otlite 1.2.0

Install, run, update and remove open-source tools by name.
One command interface for dozens of open-source intelligence (OSINT) tools, each in its own virtualenv.

Website · Documentation · Quick start · Typed inputs · Commands · Tools · FAQ · Tools · Team · Contact · Launch video

Watch the launch video on YouTube (1:31)

otlite is the no-Docker edition of OTInstaller. It installs tools with pip or git into per-tool virtualenvs on Linux and macOS, with no container runtime needed. The ot command is the other edition: it installs signed, scanned packages from the registry and runs them in a sandbox on Linux, macOS and Windows. Both share the typed inputs and the results/ layout, so you can use either, or both.

otlite was called otinstaller until version 1.0. pip install -U otinstaller now installs otlite, the old OTINSTALLER_* environment variables still work, and the first run copies your API keys and settings from ~/.otinstaller. See upgrading from otinstaller.

What it does

Every open-source tool installs and runs a little differently. otlite gives them one interface:

• Install by name. otlite install sherlock creates an isolated virtualenv for the tool. Nothing touches your system Python.
• Run with typed inputs. u:johndoe, e:john@example.com or d:example.com are translated into each tool's own flags.
• Run many tools at once. otlite run --all u:johndoe runs every installed tool that accepts a username, in parallel.
• Keep every result. Output is saved under ./results/<tool>/<target>/ with a .meta.json sidecar (command, timing, exit code, SHA-256).
• Update and remove cleanly. One command each, for one tool or all of them.
• Script it. Every command supports --json, and nothing prompts when --yes is given.

Why otlite

Running one tool by hand, spiderfoot in this case:

git clone https://github.com/smicallef/spiderfoot
cd spiderfoot
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python3 sf.py -u passive -s example.com

The same thing with otlite:

otlite install spiderfoot
otlite run spiderfoot -- d:example.com

The same install-and-run pattern works for every tool in the catalogue. Each tool is pinned to a tested version, gets its own virtualenv, has its typed inputs turned into its own flags, and saves its output with a timestamp and a SHA-256.

Quick start

curl -fsSL https://get.otinstaller.com/otlite | sh
otlite init
otlite install sherlock
otlite run sherlock -- u:johndoe

The installer finds a Python 3.10 to 3.14, installs pipx if it is missing and installs otlite with it. If you already have pipx, pipx install otlite does the same.

The full install options are below.

Requirements

Linux or macOS. Tested on Ubuntu 22.04 and 24.04, Debian 12, Arch Linux, Kali Linux (rolling) and macOS 14 on Apple silicon. On macOS, brew install python@3.12 git pipx gives you everything otlite needs; some tools are built for Linux first and may not run there.

Python 3.10 to 3.14, git, and the venv module. On Debian, Ubuntu and Kali, install that module with:

sudo apt install python3-venv git

Tools that need an older Python

Ubuntu 26.04 LTS and Kali ship Python 3.14, and otlite itself runs on it. A few managed tools only install on an older Python (listed below). To use them, run otlite inside a Python 3.12 virtualenv:

curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env
uv venv --python 3.12 ~/.otlite-venv
source ~/.otlite-venv/bin/activate
uv pip install otlite

A uv-created virtualenv has no pip, so the install command is uv pip install otlite. Run source ~/.otlite-venv/bin/activate again in any new terminal before using otlite. otlite doctor prints the Python version it is running under and lists any registered tool that needs a different one.

Python version caveats

Some managed tools only work on some Python versions. otlite checks before installing them and says which version to use, and otlite doctor lists the ones that won't install on your Python. Every tool was installed and run on Python 3.10, 3.12, 3.13 and 3.14 before 0.1.0. Known limits:

• ghunt: requires Python <3.14 (its dependency Pillow 10 has no wheels for 3.14 and needs the libjpeg headers to compile)
• auto-archiver: requires Python <3.13 (dependency pdqhash needs a C++ compiler, no wheel for 3.13+)
• telepathy: requires Python <3.13 (dependency googletrans/httpx uses removed cgi module)
• spiderfoot: requires Python <3.13 (its pinned lxml and cryptography have no wheels for 3.13+)
• theharvester: requires Python 3.12 or newer (its current release, 4.11.1, needs it)
• whatsapp-osint: requires Python 3.11 or newer (it imports datetime.UTC)

Install otlite

For system-wide installation, use pipx install otlite. This provides the otlite command on your PATH without a virtualenv. On Debian, Ubuntu and Kali there is also a .deb, built from debian/ by the CI; releases are on PyPI.

Alternatively, create a virtualenv and install from PyPI:

python3 -m venv ~/.otlite-venv
source ~/.otlite-venv/bin/activate
pip install otlite

Run source ~/.otlite-venv/bin/activate again in any new terminal before using otlite.

