penthertz/grimoire

Grimoire is a tool that collects more than 20 well-known security knowledge repositories, indexes all of their content into a single local search database, and serves a web interface where you can search across all of them at once. The idea is that instead of opening HackTricks in one browser tab, PayloadsAllTheThings in another, and the OWASP guides somewhere else, you type one search query and get matching results from every source at once, each linking back to the original file. The knowledge bases it indexes cover a wide range of offensive and defensive security topics. Included sources cover web application attacks (OWASP WSTG, OWASP API Top 10, cheat sheets), Active Directory attacks, command and control frameworks, mobile security (OWASP MASTG and MASVS), living-off-the-land references (GTFOBins, LOLBAS), reverse engineering (Ghidra docs, radare2, angr), hardware fault injection and chip glitching, Bluetooth and WiFi security, software-defined radio, OSINT, forensics and incident response, and compliance frameworks. The tool is a single Python script. Running it clones all the configured repositories to your machine, builds a SQLite full-text search index, and starts a local web server. After the initial setup there are no external calls at runtime, so it works fully offline. Search rankings use BM25, which is a standard approach for relevance scoring in full-text search. You can add your own notes or point it at an Obsidian vault and it will index those alongside the external sources. An optional MCP mode exposes the index to AI coding assistants like Claude or Codex, which can then query the knowledge base to look up techniques, build checklists, or compile cited guides on a topic. This mode has a read-only default that prevents the AI from running shell commands, with an opt-in mode for letting it detect and install tools under a restricted denylist. The project comes from Penthertz, a security firm, and is part of their RF-Swift toolkit. It requires Python and has no mandatory external services. No license is listed in the README.