Skip to Content
Open source Investigation Platformv0.5.11

Scattered data in.Closed cases out.

Classifyre reads the systems you already run and finds the signals you define — then follows them across sources, like a detective, with an AI autopilot doing the legwork between scans.

Case file · 042
The Classifyre investigator — a detective cat on a green badge
The investigatorOn duty
Case open
One command · free · no signup

Run it on your machine

The database, the UI and the scan workers are all in the image. Everything — sources, findings, cases — stays on your machine.

docker run -d --name classifyre \  -p 3000:3000 \  --shm-size=1g \  -v classifyre-pgdata:/var/lib/postgresql/data \  -v classifyre-data:/var/lib/classifyre \  -v classifyre-uv-cache:/cache/uv \  classifyre/all-in-one:0.5.11
Helm chart · scales to any size

Or run it on Kubernetes

The same core as a Helm chart, with ephemeral scan workers that scale to zero between runs and fan out as far as your estate goes. Your cluster, your data.

helm install classifyre \
  oci://registry-1.docker.io/classifyre/classifyre-core \
  --version 0.5.11

Findings are evidence.
Cases are the product.

Most scanners stop at a findings table and wish you luck. Classifyre keeps going — every finding is evidence in an investigation somebody can actually work.

The pipeline
AUTOPILOT WORKS THIS SIDESOURCESdatabases · files · saasASSETSitems + metadataDETECTORSbuilt-in + your ownFINDINGSranked by importanceINQUIRIESstanding questionsDUPLICATESreview queue, pair by pairCASESevidence + hypotheses
A case, assembling itselfSwipe →
ANALYST LINKDUPLICATE MATCH · SENT FILE = INTERNAL FILECASE #42 · OPENClassified leak via emailHYPOTHESIS 1Sender traced: A. NovakHYPOTHESIS 2214 records exposedEMLIDTAGDUPBY AUTOPILOT
A classified file emailed out: sender traced, impact scoped, duplicate confirmed — all attributed.

Scan the systems you already own

Operational databases, lakehouses, collaboration tools, analytics assets, and public content, all feeding one evidence stream.

Custom Connector
Sandbox
WordPress
Slack
S3-Compatible Storage
Azure Blob Storage
Google Cloud Storage
PostgreSQL
MySQL
Microsoft SQL Server
Oracle
Apache Hive
Databricks
Snowflake
MongoDB
Neo4j
Power BI
Tableau
Confluence
Jira
Jira Service Management
SQLite
Notion
Email
YouTube
Reddit
Delta Lake
Apache Iceberg
Apache Kafka
Elasticsearch
OpenSearch
Meilisearch
Mounted Folder
Microsoft 365
Google Workspace
Dropbox
Hugging Face
Git Repository
Custom Connector
Sandbox
WordPress
Slack
S3-Compatible Storage
Azure Blob Storage
Google Cloud Storage
PostgreSQL
MySQL
Microsoft SQL Server
Oracle
Apache Hive
Databricks
Snowflake
MongoDB
Neo4j
Power BI
Tableau
Confluence
Jira
Jira Service Management
SQLite
Notion
Email
YouTube
Reddit
Delta Lake
Apache Iceberg
Apache Kafka
Elasticsearch
OpenSearch
Meilisearch
Mounted Folder
Microsoft 365
Google Workspace
Dropbox
Hugging Face
Git Repository
Source Catalog
Pick connector by category
38 Matches

Graph Databases

Graph-native stores with node and relationship traversal.

1 Sources

Streaming

Event streams and message brokers sampled for content.

1 Sources

Web & UGC

Public-facing websites and user-generated content.

1 Sources

Analytics & BI

Dashboards, reports, and business intelligence assets.

2 Sources

Other

Sources discovered in schema that have not been categorized yet.

1 Sources

Open your first case tonight.

Run it, point it at a system you already run, and see what the investigator finds. Everything you build carries over when you go remote with Helm.

docker run -d --name classifyre \  -p 3000:3000 \  --shm-size=1g \  -v classifyre-pgdata:/var/lib/postgresql/data \  -v classifyre-data:/var/lib/classifyre \  -v classifyre-uv-cache:/cache/uv \  classifyre/all-in-one:0.5.11