Install from source

To install from this repository (for development):

python3 -m venv .venv
source .venv/bin/activate
pip install -e .

Run source .venv/bin/activate again from this folder in any new terminal if the next command says otlite: command not found.

Check the machine with:

otlite doctor

doctor prints [ok], [note] or [problem] for the platform, Python, git, venv and pipx. Fix any [problem] line before you continue: each one ends with the command that fixes it on your system (apt, dnf, pacman or Homebrew).

Upgrading from otinstaller

otlite is the same program under a new name. pipx install otlite (or pip install -U otinstaller, which now pulls in otlite and keeps an otinstaller command that runs it) is all it takes. The first otlite command copies .env (your API keys), accepted.json and crash_reports.json from ~/.otinstaller to ~/.otlite. Tools installed by otinstaller stay in ~/.otinstaller/tools, because their virtualenvs hold absolute paths; run otlite install <tool> for the ones you use, then rm -rf ~/.otinstaller when you are done with the old copy. OTINSTALLER_HOME, OTINSTALLER_RESULTS_DIR and the other OTINSTALLER_* variables are still read when their OTLITE_* twin is unset, until version 2.0. Results in ./results need no change.

Run your first tool

init creates ~/.otlite/ and shows a responsible-use notice. It asks Do you accept? [y/N]. Type y and press Enter. Nothing can be installed until you do. If you go straight to otlite install, it shows the same notice and asks the first time. In scripts, run otlite init --yes first.

otlite init

Sherlock searches for a username. The install asks Install? [y/N]. The capital N means Enter alone means no, so type y to continue.

otlite install sherlock
otlite run sherlock -- someexampleuser123

The -- marks where otlite's own options end. Everything after it is passed to Sherlock. When the run finishes, otlite prints a path under results/ in the folder where you ran the command. That file is the tool's output.

To try a different tool, run otlite list and use its name in place of sherlock. Each tool has its own page in the documentation.

Typed inputs

Instead of remembering each tool's flags, use a typed input prefix:

otlite run sherlock -- u:johndoe
otlite run holehe -- e:john@example.com
otlite run dnstwist -- d:example.com

A tool can do something different for each input. MailAccess investigates an email address with e: and harvests the email addresses of a domain with d::

otlite run mailaccess -- e:john@example.com
otlite run mailaccess -- d:example.com

Each tool declares which input types it supports. Run otlite info <tool> to see its mapping. Plain arguments after -- are always passed to the tool unchanged, so every flag of the original tool still works.

Run every matching tool

otlite run --all u:johndoe
otlite run --all --live e:john@example.com

--all runs every installed tool that supports the given input type. Only u, e, p, d and url work with --all. Tools that need API keys or a login are skipped unless --include-credentialed is passed, and tools that ask questions while they run (such as ghunt login or the fsociety menu) are always skipped; run those on their own. Tools that monitor a target continuously (such as instagram-monitor) never run under --all or auto, because they do not exit on their own.

otlite auto <target> detects whether the target is an email, domain, URL or username and runs every installed tool that takes that input, passing it with the tool's own flag, the same way as a typed input. It skips the same tools as --all, and --include-credentialed works the same way. --type overrides the detection, for example --type phone. IP addresses are detected, but no tool takes an IP as a typed input yet, so auto reports that none match.

otlite playbook --list shows the playbooks that ship with otlite (domain-recon and username-investigation). To add your own, put YAML files in a playbooks folder in the directory you run otlite from; a file with the same name as a bundled playbook replaces it.

Command reference

Scripts and AI agents

Every command supports --json. Commands never prompt when --yes or -y is given, or when stdin is not a terminal. otlite's own errors exit with 1 (error), 2 (invalid input) or 130 (interrupted). For a single-tool run, the tool's own exit code is returned and also recorded in the .meta.json file.

The startup banner is only shown in an interactive terminal. It is never printed with --json or when output is piped, and OTLITE_NO_BANNER=1 turns it off completely.

For AI agents, see llms.txt.

Results

Results are saved to ./results/<tool>/<target>/ using the filename pattern <YYYYmmdd-HHMMSS>_<tool>_<target>_<runid>.<ext> plus a .meta.json sidecar. Results go to ./results/ in the folder where the command is run, so run it from the same folder each time, or set OTLITE_RESULTS_DIR to a fixed path.

