{"repo":"ThreatRecall/zettelforge","free":true,"listed":false,"github":"https://github.com/ThreatRecall/zettelforge","clone":"git clone https://github.com/ThreatRecall/zettelforge.git","description":"Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents","language":"Python","stars":58,"topics":["claude-code","cti","llm","rag","threat-hunting","threat-intelligence","ai-agent","cybersecurity","knowledge-graph","mcp-server"],"license":"MIT","category":"ai-agents","readme_excerpt":"ZettelForge The only agentic memory system built for cyber threat intelligence. When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won \"wait, we've seen this before.\" ZettelForge is an agentic memory system built so that context stays with the team. It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports, resolves aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), builds a STIX 2.1 knowledge graph, and serves every past investigation back to your analysts — and to Claude Code via MCP — in natural language. Runs entirely in-process. No API keys. No cloud. No data leaves the host. Star · pip install zettelforge · Docs · ThreatRecall (hosted) · Changelog v2.6.2 (2026-04-27): Config web editor ships with working dropdowns for all enum fields (LLM/embedding provider, log level, PII action, synthesis format) and a working Apply button. New [crewai] extra exposes ZettelForge as CrewAI tools -- pip install zettelforge[crewai] . Full changelog If ZettelForge fits a CTI workflow you run, a star is the fastest signal that this category is worth continuing to invest in. The problem Every SOC loses analysts. When they leave, investigation context, actor attribution, and environment-specific false-positive patterns go with them. Their replacements re-open the same tickets, re-read the same reports, and re-build the same menta","default_branch":null,"files":null,"tree":[],"storefront":"/r/ThreatRecall","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ThreatRecall/zettelforge/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}