Sicry

Requirements

• Python 3.10+
• Tor daemon running locally
• pip packages (below)

2. Install Python dependencies

pip install -r requirements.txt

Or manually: ```bash pip install requests[socks] beautifulsoup4 python-dotenv stem

Installation

1. Install Tor

Linux (Debian/Ubuntu):

apt install tor
tor &

macOS:

brew install tor
tor &

Custom DataDirectory (recommended for renew_identity):

cat > /tmp/sicry_tor.conf << 'EOF'
SocksPort 9050
ControlPort 9051
CookieAuthentication 1
DataDirectory /tmp/tor_data
EOF

tor -f /tmp/sicry_tor.conf &

Tor setup

Quickstart

```bash

Optional — only needed if using the MCP server

pip install mcp

Optional — only needed if using OpenAI/Anthropic/Gemini LLM backends

pip install openai # for OpenAI pip install anthropic # for Anthropic/Claude pip install google-generativeai # for Gemini ```

3. Configure `.env`

cp .env.example .env

Minimum config — pick one LLM: ```dotenv

No-key option (local inference):

LLM_PROVIDER=ollama OLLAMA_MODEL=llama3.2

Environment variables

Copy .env.example to .env. All variables are optional — configure only what you need.

TOR_DATA_DIR is the most important Tor variable. Set it to Tor's DataDirectory path so renew_identity() can find the cookie file for authentication.

---

In .env

TOR_CONTROL_PASSWORD=mypassword ```

TorPool mode (optional)

When SICRY_POOL_SIZE=N (recommended 2–4), SICRY™ spawns N independent Tor processes and round-robins requests across them for higher throughput:

sicry_search  ─→  TorPool
                    ├── tor[0]  :9050  ← SOCKS5 proxy 0
                    ├── tor[1]  :9052  ← SOCKS5 proxy 1
                    └── tor[N-1]:...   ← SOCKS5 proxy N-1

Set in .env:

SICRY_POOL_SIZE=3   # 2–4 recommended; each uses ~50 MB RAM

Set TOR_DATA_DIR=/path/to/DataDirectory in .env

```

.onion fetch returns status: 0 The hidden service is down or Tor is slow. Try another URL from search(), or call check_search_engines() first to confirm Tor is reachable.

Search returns 0 results Dark web indexes go down frequently. Run check_search_engines() to find live engines, then pass them explicitly: search(query, engines=["Ahmia", "Ahmia-clearnet"]).

[SICRY™: OPENAI_API_KEY not set...] Set LLM_PROVIDER=ollama to use local inference with no key, or add the relevant key to .env. search(), fetch(), check_tor(), renew_identity(), scrape_all(), and check_search_engines() all work without any LLM key.

Slow searches Tor has variable latency. Use check_search_engines() to find the fastest live engines. engines=["Ahmia", "Ahmia-clearnet"] is the fastest reliable configuration.

Log spam / stem DEBUG output SICRY™ suppresses urllib3 and all stem sub-loggers (stem, stem.control, stem.response, stem.socket, stem.connection, stem.util) completely on import, set to CRITICAL with NullHandler and propagate=False. If you still see debug output, ensure you import sicry before configuring any root log handlers.

---

CLI reference

python sicry.py <command> [options]

Examples:

python sicry.py check
python sicry.py renew
python sicry.py search "ransomware healthcare" --max 15
python sicry.py search "bitcoin mixer" --engine Ahmia --engine Tor66
python sicry.py fetch http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion
python sicry.py tools --format openai | python -m json.tool
python sicry.py serve

---

Framework integration

The full OSINT pipeline

This is the recommended workflow. Each step applies a Robin pattern that makes a measurable difference in result quality:

```python import sicry

OSINT pipeline flow

The recommended 7-step pipeline (pipeline.py / The full OSINT pipeline section below):

  User query
     │
     ▼
[1] check_tor()            → verify Tor is active (abort if not)
     │
     ▼
[2] check_search_engines() → ping all 18, collect live engine list
     │
     ▼
[3] refine_query()         → LLM: natural language → ≤5 search keywords
     │
     ▼
[4] search()               → query all live engines in parallel over Tor
     │        ┌── Ahmia ──→ results
     │        ├── Tor66 ──→ results
     │        └── ...16 more (concurrent ThreadPoolExecutor)
     │
     ▼
[5] filter_results()       → LLM: pick top 20 most relevant results
     │
     ▼
[6] scrape_all()           → concurrent batch-fetch top pages over Tor
     │
     ▼
[7] ask()                  → LLM OSINT report (threat_intel / ransomware
     │                        / personal_identity / corporate)
     ▼
  Structured report

Troubleshooting

tor_active: False ```bash