Tools that ask for input, such as GHunt's login, setup wizards and menus, run on a pseudo-terminal when you are at one, so their prompts show up and the session is still saved. Values given to credential flags such as --cookie, --token or --password are written to .meta.json as ***.

results/sherlock/testuser/20260929-123456_sherlock_testuser_abc123.txt
results/sherlock/testuser/20260929-123456_sherlock_testuser_abc123.meta.json
results/sherlock/testuser/20260929-123456_sherlock_testuser_abc123.envelope.json

The .envelope.json file has the same shape for every tool, so a script or an AI agent reads them all the same way: envelope (the format version, 1), tool (name@version), runtime, input, started_at, ended_at, duration_ms, exit_code, status, entities (each {type, value}: the emails, domains, IPs and URLs found in the output, or the tool's own entities when it prints them in this shape), warnings and output (the raw file's path, SHA-256 and size). otlite run --json and otlite results --json give its path.

otlite results lists saved runs from their .meta.json files, newest first. Filter them with --tool, --target, --case, --status complete|failed|interrupted and --since 7d (or a date such as 2026-10-01), and sort with --sort time|tool|target|duration|size, adding --reverse to flip the order. It shows 50 runs unless --limit says otherwise (--limit 0 shows all), and --json prints every field for scripts.

otlite results --tool sherlock --since 7d
otlite results --status failed --sort duration --json

Results can contain personal data. Store and share them accordingly.

API keys

One env file holds all API keys: ~/.otlite/.env, permissions 600. From that file, each tool only receives the keys it declares in its registry entry. Tools also inherit your shell environment, so do not export secrets you do not want tools to see. Save a key with otlite keys set NAME: it asks for the value without showing it (or reads it from a pipe, or from another variable with --from-env VAR) and writes the file with the right permissions. otlite keys list shows the key names you have set and the tools that use them, otlite keys rm NAME removes one, and otlite keys check shows which keys the catalog's tools could use.

Resume

If a run or install is cut off by a crash, a kill or a power loss, otlite leaves a job marker in ~/.otlite/jobs/. Run otlite resume to handle it:

• For installs: cleans up partial state and retries the install.
• For runs: reports the interrupted run and prints the command to rerun.

Pressing Ctrl+C stops cleanly and removes the marker, so there is nothing to resume. Use otlite resume --dry-run to preview, and --json for machine-readable output. Partial output from interrupted runs is always kept.

Responsible use

otlite installs and runs third-party open-source tools. It does not create, own or verify them. Many are dual-use: used for fraud investigations, journalism, security research and compliance, but capable of misuse.

Use them only on targets you are authorized to investigate, and follow the laws that apply to you and the terms of the services you query. Do not use them to harass, stalk or harm anyone.

Tools tagged dual-use in the registry print a notice and ask for confirmation before installing, unless --yes is given. The full notice is accepted on first otlite init, and otlite init shows it again any time.

Tool catalogue

The registry ships 47 tools. By what they accept: 24 username, 14 email, 4 phone, 19 domain, 7 ip address, 11 url, 5 name. A tool that accepts several input types is listed under the first one.

Every page linked as docs shows the tool's source, install method, credentials, typed inputs and example commands. Missing a tool? Open an issue with its repository link. Each addition is installed, pinned to a commit and checked against its real flags before it ships.

FAQ

Does it work on Windows or macOS? macOS, yes, from 1.2. On Windows, inside WSL2 with Ubuntu. Most of the tools are built for Linux first, so a few may not run on macOS.

Do I need root? No. Root is only needed once, for sudo apt install python3-venv git. Everything else lives in your home directory under ~/.otlite/.

Does otlite send my data anywhere? otlite itself contacts GitHub and PyPI to install and update tools. It has no usage tracking. Crash reports are off unless you say yes: otlite init asks once, and Enter means no. If you turn them on, a report is sent only when otlite itself crashes, and it holds the error, where in otlite's code it happened, and the otlite, Python and OS versions, never your targets, command arguments, tool output, results, API keys, file paths or user name. Turn them on or off with otlite crash-reports on or off, and send a test report with otlite crash-reports test; DO_NOT_TRACK=1 or OTLITE_CRASH_REPORTS=off always turns them off. The tools you run contact the services they are built to query.

How do I uninstall it? otlite remove --all removes every tool, then pipx uninstall otlite removes otlite itself. rm -rf ~/.otlite deletes the config, the API key file and the logs. Results stay wherever you ran your commands.

Is it legal to use? The tools are legal to install. Whether a particular use is legal depends on where you are and what you are investigating. Read Responsible use before running anything against a real person.

Team

Sushant Koul Builder GitHub · LinkedIn

Dheeraj Yadav OSINTverse GitHub · X

Built by OSINTverse.

Contact

Email hi@osintverse.com for contributions, bug reports, new tool suggestions, or anything else. Bug reports can also go through issues.

If otlite saves you time, a star on GitHub helps other investigators find it.

X · LinkedIn · YouTube · Reddit · GitHub

License

Apache License 2.0. See LICENSE and NOTICE.

You can use, modify and redistribute otlite, including in commercial work. If you redistribute it or ship something built on it, the license requires you to keep the NOTICE file with your copy. Please credit it as "OTinstaller by OSINTverse" with a link to this repository.