ARC: threat intel with AI that shows its work.

ARC (Advanced Research Capability) is a browser-based threat intelligence platform (TIP) for querying, enriching, and visualizing relationships in a hypergraph, with optional AI that shows every query it runs and cites the nodes it used. Vincent Passaro designed and built it as a research project and uses it for his own investigations. The relationships it traces link IP addresses, domains, file hashes, and hosting infrastructure.

Vincent Passaro designed and built ARC himself, on his own time, as an advanced research project; it was not built for an employer. He started it in February 2026 and develops it solo.

Vincent Passaro built ARC to bring agentic analysis to structured threat intelligence and to have a threat intelligence platform (TIP) he could customize to his own workflows. ARC’s Analysis Sidebar is the clearest result: given a question, it plans the pivots, runs the queries, and cites the nodes it used.

Vincent Passaro uses ARC as his working threat intelligence platform for his own investigations and research; ARC is for internal use only. Its workflows are built around threat intelligence analysis: tracing how indicators, infrastructure, and threat actors connect.

ARC uses AI in two optional features. Ask mode turns a plain-language question into a query and shows it before anything runs. The Analysis Sidebar takes on a whole line of inquiry: it plans the pivots, runs the queries, interprets the results, and cites the nodes it used. AI queries are read-only by default, and write queries need analyst approval.

ARC is neither open source nor publicly available: it is closed source and for internal use only, with no public release planned. The libraries it is built on are open source, including React, TypeScript, CodeMirror 6, Cytoscape.js, and MapLibre.

A hypergraph, the data model ARC works with, is a graph in which one relationship can link any number of nodes. In ARC, indicators, infrastructure, and threat actors are nodes in a hypergraph, reached with a hypergraph query language.

ARC uses the query language of the hypergraph service it connects to, a language built for filtering and pivoting across nodes and their relationships. ARC’s editor adds autocomplete for node types, properties, tags, and functions, hover descriptions drawn from the data model, and Vim and Emacs keybindings. Ask mode can also write a query from a plain-language question and show it before it runs.

ARC is a browser-based frontend and does not include its own backend. It connects to a hypergraph service over HTTP and WebSocket, and that service stores the data and runs the queries. ARC and the hypergraph service can both be self-hosted, so investigation data stays inside the environment they run in.

ARC works with Claude, OpenAI, Ollama for local models, and any OpenAI-compatible endpoint. In ARC, the model is a configuration choice, not a dependency.

ARC sends the AI provider the question, the data schema, and summaries of the relevant nodes. With a local model through Ollama, that data does not leave the network ARC runs on.

ARC’s AI features are optional. Without a configured provider, Ask mode and the Analysis Sidebar are hidden and the rest of ARC works the same.