zettelforge

Based on the available evidence, zettelforge is best framed as an early open-source CTI memory-layer project worth watching, not yet something we can call broadly adopted. The heat proof here comes mainly from two X posts and GitHub listings, which show that people in security/agent circles noticed and shared it. But usability proof is still thin: there is no visible star-growth evidence in the provided sources, no issue-level discussion, no independent long-form reviews, and no substantial public hands-on reports, so adoption claims should stay conservative.

In practice, this is not a general chatbot and not a full threat-intelligence platform. A better analogy is a structured memory and retrieval substrate for CTI agents. From the repo text and reposts, the supported claims are Python implementation, STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, and MCP/server integrations for workflows around tools like Claude Code and LangChain. That suggests its main value is helping teams turn scattered threat data into retrievable, linkable context for downstream agent workflows.