Show HN: VoidAccess – open-source dark web OSINT, from query to a graph

What it is

VoidAccess is an MIT-licensed, self-hosted dark web OSINT tool (GitHub, 882 stars at fetch time). It positions itself as a free alternative to Recorded Future, DarkOwl and Flare. The README frames it for security researchers, threat-intelligence teams and authorized investigators.

What to do

The README's quick start installs from PyPI and runs a shallow investigation without an LLM or Tor:

pip install voidaccess
voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow
voidaccess list
voidaccess actors
voidaccess status

--no-llm and --no-tor make a first run possible with no LLM provider and no Tor setup. list, actors and status inspect stored investigations, tracked actors and system state. The README does not describe their output.

For full vector embeddings, install the optional NLP extra:

pip install "voidaccess[nlp]"

Preconditions / Affected

• Sources that need API keys are skipped cleanly when the keys are absent, so a partial configuration still runs. The key reference is in the project's Architecture document.
• Without the embedding stack, the default install runs without PyTorch. It logs that it is using a deterministic SHA-256 fallback encoder. That fallback is a hash, not a sentence-transformer, so similarity results from it should not be read as semantic.
• ScrapingAnt can proxy optional clearnet requests with --use-scraping-api or --use-proxies. Tor, .onion, GitHub and GitLab traffic is not routed through it.
• The full stack (PostgreSQL, Tor, FastAPI, Next.js) runs under Docker Compose. A self-hosting guide covers guided setup, environment configuration, operations and troubleshooting.

Caveats

The README states that use is for authorized security research and threat-intelligence work only, and points to a Usage Policy. Content-safety filtering is described as mandatory pipeline gates for queries, URLs, content and extracted entities. The README gives no accuracy figures, source coverage numbers or LLM provider details in the fetched text. Pipeline timeouts and recovery behavior are documented only in the linked Architecture page.