flowsint

Open source alternative to Maltego, IBM i2 Analyst's Notebook and Social Links

9.9K stars
Apache-2.0
Active this week
Last commit 3 days ago

Last verified Oct 21, 2026

Visualize entity relationships and investigate OSINT data on a self-hosted graph tool with pluggable domain, IP, social, and email enrichers.

Visit website GitHub9.9K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who flowsint is for#

Cybersecurity analysts mapping threat actor infrastructure

Connect domains, IPs, ASNs, and email addresses belonging to a threat actor in one graph. Run DNS, WHOIS, subdomain discovery, and IP geolocation enrichers to expand the picture automatically, then compile findings from the graph rather than reassembling them from separate tool outputs.

Skip if:

If your investigation workflow centers on a SIEM or proprietary threat intelligence platform that already imports IOC feeds, Flowsint adds a separate graph layer that may not integrate directly with your existing tooling without custom development.

OSINT researchers tracing cross-platform entity networks

Track an entity across social profiles, domain registrations, organization affiliations, and cryptocurrency wallets in a single graph session. The Maigret enricher runs username searches across social platforms, and the crypto wallet enrichers pull transaction histories and NFT holdings for blockchain addresses.

Skip if:

If your targets are restricted to structured data sources such as API feeds or public databases, a scripted approach without a graph layer is often faster for single-entity lookups where the relationship mapping overhead adds no value.

Investigative journalists tracing financial and organizational connections

Map company-to-domain, individual-to-organization, and domain-to-IP relationships visually. Add new entities by dragging them into the graph and enriching them on demand. Investigation history stays in one place rather than scattered across browser bookmarks and spreadsheets.

Skip if:

Flowsint has no built-in report generator. Journalists who need a structured output format for publication will need a separate reporting step or an n8n workflow that exports graph data into a document format.

Security teams running automated threat monitoring

Connect Flowsint to an n8n workflow to automatically collect and enrich data from new threat indicators as they appear. Route alerts to Slack or Teams when specific indicator patterns emerge in the graph. The server deployment mode makes the shared graph accessible to the full security team without each analyst running a local instance.

Skip if:

STIX 2.x export for sharing intelligence with external partners or loading it into a SIEM is on the roadmap but not yet implemented. Verify the current release before deploying if that integration is a hard requirement.

the problem

The problem it solves#

Investigating an unknown entity requires pulling data from many sources: DNS resolvers, WHOIS services, social media lookup tools, breach databases, and ASN registries. Each service returns results in its own format. Analysts end up copying findings between browser tabs and spreadsheets, and the connections between data points get lost as the investigation grows.

Commercial graph tools partially address this with a visual canvas, but they charge per-transform fees that scale with investigation size and store session data on their own infrastructure. For security researchers handling sensitive cases, sending subject data to a third-party commercial service raises legal and operational concerns that many organizations cannot accept. The alternative, a collection of standalone Python scripts, breaks whenever an upstream API changes its schema, and script outputs rarely connect automatically to an existing graph of discovered entities.

how flowsint solves it

How it solves it#

Interactive entity graph canvas

An interactive canvas displays entities (domains, IPs, individuals, organizations, social profiles, cryptocurrency wallets) as nodes and their connections as edges. The graph renders thousands of nodes without lag, and you can expand any entity directly from the canvas to trigger an enrichment run.

Pluggable REST and Python enrichers

Enrichers are simple REST endpoints or Python webhooks you register in Flowsint. The built-in set covers domain resolution, WHOIS, subdomain discovery, IP geolocation, ASN lookup, Maigret username search across social platforms, email breach checks, and cryptocurrency wallet transaction history. Add or replace any enricher without modifying the core graph.

Dynamic entity schemas with type safety

Entities use strongly typed schemas built from customizable field definitions: text, numbers, dates, and nested properties. Schema changes evolve without breaking existing graph data. The type system validates new entity data at insertion, so malformed enricher output does not corrupt the graph.

n8n workflow integration

Flowsint exposes a webhook connector that plugs directly into n8n, giving access to 500+ external services. Use it to set up automated OSINT collection from social media and public databases, trigger Slack or Teams alerts when specific indicators appear in the graph, or generate investigation reports on a schedule.

Self-hosted with encrypted API key storage

All investigation data stays on your server. API keys used by enrichers are stored in an encrypted vault rather than in plaintext config files. Only port 5173 is exposed to the network; PostgreSQL, Neo4j, and Redis all bind to localhost on the host machine, unreachable from outside.

strengths · trade-offs

Strengths and trade-offs#

Strengths

No per-transform or per-seat feesUnlike Maltego, which charges per transform run and gates advanced enrichers behind commercial tiers, Flowsint carries no transaction costs. Apache 2.0 licensed and self-hosted, so the only ongoing cost is your server. Investigation costs do not scale with graph size or the number of enrichers you run.
Full data ownership on your infrastructureInvestigation data, entity records, and API keys all stay on your machine. No subject data leaves your network to reach a third-party enrichment service. For analysts working on sensitive investigations or under legal constraints about data residency, this is the architecture that makes Flowsint usable where commercial tools are not.
Broad built-in enricher coverageThe built-in enricher set covers 25+ data sources across domains, IPs, ASNs, social profiles, emails, organizations, and cryptocurrency wallets, with n8n integration extending that reach to 500+ external services. The repository reached 8,341 GitHub stars and 1,028 forks since its January 2025 launch, with active pushes as recently as September 2026.
Developer-extensible without vendor permissionEnrichers are REST or Python webhook endpoints. Any developer can add a new data source, replace a broken API, or chain enrichers together without waiting for a vendor update. The modular codebase (flowsint-core, flowsint-api, flowsint-enrichers, flowsint-app, flowsint-types) keeps changes isolated.

