crypttrace 0.31.0__tar.gz → 0.32.0__tar.gz

{crypttrace-0.31.0/src/crypttrace.egg-info → crypttrace-0.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.31.0
+Version: 0.32.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -255,6 +255,10 @@ crypttrace trace 0xADDRESS --direction in
 # Trace a token rather than the native coin (most thefts are stablecoins)
 crypttrace trace 0xADDRESS --asset usdt --depth 4
 
+# Save the traced graph for Gephi / yEd / Cytoscape, or for Maltego / Neo4j
+crypttrace trace 0xADDRESS --depth 4 --export case.graphml
+crypttrace trace 0xADDRESS --depth 4 --export case.csv
+
 # Token holdings, valued in USD
 crypttrace tokens 0xADDRESS
 
@@ -724,6 +728,7 @@ src/crypttrace/
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
   report.py        # Markdown + JSON reports
+  export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation
   render.py        # rich terminal rendering
   webapp.py        # Flask backend for the web UI

{crypttrace-0.31.0 → crypttrace-0.32.0}/README.md

@@ -221,6 +221,10 @@ crypttrace trace 0xADDRESS --direction in
 # Trace a token rather than the native coin (most thefts are stablecoins)
 crypttrace trace 0xADDRESS --asset usdt --depth 4
 
+# Save the traced graph for Gephi / yEd / Cytoscape, or for Maltego / Neo4j
+crypttrace trace 0xADDRESS --depth 4 --export case.graphml
+crypttrace trace 0xADDRESS --depth 4 --export case.csv
+
 # Token holdings, valued in USD
 crypttrace tokens 0xADDRESS
 
@@ -690,6 +694,7 @@ src/crypttrace/
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
   report.py        # Markdown + JSON reports
+  export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation
   render.py        # rich terminal rendering
   webapp.py        # Flask backend for the web UI

{crypttrace-0.31.0 → crypttrace-0.32.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.31.0"
+__version__ = "0.32.0"

{crypttrace-0.31.0 → crypttrace-0.32.0}/src/crypttrace/cli.py

@@ -222,6 +222,9 @@ def trace(
                                   help="Top-N outflows to follow per address"),
     direction: str = typer.Option("out", "--direction", "-D",
                                   help="'out' = where funds went, 'in' = where they came from"),
+    export: Optional[Path] = typer.Option(None, "--export", "-o",
+                                          help="Also save the graph: .graphml (Gephi, yEd, Cytoscape) "
+                                               "or .csv (Maltego, Neo4j, spreadsheets)"),
 ):
     """Trace where funds moved, hop by hop, as a coloured tree (ETH or a token)."""
     try:
@@ -232,6 +235,10 @@ def trace(
     if direction not in ("out", "in"):
         console.print("[red]Error:[/red] --direction must be 'out' or 'in'")
         raise typer.Exit(1)
+    fmt = export.suffix.lower().lstrip(".") if export else None
+    if export and fmt not in ("graphml", "csv"):
+        console.print("[red]Error:[/red] --export takes a .graphml or .csv file name")
+        raise typer.Exit(1)
     try:
         tree = trace_mod.build_tree(address, chain, depth, branching, asset_desc, direction)
     except (chains_mod.ChainError, etherscan.EtherscanError) as e:
@@ -242,6 +249,18 @@ def trace(
         "\n[dim]Legend: \U0001F7E2 exchange  \U0001F7E3 mixer  \U0001F534 sanctioned/scam"
         "  \U0001F309 bridge  \U0001F504 DEX  \U0001F537 service  ⚪ unknown[/dim]"
     )
+    if export:
+        from crypttrace import export as export_mod
+        try:
+            graph = trace_mod.build_graph(address, chain, depth, branching, asset_desc, direction)
+        except (chains_mod.ChainError, etherscan.EtherscanError) as e:
+            console.print(f"[red]Error:[/red] {e}")
+            raise typer.Exit(1)
+        export.write_text(export_mod.render(graph, chain, fmt), encoding="utf-8", newline="")
+        console.print(f"\n[green]Graph saved:[/green] {export} — {len(graph['nodes'])} addresses, "
+                      f"{len(graph['edges'])} transfers"
+                      + ("  [dim](Maltego: Import Graph from Table, map from/to to an address entity)[/dim]"
+                         if fmt == "csv" else "  [dim](open in Gephi, yEd or Cytoscape)[/dim]"))
 
