Database

SQLite schema used by TI Agent for persistence.

The SQLite database (ti-agent.db) is created automatically in the same directory as server.js on first run. The server runs non-destructive migrations at startup — ALTER TABLE statements are wrapped in try/catch so already-existing columns are silently skipped.

config

Key/value store for all UI preferences. Values are JSON-serialized.

Key	Type	Description
selectedIds	string[]	Feed IDs selected for analysis
selectedModelId	string	Active Claude model
query	string	Analysis focus prompt
schedule	string	Schedule preference label
maxTokens	number	Claude max output tokens
datePreset	number	Index into date preset array
customFrom / customTo	string	Custom date range (YYYY-MM-DD)
disabledIds	string[]	Feeds temporarily disabled
deletedIds	string[]	Feeds permanently removed
feedOverrides	{ [feedId]: {name, url, xmlUrl} }	Renamed/re-pointed built-in feeds — merged onto the hardcoded feed list at render time. Edits to custom feeds update their custom_feeds row directly

custom_feeds

User-added RSS/Atom feeds.

Column	Type	Description
id	TEXT PK	Unique identifier
name	TEXT	Display name
xmlUrl	TEXT	RSS/Atom feed URL
url	TEXT	Human-readable site URL
category	TEXT	Feed category
color	TEXT	Hex color for UI
created_at	TEXT	ISO timestamp

reports

Generated briefings with full metadata.

Column	Type	Description
id	INTEGER PK	Auto-increment
timestamp	TEXT	Human-readable generation time
query	TEXT	Analysis focus used
date_from / date_to	TEXT	Date window
sources	INTEGER	Number of feeds selected
model_id / model_name	TEXT	Claude model used
input_tokens / output_tokens	INTEGER	Actual token usage
input_cost / output_cost / total_cost	REAL	Actual costs in USD
est_input_tok / est_output_tok / est_total_cost	REAL	Pre-flight estimates
body	TEXT	Full Markdown report
source_map	TEXT	JSON mapping {"1": {name, url}, ...} for citations
created_at	TEXT	ISO timestamp

hypotheses

Extracted threat hunting hypotheses. One row per hypothesis, linked to the report they were derived from. Re-extracting a report deletes and replaces all of its rows.

Column	Type	Description
id	INTEGER PK	Auto-increment
report_id	INTEGER	FK to reports.id (indexed)
priority	TEXT	critical | high | medium
category	TEXT	Network | Endpoint | Cloud | Identity | Supply Chain
title	TEXT	Short hunt title
hypothesis	TEXT	Hunting rationale with [N] citations
where_to_look	TEXT	Systems/logs/environments to search
data_sources	TEXT	JSON array of log sources / telemetry types
query_logic	TEXT	Pseudo detection-logic sketch
mitre	TEXT	JSON array of MITRE ATT&CK technique IDs/names
iocs	TEXT	JSON array of indicators/artefact patterns
refs	TEXT	JSON array of {label, url} resolved from the source report’s citations
created_at	TEXT	ISO timestamp