Trade-offs

-Early development with incomplete test coverageThe README explicitly states that Flowsint is "still in early development" and that each module's test suite is incomplete. Breakage is more likely on self-hosted upgrades than on a more mature project. Budget time for debugging if you track the latest main branch rather than a pinned version tag.
-Multi-database self-hosting stackA full deployment requires Docker running PostgreSQL, Neo4j, and Redis simultaneously. Neo4j in particular is memory-intensive and adds operational overhead that typical Docker deployments do not require. Lightweight VPS instances under 2 GB RAM may struggle. The `make prod` command handles initial setup, but you own the ongoing maintenance.
-STIX 2.x support not yet availableFlowsint's public roadmap lists STIX 2.x (the standard format for cyber threat intelligence sharing) as planned but not implemented. Teams that need to import or export CTI in STIX format for sharing with partners or ingesting into a SIEM will not find that capability in the current release.

versus alternatives

flowsint vs alternatives#

Flowsint vs Maltego

Maltego is the dominant commercial graph investigation tool used by corporate security teams and government analysts. Both tools visualize entity relationships through a graph interface, but they differ on cost model, extensibility, and data residency.

Feature	Flowsint	Maltego
License	Apache-2.0	Proprietary
Self-hosting	Yes, Docker	No (desktop app with cloud transforms)
Enricher model	Open REST/Python webhooks	Commercial transform marketplace
Cost	Server costs only	Per-transform fees plus seat licensing

Flowsint is the better choice when data privacy requirements prevent sending subject information to a third-party service, or when investigation scale makes per-transform fees prohibitive. Maltego is worth considering when your team needs a large existing library of pre-built commercial transforms (ThreatConnect, PassiveTotal, Shodan) without building your own enrichers, and when UI polish and desktop integration matter more than self-hosting.

Flowsint vs IBM i2 Analyst's Notebook

IBM i2 Analyst's Notebook is an enterprise law enforcement and intelligence analysis product. The overlap with Flowsint is the visual entity relationship graph; the target market and deployment model differ substantially.

Feature	Flowsint	IBM i2 Analyst's Notebook
License	Apache-2.0	Proprietary
Deployment	Self-hosted Docker	On-premises enterprise install
Extension model	Open webhooks	IBM plugin ecosystem
Target market	Security analysts, OSINT researchers	Law enforcement, intelligence agencies

IBM i2 is worth the cost when your organization needs certified integrations with law enforcement databases, case management compliance features, or an enterprise support contract. Flowsint suits independent analysts, security teams, and organizations where IBM i2 licensing costs are not justified and where extending enrichers freely matters more than vendor support.

Social Links is a commercial OSINT enrichment service specializing in social media and identity resolution. It provides a Maltego transform library and a standalone search interface.

Feature	Flowsint	Social Links
License	Apache-2.0	Proprietary SaaS
Deployment	Self-hosted	Cloud-managed
Social enrichment	Via Maigret (open source)	Proprietary dataset access
Graph visualization	Built-in	Via Maltego integration

Social Links is worth considering when you need high-accuracy social media identity resolution from proprietary datasets not available through open sources. Flowsint's Maigret enricher covers username matching across social platforms using open lookup methods. For teams that need Social Links' proprietary dataset coverage alongside local graph storage, Flowsint can serve as the graph layer with a custom enricher that calls the Social Links API.

