otlite · Frameworks
Install SpiderFoot on Linux or macOS in one command
SpiderFoot runs two hundred-odd modules against a domain, IP, email, or username and links what they return into one graph. The CLI mode writes results to the terminal or a file; the web UI is optional.
SpiderFoot in three lines
pipx install otlite
otlite install spiderfoot
otlite run spiderfoot -- d:example.comRuns smicallef/spiderfoot (MIT, ★ 22k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.
What SpiderFoot is for
- Attack-surface mapping of a domain you are authorised to assess.
- Pivoting from one seed into related hosts, emails, and names.
- Passive-only runs (-u passive) when you must not touch the target.
Typed inputs for SpiderFoot
otlite translates these prefixes into SpiderFoot's own flags. Anything else after -- is passed through unchanged, so every original flag still works.
- d:
- Domain ·
otlite run spiderfoot -- d:example.com - ip:
- IP address ·
otlite run spiderfoot -- ip:203.0.113.7
Run every installed tool that takes the same input at once: otlite run --all d:example.com
Where the results go
Every run lands under ./results/spiderfoot/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff spiderfoot <target>, and pull indicators out with otlite extract spiderfoot.
Before you run it
- Installed from git rather than PyPI, so the first install takes longer.
- Many modules need their own API keys; without them SpiderFoot still runs but with fewer sources.
- A full scan can run for hours. Start with a passive scan and a module subset.
Update, remove, inspect
otlite info spiderfoot # inputs, keys, an example command
otlite example spiderfoot # sample output, where there is one
otlite update spiderfoot # move to the next tested version
otlite remove spiderfoot # delete its virtualenvFull reference: the otlite docs, and the tool's own README on GitHub.
Pairs with
FAQ
SpiderFoot with otlite, answered
How do I install SpiderFoot on Kali, Ubuntu, or macOS?
Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install spiderfoot. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.
Which inputs does SpiderFoot take through otlite?
d: (domain), ip: (ip address). otlite maps each prefix to SpiderFoot's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.
Where does otlite save SpiderFoot results?
Under ./results/spiderfoot/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff spiderfoot <target> to compare the last two.
Does SpiderFoot need an API key or a login?
No key is required for the basic run. Many modules need their own API keys; without them SpiderFoot still runs but with fewer sources.
Can I run SpiderFoot together with other tools?
Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including SpiderFoot. Save the combination as a playbook to repeat it.