ThreatRecall/zettelforge — Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-fir…

Description and use

**Brief Summary (2‑3 sentences)**
ThreatRecall / zettelforge is a Python library that adds “agentic memory” to cyber‑threat‑intelligence (CTI) workflows by building STIX‑based knowledge graphs, resolving threat‑actor aliases, and providing an offline‑first RAG layer. It ships a lightweight MCP server that lets Claude‑Code and LangChain agents query and update this memory, making it easy to stitch together repeatable multi‑agent pipelines.

**Value**

• **Unified CTI context:** By persisting STIX entities and alias mappings in a graph, agents can recall prior observations, enrich new alerts, and avoid duplicated effort.
• **Plug‑and‑play agent orchestration:** The MCP server exposes a simple API/CLI/SDK, so existing Claude‑Code or LangChain agents can be turned into “memory‑aware” tools with just a few configuration lines.
• **Offline‑first RAG:** The built‑in retrieval‑augmented generation component works without internet access, which is crucial for sensitive threat‑intel environments.
• **Standardised pipelines:** Developers can define reusable tool‑use pipelines (e.g., fetch OSINT → resolve aliases → enrich STIX → generate report) that are version‑controlled and reproducible.

**Practical Adoption Path**

| Step | Action | Reason |
|------|--------|--------|
| 1️⃣ | **Prototype** – clone the repo, spin up the MCP server locally (docker compose up or python -m zettelforge.server). | Quick “smoke test” of API endpoints and graph ingestion. |
| 2️⃣ | **Integrate** – add the Python SDK to an existing Claude‑Code or LangChain agent (pip install zettelforge). Replace ad‑hoc prompts with calls to client.query_memory(...) and client.update_graph(...). | Demonstrates the memory‑driven workflow without rewriting the whole agent. |
| 3️⃣ | **Validate CTI data** – import a sample STIX bundle (e.g., ATT&CK, MISP export) and run the alias‑resolution utilities. Verify that the graph reflects expected relationships. | Ensures the knowledge graph aligns with your organisation’s taxonomy. |
| 4️⃣ | **Add persistence & security** – back the graph with a production‑grade store (PostgreSQL, Neo4j) and enable TLS/auth on the MCP server. | Moves the prototype from a dev container to a secure, durable environment. |
| 5️⃣ | **CI/CD & monitoring** – package the server as a container image, add health checks, and instrument logs/metrics. | Provides the operational hygiene needed for production deployments. |
| 6️⃣ | **Roll‑out** – deploy the service in a staging environment, run end‑to‑end tests (e.g., “detect new IOCs → enrich → generate briefing”), then promote to production. | Final validation before exposing the service to analysts or automated pipelines. |

**Production Readiness**

• **Maturity:** Medium. The project is actively maintained (last commit 2026‑06‑27) and has modest community traction (≈50 ★, 7 forks). It is suitable for internal prototypes, PoCs, or “sandbox” CTI pipelines.
• **Dependencies:** Pure‑Python core with optional graph back‑ends; no heavyweight native binaries, which eases containerisation. However, you’ll need to audit third‑party packages for security and license compliance before a production rollout.
• **Operational considerations:**
• **Scalability** – the built‑in in‑memory store works for small‑to‑medium graphs; for large enterprise STIX datasets you’ll want to switch to an external graph DB.
• **Security** – the MCP server currently lacks built‑in auth/role‑based access; you’ll need to front it with an API gateway or add TLS + token validation.
• **Maintainability** – the codebase is concise (≈20 topics) but limited documentation; allocating a small engineering owner to track upstream changes is advisable.

Overall, ThreatRecall/zettelforge offers a compelling way to give CTI agents persistent, queryable memory and to orchestrate multi‑agent workflows. With a short integration effort and a clear path to hardening (auth, external storage, monitoring), it can move from prototype to production for internal threat‑intel automation.

Problem

ThreatRecall/zettelforge helps turn isolated prompts and tools into repeatable agent workflows.

Outcome

Medium: useful for prototypes or internal workflows, with dependency and maintenance checks before production.

Workflow

• coordinate multi-agent workflows
• add tool-use pipelines
• standardize agent memory

Evidence

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

Source