install · quick start

Quick start#

bash

Self-hosting uses Docker with PostgreSQL, Neo4j, and Redis; a single Make command handles the full stack on Linux and macOS.
```bash
git clone https://github.com/reconurge/flowsint.git
cd flowsint
make prod
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaScriptPythonTypeScript
Frameworks: FastAPIReact
Databases: PostgreSQL
Infrastructure: Docker
Cache: Redis

frequently asked

FAQ#

Is Flowsint free to use?

Yes. Flowsint is Apache 2.0 licensed and entirely self-hosted. There is no cloud tier, no per-transform fee, and no managed service. You run it on your own server and pay only for the hosting infrastructure. The Apache 2.0 license permits commercial internal use with no additional restrictions.

What does Flowsint require to self-host?

Docker is the only hard requirement. On Linux and macOS, a make prod command pulls pre-built images for the full stack: the TypeScript frontend, a FastAPI backend, PostgreSQL, Neo4j (the graph database), and Redis. Windows users run the same Docker Compose file without Make by copying the .env files and running docker compose -f docker-compose.prod.yml up -d. The README recommends rotating the default AUTH_SECRET, MASTER_VAULT_KEY_V1, and NEO4J_PASSWORD values in .env before exposing the server to a network.

Can Flowsint run without internet access?

The core application and local graph database work offline. Individual enrichers that call external APIs (WHOIS services, Maigret, breach databases, IP geolocation) require internet access to function. Investigations already stored in the local graph are accessible and editable without connectivity.

Does Flowsint support custom enrichers?

Yes. Enrichers are REST endpoints or Python webhooks that you write and host, then register in Flowsint. This means you can add any data source you have API access to, including internal databases, paid data providers, or proprietary feeds, without modifying Flowsint's core. The n8n connector also lets you chain Flowsint enrichment with 500+ external services through webhook-based workflows.

How does Flowsint compare to Maltego?

Flowsint is self-hosted and Apache 2.0 licensed; Maltego is a proprietary desktop application with per-transform fees and a managed cloud component. Flowsint's enrichers are open webhook endpoints you write or replace freely; Maltego transforms are distributed through a commercial marketplace. For teams that need data to stay on their own infrastructure and want an enricher model they can extend independently, Flowsint is the better fit. Maltego has a larger library of pre-built commercial transforms for teams that prefer purchasing integrations over building them.

also worth a look

Similar open-source tools#

Maigret

Alternative toSocial Links

Collect OSINT data by username effortlessly

39,239 GitHub stars
Licence MIT

Local Deep Research

Alternative toPerplexity AI

Your AI research assistant, fully local and encrypted.

9,372 GitHub stars
Licence MIT

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

345,900 GitHub stars
Licence MIT

Unkey

Alternative toKong Konnect

Unified API keys, gateways, and observability for developers.

5,471 GitHub stars
Licence FSL-1.1-ALv2

Shadowbroker

InSecurity & Monitoring

Real-time OSINT map: aircraft, ships, CCTV, satellites, self-hosted.

11,344 GitHub stars
Licence AGPL-3.0

WebCheck-OSINT

Alternative toShodan

44-check OSINT scanner for DNS, SSL, ports, CVEs, and TLS audits

343 GitHub stars
Licence MIT

by category

Open source tools in these categories#

126

Run flowsint on your own server

Self-host flowsint on a Hostinger VPS.

Deploy on Hostinger

Featured

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Flowsint vs Maltego

Feature	Flowsint	Maltego
License	Apache-2.0	Proprietary
Self-hosting	Yes, Docker	No (desktop app with cloud transforms)
Enricher model	Open REST/Python webhooks	Commercial transform marketplace
Cost	Server costs only	Per-transform fees plus seat licensing

Flowsint vs IBM i2 Analyst's Notebook

Feature	Flowsint	IBM i2 Analyst's Notebook
License	Apache-2.0	Proprietary
Deployment	Self-hosted Docker	On-premises enterprise install
Extension model	Open webhooks	IBM plugin ecosystem
Target market	Security analysts, OSINT researchers	Law enforcement, intelligence agencies

Social Links is a commercial OSINT enrichment service specializing in social media and identity resolution. It provides a Maltego transform library and a standalone search interface.

Feature	Flowsint	Social Links
License	Apache-2.0	Proprietary SaaS
Deployment	Self-hosted	Cloud-managed
Social enrichment	Via Maigret (open source)	Proprietary dataset access
Graph visualization	Built-in	Via Maltego integration

Who flowsint is for#

Cybersecurity analysts mapping threat actor infrastructure

Skip if:

OSINT researchers tracing cross-platform entity networks

Skip if:

Investigative journalists tracing financial and organizational connections

Skip if:

Security teams running automated threat monitoring

Skip if:

The problem it solves#

How it solves it#

Interactive entity graph canvas

Pluggable REST and Python enrichers

Dynamic entity schemas with type safety

n8n workflow integration

Self-hosted with encrypted API key storage

Strengths and trade-offs#

Strengths

Trade-offs

flowsint vs alternatives#

Flowsint vs Maltego

Flowsint vs IBM i2 Analyst's Notebook

Flowsint vs Social Links

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Data & Analytics

Developer Tools

Find open source alternatives to paid software

Who flowsint is for#

Cybersecurity analysts mapping threat actor infrastructure

Skip if:

OSINT researchers tracing cross-platform entity networks

Skip if:

Investigative journalists tracing financial and organizational connections

Skip if:

Security teams running automated threat monitoring

Skip if:

The problem it solves#

How it solves it#

Interactive entity graph canvas

Pluggable REST and Python enrichers

Dynamic entity schemas with type safety

n8n workflow integration

Self-hosted with encrypted API key storage

Strengths and trade-offs#

Strengths

Trade-offs

flowsint vs alternatives#

Flowsint vs Maltego

Flowsint vs IBM i2 Analyst's Notebook

Flowsint vs Social Links

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Data & Analytics

Developer Tools

Find open source alternatives to paid software