SecurityCipher
Home Blog About Us
Resources ▼
✅ Security Checklists Hub 🗺️ Penetration Testing Roadmap 🤖 OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist 🛠️ Security Tools 🎯 Penetration Testing Tricks 📄 Secure Code Explain 📖 Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Our ServicesServices
New On-Call Drive Drive the neon city, jack in, and clear security tickets Play now →
← Security Tools View on GitHub

Robin

AI-powered dark web OSINT tool for investigating underground sources.

Logo
Release GitHub Release Docker Pulls

Star History Rank GitHub Trending Repository of the Day

Robin: AI-Powered Dark Web OSINT Tool

Robin is an AI-powered tool for conducting dark web OSINT investigations. It leverages LLMs to refine queries, filter search results from dark web search engines, and provide an investigation summary.

Installation • Troubleshooting • Contributing • Acknowledgements

Demo

Architecture

Workflow


Features

  • ⚙️ Modular Architecture – Clean separation between search, scrape, and LLM workflows.
  • 🤖 Multi-Model Support – OpenAI, Claude, Gemini, Mistral, OpenRouter, Ollama, or any OpenAI-compatible API (LM Studio, llama.cpp, Groq, etc.).
  • 🔄 Live Model List – Models are discovered from each provider at startup, so new releases appear on their own and retired ones disappear. No hardcoded list to go stale.
  • 🎚️ Tunable Depth – Sidebar controls for how many results to filter, how many pages to scrape, and how much of each page the model reads, with the token cost shown before you run.
  • 🌐 Web UI – Streamlit-based interface for interactive investigations.
  • 💬 Conversational Follow-ups – Ask grounded follow-up questions about an investigation without re-running the search — answered from that investigation's own data.
  • 🔀 One-Click Pivots – Suggested follow-up queries surfaced from the findings; click one to launch a fresh investigation.
  • 🐳 Docker-Ready – Recommended Docker deployment for clean, isolated usage.
  • 🔍 Honest Results – When nothing relevant is found, Robin says so instead of summarizing whatever it happened to scrape.
  • 📝 Custom Reporting – Save investigation output to file for reporting or further analysis.
  • 🧩 Extensible – Easy to plug in new search engines, models, or output formats.

⚠️ Disclaimer

This tool is intended for educational and lawful investigative purposes only. Accessing or interacting with certain dark web content may be illegal depending on your jurisdiction. The author is not responsible for any misuse of this tool or the data gathered using it.

Use responsibly and at your own risk. Ensure you comply with all relevant laws and institutional policies before conducting OSINT investigations.

Additionally, Robin leverages third-party APIs (including LLMs). Be cautious when sending potentially sensitive queries, and review the terms of service for any API or model provider you use.

Installation

[!NOTE] The tool needs Tor to do the searches. You can install Tor using apt install tor on Linux/Windows(WSL) or brew install tor on Mac. Once installed, confirm if Tor is running in the background.

[!TIP] Provide your API key either in a .env file (copy .env.example) or as environment variables. One key is enough: Robin lists models for whichever providers it finds. Supported keys are OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY, MISTRAL_API_KEY and OPENROUTER_API_KEY.

For Ollama, nothing goes in your .env. Robin defaults to http://host.docker.internal:11434, which is what the recommended Docker install needs. Two things are still on you:

  1. Run the container with --add-host=host.docker.internal:host-gateway (the README command already does).
  2. Make Ollama listen on all interfaces, since it binds to 127.0.0.1 by default and a container cannot reach that. If you start it yourself, OLLAMA_HOST=0.0.0.0 ollama serve &. If it runs under systemd, sudo systemctl edit ollama.service, add [Service] and Environment="OLLAMA_HOST=0.0.0.0", then sudo systemctl daemon-reload && sudo systemctl restart ollama.

Running Robin directly with Python instead of Docker? Add OLLAMA_BASE_URL=http://127.0.0.1:11434 to override the default. See TROUBLESHOOTING.md if it still doesn't appear.

For any other OpenAI-compatible provider (LM Studio, llama.cpp, Groq, etc.), use the 🔌 Custom API Provider expander in the sidebar — no .env changes required. Enter the base URL, an optional API key, and optionally a model name if the provider doesn't expose /v1/models for auto-discovery.

Docker [Recommended]

  • Pull the latest Robin docker image
docker pull apurvsg/robin:latest
  • Run the docker image as:
docker run --rm \
   -v "$(pwd)/.env:/app/.env" \
   --add-host=host.docker.internal:host-gateway \
   -p 8501:8501 \
   apurvsg/robin:latest

[!TIP] To persist saved investigations across Docker restarts, mount a local directory:

docker run --rm \
   -v "$(pwd)/.env:/app/.env" \
   -v "$(pwd)/investigations:/app/investigations" \
   --add-host=host.docker.internal:host-gateway \
   -p 8501:8501 \
   apurvsg/robin:latest

Investigations are saved to the investigations/ folder in your working directory and can be loaded from the Past Investigations panel in the sidebar.

  • Open your browser and navigate to http://localhost:8501

Using Python (Development Version)

  • With Python 3.10+ and Tor installed, run the following:
pip install -r requirements.txt
streamlit run ui.py
  • Open your browser and navigate to http://localhost:8501

Troubleshooting

Empty model dropdown, Ollama not showing up, Tor resolve failed errors, 401s, or "no results found"? See TROUBLESHOOTING.md before opening an issue.


Contributing

Bugs go in Issues. Questions and feature ideas go in Discussions. See CONTRIBUTING.md before opening a pull request.


Acknowledgements

  • Idea inspiration from Thomas Roccia and his demo of Perplexity of the Dark Web.
  • Tools inspiration from my OSINT Tools for the Dark Web repository.
  • LLM Prompt inspiration from OSINT-Assistant repository.
  • Logo Design by my friend Tanishq Rupaal

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Product Security Engineer || AI Security

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • Cloud Misconfig Bounty Hunting in 2026: Open Buckets, Firebase, and Secrets
    Cloud Misconfig Bounty Hunting in 2026: Open Buckets, Firebase, and Secrets
    September 8, 2026/
    0 Comments
  • DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
    DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
    August 27, 2026/
    0 Comments
  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    August 25, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Security Checklists
  • Cybersecurity Jobs
  • Blogs
  • About
  • Contact
© 2026 SecurityCipher. All rights reserved. Privacy Policies · Terms & Conditions