A tool-calling agent with a sixteen-tool workbench that investigates the way a good analyst does. It forms competing hypotheses, tests them, notices its own blind spots on a scheduled skeptic pass, and stops when the next action is no longer worth its cost.
CrypsisX · Agent 47
You give Agent 47 one detail.
It works out the rest, shows where every fact came from, and stops when it has enough.
A name, a phone number, an email, a username, a face, a crypto wallet, a company or a document. Everything after the seed is automatic.
01 The loop
Eight moves, and it decides all of them.
Not a fixed script. A loop that plans, tests itself, and knows when to stop.
Seed
One identifier, a face, or a file. That is the entire input.
Plan
Objectives, phases and decision branches, drawn as a graph the analyst controls.
Collect
Across eight disciplines in parallel — only the collectors the plan calls for.
Validate
Every result classified into one of exactly three states before it is trusted.
Resolve
Identities disambiguated and merged — or abstained on, when the evidence will not carry it.
Reason
Competing hypotheses tested, blind spots found on a scheduled skeptic pass.
Stop
It halts when the next action is no longer worth its cost. It is not run to a timer.
Dossier
One evidence store, projected into a client report, an internal memo or a court pack.
A seed is a name, phone, email, face photo, username, crypto wallet, company or document. Everything after it is automatic — and every step above is recorded, so the loop can be read back after the fact.
02 How it works
Four parts, and none of them is a chat window.
Human judgement stays in charge of all four.
The analyst draws the investigation as a graph — objectives, phases, decision branches, evidence rules, notes and attached files. The Director reads that plan on every turn and must either follow it or formally log a deviation.
Every raw artefact is hashed into a custody chain the moment it lands. Every sentence in the final report is bound to a stored artefact ID. Uncited claims are stripped before the report is written — they cannot survive to the page.
One evidence store projects into three documents: a branded client report, an internal memo, or a court evidence pack with BNS / BSA 2023 statutory references, PII masking and DPDP-compliant access logs.
An analyst can retract a wrong entity without deleting the evidence behind it.
03 Capabilities
Eight disciplines, one evidence graph.
A firm normally buys four separate tools for this, and still does the reasoning by hand.
Identity & person intelligence
Resolving who is actually behind an identifier — before the investigation deepens on the wrong person.
- Cross-platform identity clustering
- Alias and variation discovery
- Abstention when evidence will not carry a match
Social & platform intelligence
Public presence across platforms, read as a structured record rather than a pile of screenshots.
- Profile and activity collection
- Connection and interaction mapping
- Coordinated-behaviour detection
Financial & crypto intelligence
Money movement traced end to end, including the join between on-chain and conventional rails.
- Multi-chain tracing with fiat stitching
- Mule-network and layering detection
- Ownership unwind to beneficial owners
Corporate & registry intelligence
Companies, directorships and corporate parents resolved against authoritative registries.
- Directorship and shareholding graphs
- Corporate-parent resolution
- Shell and nominee patterns across cases
Infrastructure & domain intelligence
The technical estate behind a fraud — the part that usually outlives the person running it.
- DNS, WHOIS and certificate history
- Phishing-flow reconstruction
- Typosquat and impersonation clustering
Image & face intelligence
Where a picture has been, what it carries, and whether it is what it claims to be.
- Reverse-image and face clustering
- EXIF and provenance timelines
- Mandatory PII masking on output
Document & file forensics
Certified forensic engines running in hardened sandboxes, writing into the same graph as the web evidence.
- Hashing, format ID and metadata extraction
- Error-level analysis, steganography, carving
- OCR and structured extraction from statements and IDs
Breach & exposure intelligence
What has already leaked about a subject, and what that opens up next.
- Exposed-credential discovery
- Historical dump correlation
- Continuous re-check as new corpora land
Governance, custody & access
The layer that decides whether any of the above is admissible, and who was allowed to see it.
- SHA-256 custody from artefact to page
- DPDP-compliant, tamper-evident access logs
- Prompt-injection resistance on collected content
04 Forensics & tradecraft
Look without being seen looking.
Investigation work has an observation problem: the act of checking a subject's page can tell the subject they are being checked.
Agent 47 includes a forensic browser with per-persona profiles, isolated cookies and controlled locale and timezone, so a subject's public page can be examined without that visit becoming a signal. Its egress and security posture are shown as live status rather than buried in documentation, and every action taken in the tab is recorded against the operator who took it.
Anything captured goes into the case with its hash in one action — so the difference between "I saw this" and "this is in evidence" is a single deliberate step, not a copy-paste.
01
A wall is not an absence
Bot challenges, sign-in walls, rate limits, geo-blocks and paywalls are classified as what they are. A source that never got to look is never recorded as having found nothing.
02
It will not go where it may not
Where a real browser could lawfully succeed, a blocked source is retried once through it. Sign-in walls and paywalls are never retried — it cannot lawfully pass either, so it does not try.
03
A retry cannot corroborate itself
A retried source is treated as the same upstream source, so a second attempt can never be counted as independent confirmation of the first.
04
The session is bound and authenticated
Each browser session is bound to one operator, one identity profile and one case, over a short-lived single-use credential. There is no setting that turns this off.
05 Compare
What Agent 47 does that the others don't.
All of it is architecture, not features — which is why it would take years to copy.
| Capability | Agent 47 | Link-analysis tools | Nation-state platforms | Generic LLM agents |
|---|---|---|---|---|
| Autonomous investigation loop | Director + 16 tools | Manual transforms | Semi-automated | Chat only |
| Un-run checks can never read as clear | Enforced in architecture | No | No | Hallucinates |
| Memory that compounds across cases | Built in, per firm | No | Manual ingest | No |
| File forensics in the same platform | 30+ sandboxed engines | No | No | No |
| Court-admissible custody chain | SHA-256 + BSA 2023 | No | Partial | No |
| Buyable by a four-person firm | Yes | Per-transform billing | No | Cheap, not usable |
Scroll the table sideways →
Every plan gets the whole engine.
06 Who it is for
The same product, four sets of outputs.
One engine. What changes is which documents come out of it.
State cyber cells, economic-offence wings and financial-crime units. This is where the platform was born. Air-gapped on-premise edition, long procurement, impossible to displace once in.
Small teams, fast decisions, and a case load that maps one-to-one onto how the product is priced. Over ten thousand investigators and agencies operate in India with almost no modern software.
Fintechs, banks, neobanks and screening firms. Tens of millions of background checks run in India every year, and compliance teams still clear the false positives by hand.
Agencies protecting founders, executives and public figures. They need to know what exists about a client online, who is impersonating them, and where a deepfake is spreading — the same collection engine, pointed inward.
01
Land
One paid pilot on one matter type. Two weeks, not two quarters.
02
Prove
Run your live case load beside your current manual process, and look at the difference.
03
Expand
More seats, more matter types, firm-wide holdings switched on.
04
Compound
Cross-case memory. Your graph is worth more every month you stay.
Bring us your hardest open matter.
That is a better demo than anything we could script.
For law enforcement, investigation firms, compliance teams and institutional partners. Pricing is shared on request.