ZettelForge documentation¶
ZettelForge is an open-source, self-hosted memory system for cyber threat intelligence. You store investigation notes, extract CTI entities such as CVEs, actor names, tools, indicators, and ATT&CK techniques, and retrieve the context later by asking a related question.
New here? Install ZettelForge, then follow the Quickstart to store and retrieve your first memory.
Two products, one core¶
There are two products:
- ZettelForge. You run the MIT-licensed Python package on infrastructure you control. This documentation covers the open-source project.
- ThreatRecall.ai. You use the managed SaaS instead of operating ZettelForge yourself. Review the current ThreatRecall.ai pricing tiers before you choose a plan.
Choose ZettelForge when you want to operate the memory service and control its local data path. Choose ThreatRecall.ai when you want a hosted service with plan-based limits and features.
Get started¶
ZettelForge 2.8.0 requires Python 3.10 or newer.
python -m pip install zettelforge==2.8.0
The core store-and-recall path runs without a hosted API key. Your first embedding-model use can download model assets. By default, LLM-generated synthesis connects to Ollama at http://localhost:11434 with qwen3.5:9b.
Continue with the Quickstart. If you prefer a browser workflow, follow Use the web interface.
Find the right documentation¶
- Learn the workflow: complete the Quickstart, then ingest your first CTI report.
- Complete a task: follow a how-to such as Store a threat actor or Set up the MCP server.
- Look up exact behavior: use the Configuration reference or Memory Manager API.
- Understand the design: read the Architecture and Two-phase pipeline explanations.
At a glance¶
| Property | Verified value |
|---|---|
| Current release | 2.8.0 |
| License | MIT |
| Python | 3.10 or newer |
| Default storage | SQLite with a LanceDB vector index |
| Default embeddings | fastembed nomic-ai/nomic-embed-text-v1.5-Q, 768 dimensions |
| Default LLM | Ollama at http://localhost:11434, model qwen3.5:9b |
This page describes ZettelForge 2.8.0. Use the release history when you maintain an older deployment.