Sleuth
6 phase, 56 task agent workflow, consisting of; Operational Direction, Intelligence Collection, Collation & Entity Resolution, Chronological & Relational Processing, Hypothesis & Reasoning, concluding with the Final Report. Templates for every step,
What is Sleuth?
Sleuth is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to 6 phase, 56 task agent workflow, consisting of; operational direction, intelligence collection, collation & entity resolution, chronological & relational processing, hypothesis & reasoning, concluding...
6 phase, 56 task agent workflow, consisting of; Operational Direction, Intelligence Collection, Collation & Entity Resolution, Chronological & Relational Processing, Hypothesis & Reasoning, concluding with the Final Report. Templates for every step,
This server falls under the Coding Agents category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- 6 phase, 56 task agent workflow, consisting of; Operational
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx sleuthConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Sleuth
Sleuth is a structured OSINT (Open Source Intelligence) investigation framework for Claude Code and Claude Desktop that guides AI agents through a rigorous 6-phase, 56-task workflow. The phases cover Operational Direction, Intelligence Collection with Admiralty 6×6 source grading, Collation and Entity Resolution using Fellegi-Sunter probabilistic record linkage, Chronological and Relational Processing with UTC timeline construction, Hypothesis Reasoning via Analysis of Competing Hypotheses (ACH), and a final ICD 203-compliant report with SHA-256 hash audit and chain of custody. It is designed for investigative journalists, researchers, and analysts who need disciplined, reproducible intelligence tradecraft from an AI system.
Prerequisites
- Python 3.9 or higher installed
- Git to clone the repository
- Claude Desktop or Claude Code as the MCP client
- Optional: access to OSINT data sources (corporate registries, sanctions lists, domain data)
- Optional: self-hosted CSDb server for evidence archiving (./server/setup.sh)
Clone the Sleuth repository
Clone the repository from GitHub. Note the actual repo is at elb-pr/sleuth; the internal scripts folder refers to claude-sleuth.
git clone https://github.com/elb-pr/sleuth.git
cd sleuthInstall dependencies
Install all optional dependency groups to enable the full capability set including identity resolution, network analysis, sanctions screening, geo lookups, NLP, and document processing.
pip install ".[all]"Optional: set up the self-hosted evidence server
Start the CSDb evidence archiving server for SHA-256 hash-backed evidence preservation and chain of custody tracking.
cd server && ./setup.shRegister Sleuth as an MCP server in Claude Desktop
Add Sleuth to your Claude Desktop configuration file so it appears as an available MCP server.
{
"mcpServers": {
"sleuth": {
"command": "python",
"args": ["-m", "sleuth"]
}
}
}Start an investigation using the task runner
Use the built-in task runner to navigate the 56-task workflow. The runner enforces phase order and prevents advancing without completing required checklists.
python3 scripts/task_runner.py status # See current phase
python3 scripts/task_runner.py next # Show current task
python3 scripts/task_runner.py done # Advance after checklist
python3 scripts/task_runner.py jump t6.2 # Jump to specific taskSleuth Examples
Client configuration
Configure Claude Desktop to use Sleuth as an MCP server running via Python in the cloned project directory.
{
"mcpServers": {
"sleuth": {
"command": "python",
"args": ["-m", "sleuth"],
"cwd": "/path/to/sleuth"
}
}
}Prompts to try
Use these prompts with Claude Desktop after Sleuth is connected to run structured OSINT investigations.
- "Begin a Sleuth investigation into [subject name], define the scope and seed entities for Phase 1"
- "Grade this source using the Admiralty 6x6 scale and add it to the intelligence collection in Phase 2"
- "Run entity resolution on these three records to determine if they refer to the same person"
- "Build a UTC timeline from the collected evidence and flag any gaps where inference would be needed"
- "Apply the ACH matrix to the top three hypotheses and score them against the available evidence"
- "Generate the final ICD 203-compliant report with confidence levels and hash audit trail"Troubleshooting Sleuth
pip install fails for optional groups like 'sanctions' or 'corporate'
Some optional groups have system-level dependencies (e.g., libxml2 for document processing). Install them individually: `pip install ".[identity,social,network]"` and skip groups that fail, then install their system deps separately.
Task runner does not advance past a phase checklist
Sleuth enforces that all checklist items in the current task must be marked complete before advancing. Review the current task with `python3 scripts/task_runner.py next` and confirm each item, then run `done`.
Claude does not see Sleuth tools in Claude Desktop
Ensure the `cwd` in the MCP config points to the cloned sleuth directory, and that `python -m sleuth` runs without error from that directory. Check Claude Desktop's MCP server logs for startup errors.
Frequently Asked Questions about Sleuth
What is Sleuth?
Sleuth is a Model Context Protocol (MCP) server that 6 phase, 56 task agent workflow, consisting of; operational direction, intelligence collection, collation & entity resolution, chronological & relational processing, hypothesis & reasoning, concluding with the final report. templates for every step, It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Sleuth?
Follow the installation instructions on the Sleuth GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with Sleuth?
Sleuth works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Sleuth free to use?
Yes, Sleuth is open source and available under the MIT license. You can use it freely in both personal and commercial projects.
Sleuth Alternatives — Similar Coding Agents Servers
Looking for alternatives to Sleuth? Here are other popular coding agents servers you can use with Claude, Cursor, and VS Code.
Dify
★ 142.2kProduction-ready platform for agentic workflow development.
Ruflo
★ 54.0k🌊 The leading agent orchestration platform for Claude. Deploy intelligent multi-agent swarms, coordinate autonomous workflows, and build conversational AI systems. Features enterprise-grade architecture, self-learning swarm intelligence, RAG integrat
Goose
★ 45.7kan open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM
Antigravity Awesome Skills
★ 38.3kInstallable GitHub library of 1,400+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.
AgentScope
★ 25.5kBuild and run agents you can see, understand and trust.
Serena
★ 24.5kA coding agent toolkit that provides IDE-like semantic code retrieval and editing tools, enabling LLMs to efficiently navigate and modify codebases using symbol-level operations instead of basic file reading and string replacements.
Browse More Coding Agents MCP Servers
Explore all coding agents servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Sleuth in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Sleuth?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.