://flowsint.io)
- [README](https://github.com/reconurge/flowsint/blob/main/README.md)
- [reconurge/flowsint on GitHub](https://github.com/reconurge/flowsint)
- [Releases](https://github.com/reconurge/flowsint/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/reconurge-flowsint