 
 @app.command()

crypttrace-0.32.0/src/crypttrace/export.py

@@ -0,0 +1,94 @@
+"""Export a traced fund-flow graph for the tools analysts already use.
+
+    GraphML  — Gephi, yEd, Cytoscape: nodes keep their label, kind, hop and
+               explorer link; edges their amount, USD value, transfer count and
+               exchange memo, so a layout can be coloured and sized by them.
+    CSV      — one row per edge with both ends' labels and kinds: Maltego's
+               "Import Graph from Table" (map `from` and `to` to a
+               cryptocurrency-address entity), Neo4j's LOAD CSV, a spreadsheet.
+
+Both take the dict `trace.build_graph` returns, the same graph the web UI draws.
+"""
+import csv
+import io
+from xml.sax.saxutils import escape, quoteattr
+
+from crypttrace import chains
+
+NODE_KEYS = [("label", "string"), ("kind", "string"), ("hop", "int"), ("root", "boolean"),
+             ("trail_ends", "boolean"), ("chain", "string"), ("explorer", "string")]
+EDGE_KEYS = [("amount", "double"), ("symbol", "string"), ("usd", "double"), ("transfers", "int"),
+             ("memo", "string")]
+CSV_HEAD = ["from", "from_label", "from_kind", "to", "to_label", "to_kind", "amount", "symbol",
+            "usd", "transfers", "memo", "chain", "from_explorer", "to_explorer"]
+
+
+def _node_attrs(n: dict, chain: str) -> dict:
+    return {"label": n.get("label") or n.get("short") or n["id"], "kind": n.get("type") or "unknown",
+            "hop": n.get("level", 0), "root": bool(n.get("root")), "trail_ends": bool(n.get("terminal")),
+            "chain": chain, "explorer": chains.explorer_url(n["id"], chain)}
+
+
+def _edge_attrs(e: dict, symbol: str) -> dict:
+    return {"amount": e.get("value") or 0, "symbol": symbol, "usd": e.get("usd"),
+            "transfers": e.get("tx") or 0, "memo": e.get("memo") or ""}
+
+
+def _val(v, kind: str) -> str:
+    if v is None:
+        return ""
+    if kind == "boolean":
+        return "true" if v else "false"
+    return escape(str(v))
+
+
+def to_graphml(graph: dict, chain: str) -> str:
+    """GraphML 1.0, directed: money flows along the edges."""
+    symbol = graph.get("symbol", "")
+    out = ['<?xml version="1.0" encoding="UTF-8"?>',
+           '<graphml xmlns="http://graphml.graphdrawing.org/xmlns">']
+    for k, t in NODE_KEYS:
+        out.append(f'  <key id="n_{k}" for="node" attr.name="{k}" attr.type="{t}"/>')
+    for k, t in EDGE_KEYS:
+        out.append(f'  <key id="e_{k}" for="edge" attr.name="{k}" attr.type="{t}"/>')
+    out.append(f'  <graph id={quoteattr("crypttrace " + chain)} edgedefault="directed">')
+    for n in graph.get("nodes", []):
+        out.append(f'    <node id={quoteattr(n["id"])}>')
+        for (k, t), v in zip(NODE_KEYS, _node_attrs(n, chain).values()):
+            if v not in (None, ""):
+                out.append(f'      <data key="n_{k}">{_val(v, t)}</data>')
+        out.append("    </node>")
+    for i, e in enumerate(graph.get("edges", [])):
+        out.append(f'    <edge id="e{i}" source={quoteattr(e["from"])} target={quoteattr(e["to"])}>')
+        for (k, t), v in zip(EDGE_KEYS, _edge_attrs(e, symbol).values()):
+            if v not in (None, ""):
+                out.append(f'      <data key="e_{k}">{_val(v, t)}</data>')
+        out.append("    </edge>")
+    out += ["  </graph>", "</graphml>", ""]
+    return "\n".join(out)
+
+
+def to_csv(graph: dict, chain: str) -> str:
+    """One row per edge, both ends described — what a link-analysis import wants."""
+    symbol = graph.get("symbol", "")
+    nodes = {n["id"]: n for n in graph.get("nodes", [])}
+    buf = io.StringIO()
+    w = csv.writer(buf, lineterminator="\n")
+    w.writerow(CSV_HEAD)
+    for e in graph.get("edges", []):
+        a, b = nodes.get(e["from"], {"id": e["from"]}), nodes.get(e["to"], {"id": e["to"]})
+        ea = _edge_attrs(e, symbol)
+        w.writerow([e["from"], a.get("label") or "", a.get("type") or "unknown",
+                    e["to"], b.get("label") or "", b.get("type") or "unknown",
+                    ea["amount"], symbol, "" if ea["usd"] is None else ea["usd"], ea["transfers"],
+                    ea["memo"], chain, chains.explorer_url(e["from"], chain), chains.explorer_url(e["to"], chain)])
+    return buf.getvalue()
+
+
+FORMATS = {"graphml": (to_graphml, "application/graphml+xml"), "csv": (to_csv, "text/csv")}
+
+
+def render(graph: dict, chain: str, fmt: str) -> str:
+    if fmt not in FORMATS:
+        raise ValueError(f"unknown export format '{fmt}' — use one of: {', '.join(FORMATS)}")
+    return FORMATS[fmt][0](graph, chain)

