Perfect for Journalists, Researchers & Private Investigators.

and yes...you. It's okay. I built the thing and I am none of those either.

It is 11:14 p.m., Tuesday. November, which is obvious from the condensation wrapping the edges of the glass, forming droplets and slow patterns amongst the damp Cladosporium at the bottom of the frame. The flat is in Peckham, third floor, and the only light on is the desk lamp, which throws a cone of yellow that could be mistaken for old nicotine stains, planting itself into the wall directly above the monitor. The monitor disagrees, pushing back with a cold blue of its own. Everything else besides the edges of a pair of cheekbones and the occasional puff of smoke being aspirated past the amalgamation of ugly colour is left in a particular dark. The room smells of cold coffee and something faintly organic behind it, the slow exhalation of a building at night, and Sarah has been using both to stay present for the last two hours.

Sarah Lawton is 34. She is a freelance investigative journalist, which in practice means she works alone, pays for her own PACER access, and has developed, over eleven years, a finely calibrated sense of when a set of numbers is lying to her. She is small, with close-cropped hair and the particular stillness of someone who has learned that patience is a professional skill. Her colleagues describe her as "relentless." Her editors describe her as "a nightmare to commission, impossible not to publish." She has a name on her screen, a company registration in the Cayman Islands, a beneficial owner who appears in three separate jurisdictions under two slightly different spellings, and a series of transfers that do not quite resolve.

She has been staring at this for six hours. She opens a terminal.

The skills/claude-sleuth folder is uploaded as a Claude skill. Claude reads the SKILL.md. The task runner activates.

git clone https://github.com/elb-pr/claude-sleuth.git
cd claude-sleuth
pip install ".[all]"
python3 scripts/task_runner.py next

The terminal returns a single line. Task 1.1. Operational Direction. Before the investigation collects a single source, it requires a subject, a PLAN document, and a set of seed entities. Sarah reads it twice. She has been working this case for six hours without any of those three things formally documented. She opens a new file.

python3 scripts/task_runner.py next      # read current task and required resources
python3 scripts/task_runner.py done      # verify checklist, advance to next task
python3 scripts/task_runner.py status    # progress overview by phase
python3 scripts/task_runner.py notebook  # view the Investigation Notebook
python3 scripts/task_runner.py jump t6.2 # jump to a specific task

It takes her forty minutes to complete Task 1.1. She types done. The checklist has seven items. Five pass immediately. The sixth — PLAN justification, the formal statement of why this investigation is in the public interest — requires a rewrite. She rewrites it. The seventh passes. The task runner advances to 1.2.

By midnight she is in Phase 2, and the Admiralty scale is the first thing that slows her down.

The forum post she found at 9 p.m., the one with the account number and the name of a shell company, has no author, no date, and no corroborating link. source_grader.py returns it as F-6. Reliability F: the source cannot be assessed. Credibility 6: truth cannot be judged. The script does not argue. It logs the source and sets it aside. Sarah has used that post as a mental anchor for the last two hours. She deletes the note referencing it and starts again.

The ICD 203 scale is the second thing that slows her down. She types "the transfers are probably linked to the holding company in Malta" and the pipeline does not accept it. Probably is not a term. She looks at the scale.

She thinks about it for a moment. She types: likely. 55 to 80 percent. The pipeline accepts it.

Six phases. Each one contingent on the last.

flowchart LR
    P1["Phase 1\nOperational\nDirection"] --> P2["Phase 2\nIntelligence\nCollection"]
    P2 --> P3["Phase 3\nCollation &\nEntity Resolution"]
    P3 --> P4["Phase 4\nChronological &\nRelational"]
    P4 --> P5["Phase 5\nHypothesis\nReasoning"]
    P5 --> P6["Phase 6\nFinal Reporting"]

    P1 -.- P1a["STEEPLES\nPLAN justification\nSeed entities"]
    P2 -.- P2a["Source grading\nEvidence hashing\nTiered collection"]
    P3 -.- P3a["POLE records\nFellegi-Sunter\nEntity resolution"]
    P4 -.- P4a["UTC timeline\nDiGraph analysis\nMedia authentication"]
    P5 -.- P5a["ACH matrix\nSensitivity analysis\nDeception analysis"]
    P6 -.- P6a["ICD 203 briefing\nHash audit\nCSDb closure"]

The toolkit is fifteen Python scripts.

At 1 a.m. Sarah runs financial_analysis.py against the target company's SEC EDGAR filings. Benford's Law flags the distribution of leading digits across three years of reported transactions. The expected frequency of the digit 1 is 30.1 percent. The observed frequency is 14.3 percent. The script marks it as anomalous and logs the finding with a confidence rating. She stares at it for a long moment. Then she opens the notebook and types a new entry.

Python 3.10 or higher.

The zip is downloaded, or the repository is cloned, and the folder is dropped into Claude.

git clone https://github.com/elb-pr/claude-sleuth.git
cd claude-sleuth

pip install .
pip install ".[all]"
pip install ".[geo,graph,sanctions,corporate]"

python3 scripts/setup.py --modules core geo graph sanctions corporate
python3 scripts/setup.py --list
python3 scripts/setup.py --dry-run all

Three servers. Two are hosted. One is self-hosted. Server URLs go in .claude/mcp.json.

By 1:30 a.m. the Pigeon Superstition Superposition profile has sixteen sections. Sarah has built it entirely from public documents: company filings, a deposition transcript from 2017, a pattern of director appointments made consistently in the two weeks before quarterly reporting periods, and three interviews the subject gave to trade publications in which his description of the company's structure changed in ways that are small and specific and, she now suspects, deliberate. The profile does not require an interview. It does not require access. It requires the record, and the record is extensive.

cd server
./setup.sh

CSDb stores every entity, every timeline entry, every graded source across sessions. When Sarah closes the laptop and opens it again in the morning, the investigation is exactly where she left it.

It is nearly 2 a.m. The mug is cold and has been cold for a long time. Sarah has not moved from the desk in three hours. On the screen: a single document, a chain of attributed findings, each one carrying a source grade, a hash, a confidence rating from a fixed scale. The forty-seven tabs are gone. The beneficial owner with two spellings of his surname is one person and always was. The gap between March and July 2021 has a label: outstanding line of inquiry, flagged for follow-up. Hypothesis 2 is alive. Hypothesis 1 is dead.

She reads the summary back. The transfers are very likely part of a sanctions evasion scheme. Very likely. 80 to 95 percent.

That is enough to go to print.