Ryuzaki

Ryuzaki

A desktop app for recon and OSINT workbench.

One app for the whole analyst workflow. Import raw data, build relationship graphs, query intelligence sources, and collect evidence. Nothing leaves the machine unless you sign in and sync.

Tauri v2 Rust React 18 TypeScript Vite Tailwind React Flow Recharts Zustand Framer Motion
View showcase → See features

In progress

  • Improve recon capabilities
  • Fix hacker design
  • Add built-in terminal

What it is

A command center for investigative analysts

Most threat-intel platforms are cloud SaaS. Ryuzaki is local-first by choice. Parsing, storage, and graphing happen on-device, and every network request goes through a hardened Rust allowlist.

  1. 01
    The webview can't be trusted. Rust enforces every security boundary, not JavaScript.
  2. 02
    User data stays private by default. Datasets and evidence stay on the machine. Only optional Discord-signed-in graph sync touches the cloud.
  3. 03
    Everything funnels into one graph. Raw data, tool output, API lookups, and evidence all become nodes and edges in a single investigation canvas.

Features

Feature overview

2.1

Command Center (Dashboard)

An overview screen with KPI cards for datasets, investigations, graph nodes and edges, and evidence. Two Recharts visualizations read live state, a Node Type Breakdown and a 24h Activity Timeline. Intel panels cover the IoC Watchlist, Evidence Preview, API Health and Quotas, plus a Recent Activity Log and Quick Actions.

2.2

Investigation Graph (React Flow canvas)

The drag-and-drop entity-relationship canvas at the center of everything.

  • Typed entity nodes for IP, domain, hash, URL, email, note, and tool-result.
  • Multiple investigation tabs. Create, rename, duplicate, close.
  • Instant free lookups. Right-click an IP or domain and the app fires RDAP and DNS-over-HTTPS through Rust at the same time. Results enrich the node and fan out into child nodes.
  • Inline label editing, tool-result modals, and cloud sync. Graphs autosave to Supabase, scoped to your account with RLS, debounced, with offline retry.
2.3

Capture Parser (PCAP / CSV / JSON)

Parses PCAP, CSV, and JSON in a background Rust thread so the UI never blocks, and streams progress to the frontend as it goes. Results open in a searchable, sortable data grid with per-dataset tabs. It tells you the truth about truncation rather than hiding it: 250k row cap, UI state trimmed to 1000.

2.4

Dataset Ingestion → Graph Mapping

A wizard that maps an ingested CSV or JSON dataset onto graph entities. You pick a source column for node A, a target column for node B, an optional edge-label column, and a kind per node. It auto-detects, or you force IP, domain, hash, URL, email, or note. Then it builds a graph from the row relationships and previews the first rows.

2.5

Intel API Hub (DoH + RDAP)

A plugin-driven source hub with registered manifest plugins.

  • DNS over HTTPS. A and MX record lookups via the Google DNS JSON API.
  • RDAP. Domain registration and IP network ownership and abuse contacts. It is the WHOIS successor.
  • Credentials live in the OS credential manager, the keyring, never in plaintext.
  • Every query goes through Rust http_query: HTTPS only, hard host allowlist, no credentials in the URL, no redirects, 15s timeout, 1MB cap.
2.6

Evidence Board

A private workspace for collecting evidence. Drop images or files up to 50MB into an app-private directory and write analyst notes. Images render only from data:image/* URLs that Rust mints itself, so path traversal can't reach them. Right-click any card, or send all to the graph, and evidence becomes graph nodes.

2.7

Auth & Sync

Discord OAuth2 sign-in with PKCE over a ryuzaki:

Architecture

How it's built

Frontend

  • React 18, TypeScript, Vite
  • Tailwind CSS
  • React Flow (@xyflow/react)
  • Recharts
  • Zustand, with persistence
  • Framer Motion

Backend, Tauri v2 and Rust

  • reqwest does the HTTP proxy
  • csv and serde_json handle parsing
  • keyring talks to the OS credential manager
  • uuid, chrono, regex
  • base64, windows-sys
  • Strict CSP and isolation pattern

Persistence

  • localStorage for UI state, trimmed
  • OS keyring for secrets and the auth session
  • App-private evidence directory for files
  • Supabase for optional cloud graph sync
  • Discord OAuth2 and Supabase RLS

Security

Designed-in, not bolted-on

  1. 01
    No dangerouslySetInnerHTML anywhere. Every imported string renders as React-escaped text. Imported bytes can never become markup.
  2. 02
    Sanitization at the boundary. Control, zero-width, and format chars get stripped, whitespace collapsed, length capped. Entity kinds are validated against strict regexes.
  3. 03
    No data-derived URLs. Images only come from data: URLs that Rust mints itself. javascript: and data:text/html are impossible.
  4. 04
    Strict CSP. script-src 'self', connect-src ipc:, object-src 'none'. The isolation pattern adds an integrity-checking IPC origin.
  5. 05
    Single, explicit IPC surface. Only the commands listed in lib.rs are callable. No generic eval or command passthrough.
  6. 06
    Scoped filesystem access. FS plugin limited to $APPDATA/evidence/**. Path traversal is blocked twice, once by filename sanitization and again by canonicalize and prefix validation.
  7. 07
    Constrained network egress. Rust http_query enforces HTTPS only, a hard allowlist, no credentials in the URL, no redirects, a 15s timeout, and a 1MB cap.
  8. 08
    Secrets in the OS keyring. API keys and the auth session live in the credential manager. The frontend keeps only boolean flags.
  9. 09
    Data caps. Datasets cap at 250k rows, evidence at 50MB, and graph JSON at 2MB for cloud sync.

Some enrichment flows use locally generated mock or simulated data where a real third-party API needs credentials. Those paths are clearly labeled. Real API-backed paths run through the Rust backend.