{crypttrace-0.31.0 → crypttrace-0.32.0}/src/crypttrace/web/index.html

@@ -230,6 +230,8 @@
   <button id="go">Investigate</button>
   <button id="fit" class="ghost" title="Fit graph to view">Fit</button>
   <button id="casefile" class="ghost" title="Download a one-page case file for an exchange or the police">Case file</button>
+  <button id="exp-graphml" class="ghost" title="Download the graph for Gephi, yEd or Cytoscape">GraphML</button>
+  <button id="exp-csv" class="ghost" title="Download the graph as an edge list for Maltego, Neo4j or a spreadsheet">CSV</button>
 </div>
 
 <div class="legend">
@@ -779,6 +781,24 @@ async function downloadCaseFile(){
 }
 $('#casefile').addEventListener('click',downloadCaseFile);
 
+// The traced graph as a file: GraphML for Gephi/yEd/Cytoscape, CSV for Maltego/Neo4j.
+async function downloadGraph(fmt){
+  const a=$('#addr').value.trim(), b=$('#exp-'+fmt);
+  if(!a){ setStatus('enter an address',true); return; }
+  b.disabled=true; setStatus(`building the ${fmt} file…`,false,true);
+  try{
+    const r=await fetch(`/api/trace?address=${q(a)}&chain=${chain()}&depth=${$('#depth').value}&asset=${q($('#asset').value)}&direction=${$('#direction').value}&format=${fmt}`);
+    if(!r.ok){ const j=await r.json().catch(()=>({})); throw new Error(j.error||`HTTP ${r.status}`); }
+    const name=((r.headers.get('Content-Disposition')||'').match(/filename="([^"]+)"/)||[])[1]||`graph.${fmt}`;
+    const u=URL.createObjectURL(await r.blob()), l=document.createElement('a');
+    l.href=u; l.download=name; l.click(); URL.revokeObjectURL(u);
+    setStatus(`graph saved: ${name}`);
+  }catch(e){ setStatus(e.message,true); }
+  finally{ b.disabled=false; }
+}
+$('#exp-graphml').addEventListener('click',()=>downloadGraph('graphml'));
+$('#exp-csv').addEventListener('click',()=>downloadGraph('csv'));
+
 function downloadCsv(){
   const head=['address','hop',`amount_sent_${victimSym}`,'transactions','first_seen_utc','last_seen_utc','label','explorer'];
   const body=victimRows.map(r=>[r.address,r.hop,r.value,r.txs,dstamp(r.first_seen),dstamp(r.last_seen),

{crypttrace-0.31.0 → crypttrace-0.32.0}/src/crypttrace/webapp.py

@@ -145,6 +145,14 @@ def create_app() -> Flask:
             graph = trace_mod.build_graph(addr, chain, depth, branching, asset, direction)
         except _KNOWN_ERRORS as e:
             return jsonify({"error": str(e)}), 400
+        fmt = request.args.get("format", "")
+        if fmt:                     # the same graph as a file for Gephi / Maltego
+            from crypttrace import export as export_mod
+            if fmt not in export_mod.FORMATS:
+                return jsonify({"error": f"unknown format '{fmt}'"}), 400
+            name = f"crypttrace_{chain}_{addr[:12]}_{direction}.{fmt}"
+            return Response(export_mod.render(graph, chain, fmt), mimetype=export_mod.FORMATS[fmt][1],
+                            headers={"Content-Disposition": f'attachment; filename="{name}"'})
         return jsonify(graph)
 
     @app.route("/api/assess")

{crypttrace-0.31.0 → crypttrace-0.32.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.31.0
+Version: 0.32.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -255,6 +255,10 @@ crypttrace trace 0xADDRESS --direction in
 # Trace a token rather than the native coin (most thefts are stablecoins)
 crypttrace trace 0xADDRESS --asset usdt --depth 4
 
+# Save the traced graph for Gephi / yEd / Cytoscape, or for Maltego / Neo4j
+crypttrace trace 0xADDRESS --depth 4 --export case.graphml
+crypttrace trace 0xADDRESS --depth 4 --export case.csv
+
 # Token holdings, valued in USD
 crypttrace tokens 0xADDRESS
 
@@ -724,6 +728,7 @@ src/crypttrace/
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
   report.py        # Markdown + JSON reports
+  export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation
   render.py        # rich terminal rendering
   webapp.py        # Flask backend for the web UI

{crypttrace-0.31.0 → crypttrace-0.32.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -12,6 +12,7 @@ src/crypttrace/cli.py
 src/crypttrace/config.py
 src/crypttrace/drain.py
 src/crypttrace/evidence.py
+src/crypttrace/export.py
 src/crypttrace/freeze.py
 src/crypttrace/funder.py
 src/crypttrace/gascluster.py