> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> AI-powered threat intelligence briefing tool powered by Claude.

**TI Agent** is a full-stack local application that fetches real security articles from RSS/Atom feeds, passes them to Claude for analysis, and produces structured threat intelligence briefings with inline citations linking directly to source articles.

> [!NOTE]
>
> [GitHub Repository](https://github.com/tasox/ti-agent)

Unlike tools that prompt an LLM with feed URLs and hope for the best, TI Agent **actually fetches and parses the feeds server-side**, filters articles to your chosen date window, and sends the real content to Claude. Every claim in the report traces to a specific article, and every `[N]` citation is a clickable link.

Beyond briefings, the **Hunt** tab turns any saved report into structured, citation-grounded threat hunting hypotheses and merges a selection into one consolidated, filterable HTML dashboard — usable with either a metered API key or a local Claude Code subscription login.

## Features

> [card] 97 Built-in Security Feeds
>
> Across 6 categories: IOC Feeds, Vulnerabilities, Threat Intel, Red|Blue|Purple, Security News, CTF & Learning.

> [card] Real RSS/Atom Ingestion
>
> Articles fetched and parsed server-side, filtered to your date window before Claude sees them.

> [card] Inline Citations
>
> Every factual claim is followed by `[N]` badges linking to the source article. References rebuilt from the source map — no duplicates.

> [card] 4 Export Formats + Bulk
>
> Markdown, HTML, PDF (dark theme, print-ready), DOCX. Bulk-export one, several, or all reports at once.

> [card] Threat Hunt Hypotheses
>
> Derive citation-grounded hunting hypotheses from any saved report. Merge into one consolidated, filterable HTML dashboard (light or dark theme).

> [card] Claude Subscription Auth
>
> Extract hypotheses via a local, logged-in Claude Code CLI — no API billing, no key needed for Hunt tab.

> [card] Feed Management
>
> Enable, disable, rename, re-point, or permanently delete any feed. Edit custom feeds in place.

> [card] Config Export / Import
>
> Snapshot and restore your entire configuration (feeds, preferences) as JSON.

> [card] Cost Tracking
>
> Per-run token usage, actual vs. estimated cost accuracy, and 30-day budget projections.

> [card] 4 Claude Models
>
> Haiku 4.5 (default), Sonnet 4.5, Sonnet 4.6, Opus 4.5.

## Report Sections

Every generated briefing follows this structure:

| # | Section | Description |
| - | - | - |
| 1 | Data Window | Date range covered and article count |
| 2 | Executive Summary | 3-4 sentence CISO-level summary with citations |
| 3 | Top Threats | Up to 5 ranked threats (CRITICAL / HIGH / MEDIUM) |
| 4 | IOC Highlights | Real IOCs from articles — IPs, domains, hashes |
| 5 | CVE Watch | Explicitly mentioned CVEs in table format |
| 6 | Threat Actor Spotlight | Named actors with TTPs and MITRE IDs |
| 7 | Analyst Recommendations | 3 actionable steps |
| 8 | MITRE ATT\&CK Coverage | Techniques in table format |
| 9 | References | Complete deduplicated list of cited articles |

## Hunting Hypotheses (HUNT Tab)

The **🎯 HUNT** tab turns already-saved reports into structured, actionable threat hunting hypotheses, then merges a selection into one consolidated interactive HTML dashboard.

1. Select one or more saved reports (checkboxes).
2. Click **⚡ GENERATE CONSOLIDATED HTML** — this extracts hypotheses for any that don't have them yet, then merges everything into a single downloadable file with category and date filters.

### Auth Modes

| Mode | How it works | Cost |
| - | - | - |
| **API Key** *(default)* | Uses the Anthropic API key from CONFIG tab | Metered, billed per token |
| **Claude Subscription** | Shells out to a local `claude` CLI (`claude -p`) | Uses Claude Pro/Max subscription — no API billing |

### Hypothesis Fields

| Field | Description |
| - | - |
| `priority` | `critical` \| `high` \| `medium` |
| `category` | `Network` \| `Endpoint` \| `Cloud` \| `Identity` \| `Supply Chain` |
| `title` | Short one-line hunt title |
| `hypothesis` | 2-4 sentence hunting rationale with `[N]` citations |
| `where` | Systems/logs/environments to look in |
| `data_sources` | Specific log sources or telemetry types |
| `query` | Pseudo detection-logic sketch |
| `mitre` | MITRE ATT\&CK technique IDs and names |
| `iocs` | Specific indicators or artefact patterns |
| `refs` | `{label, url}` pairs resolved from source report's citations |

## Supported Claude Models

| Model | API ID | Input | Output | Best for |
| - | - | - | - | - |
| Haiku 4.5 *(default)* | `claude-haiku-4-5-20251001` | \$1.00/1M | \$5.00/1M | Daily briefings, high volume |
| Sonnet 4.5 | `claude-sonnet-4-5-20251101` | \$3.00/1M | \$15.00/1M | Balanced quality and cost |
| Sonnet 4.6 | `claude-sonnet-4-6` | \$3.00/1M | \$15.00/1M | Latest capabilities |
| Opus 4.5 | `claude-opus-4-5` | \$5.00/1M | \$25.00/1M | Deep analysis, complex reports |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.