Coeus 2.0: one build for home and work

Update, 6 November 2026. Coeus no longer has accounts; everything it keeps is stored in your browser.

Coeus 1.x had a problem nobody outside the repository could see: there were two of it. One build carried the public OSINT sources. The other was a private branch with a colleague's SIEM, a ticket search and an internal reputation source pasted into the same pack. Every time a public source changed a URL, both had to be edited. Every time somebody else needed it, they were handed a zip and a paragraph of instructions.

2.0 removes the private branch. There is one extension, and the sources it traces are data rather than code.

Sources became packs#

A source is one place an entity can be sent: a URL template plus the entity types it accepts. A pack is a named list of sources with an id and a version. Coeus now ships one built-in pack of 48 public sources, saves everything you add in a second pack called My sources, and can subscribe to any number of packs published at a URL.

{
  "schema": 1,
  "id": "acme-soc",
  "name": "ACME SOC",
  "version": "2026.09",
  "sources": [
    {
      "id": "acme-siem",
      "name": "ACME SIEM",
      "desc": "Last 7 days of events for this entity",
      "tags": ["siem"],
      "auth": true,
      "url": {
        "ip": "https://siem.example.com/search?q={ioc}&range=7d",
        "domain": "https://siem.example.com/search?q={ioc}&range=7d"
      }
    }
  ]
}

That is the whole format. Nothing in a pack executes; a pack only ever produces URLs that Coeus opens in a tab. The full reference — every key, every placeholder, and the four legacy shapes the importer still accepts — is in the pack format docs.

Two details matter when a pack travels. First, a url key can be a concrete type (sha256) or a group (hash), and the concrete key wins, so one source can give SHA-256 its own template and let MD5 and SHA-1 fall through to a search endpoint. Second, any source you add yourself can be marked localOnly, which pins it to chrome.storage.local in that one browser. Internal hostnames never reach a pack file and never reach the browser's sync storage.

Subscriptions instead of a wiki page#

Publish a pack at a URL the intended browsers can reach and share the URL. Coeus asks for permission to read that one origin before the first fetch — decline and the subscription is simply not added — then refreshes it on the schedule in Settings using If-None-Match. Serve an ETag and a refresh costs one 304. When a refresh fails, the previous copy stays in use and the Packs page shows the error rather than silently emptying your menu.

The practical effect is that "who has the current pack" stops being a question. Edit the file, and every subscribed browser's pack changes within the refresh interval.

Verdicts, from your keys#

1.x opened tabs. That is still the fastest thing Coeus does, but half of a triage pass is answering one question — is this thing known bad — and opening eight tabs to find out is a poor way to spend thirty seconds.

2.0 adds tracing. Paste a free API key for VirusTotal, AbuseIPDB, urlscan.io, Shodan, AlienVault OTX, GreyNoise, IPinfo, abuse.ch, NVD or crt.sh, and Coeus reads the ones that answer for that entity type, then shows a consensus bar and one card per source in Chrome's side panel. Each card carries the facts that source is actually good at, its own verdict, and a meter for the quota you have left this minute and today.

The keys never leave the browser where you typed them. They live in chrome.storage.local, are excluded from sync and from exports, and are sent only to the source that issued them, from a host permission you granted for that one origin. Private and reserved address ranges are filtered before any external source is called. There is more on this in where your API keys live and in the privacy design.

Scan this page#

The other new surface is the page scan. Trigger it from Ctrl+Shift+K, the page context menu, or the popup, and Coeus walks the text nodes of the page you are reading, marks every entity it finds with a dotted bronze underline, and offers a hover chip with the type, the value and three actions. It uses the CSS Custom Highlight API where the browser has it, so the page's own markup is never rewritten.

It runs only when you ask. There is no content script in the manifest and no host permission at install time: the scan is injected under activeTab, which is the grant Chrome gives an extension for the current tab when you click something. Sites you explicitly allowlist get a registered script instead, after you approve that origin. How that works, in detail.

What else changed#

• More types. IPv6, CIDR, ASN, MAC, Bitcoin addresses, Windows process names, file paths and registry keys joined IPv4, domain, URL, email, the three hash lengths and CVE. Detection runs in a fixed priority order so svchost.exe resolves as a process rather than a domain, and 1.2.3.4 never resolves as one.
• Defanged input is first class. hxxps://evil[.]com/x is recognised, refanged and typed before anything else is tried. See defanging, refanging, and why hxxp still matters.
• Extract. Paste a report, an email or a log and get every entity it contains, de-duplicated, refanged and typed, with a CSV export.
• Tab groups gained a colour per entity type and a reuse rule, so opening the same entity again same value joins the group it already opened.
• A settings page, a history view, a keep-screen-awake toggle, and a light theme.

Upgrading from 1.x#

Nothing is asked of you. On update, Coeus removes the four 1.x storage keys it no longer reads (type, indicator, tools, clientId), records what it migrated from, and shows the what's-new panel once. Your old tool list is not thrown away: Sources → Import JSON accepts the 1.x tools shape, strips the ✅ and 🔐 prefixes from names, and turns 🔐 into "auth": true. It also accepts a type map, a bare array of sources, and a modern pack, and it reports every entry it had to drop before you commit the result.

There is no new permission. The manifest asks for the same list 1.1.2 asked for, site access included: 1.1.2 declared content_scripts on <all_urls>, which is the largest warning Chrome shows, so an update has nothing new to warn about.

What did change is what that access does. 1.1.2 ran a content script on every page you opened. 2.0 declares none: the access is permission to read a page when you ask, and the scanner is injected at the moment you press something.

If you were running the private branch, the migration is: export your sources, delete the branch, paste the export into a file, host it, subscribe. The one-line version of that is build a source pack your whole SOC can subscribe to.