VendorGhost

Third-party vendors are the fastest-growing attack surface in enterprise security, yet most teams still assess them with manual questionnaires and stale spreadsheets. VendorGhost fixes that. Enter any vendor domain. Six LangGraph agents run in parallel—subdomain discovery, breach OSINT, infrastructure exposure (Shodan), hiring maturity, news incidents, and trust-page verification—all powered by Bright Data (SERP API, Web Unlocker, Scraping Browser, and Web Scraper datasets). An LLM synthesizes the evidence into a structured risk report with an APPROVE / CAUTION / DO NOT ONBOARD verdict, downloadable PDF, and cited findings. Progress streams live to the dashboard via Server-Sent Events. Target users: security teams, GRC analysts, procurement, and startups doing vendor due diligence before signing contracts. Unique features: • Real-time multi-module investigation in ~90 seconds • RAG chat over saved evidence (“Were credentials leaked?”) • Optional Cognee graph memory for cross-vendor recall • Vendor monitoring with Telegram alerts on score/verdict changes • Organization dashboard with risk distribution and watchlists • Mock mode for offline demos without API keys Built with FastAPI, LangGraph, Vite/React, Supabase, and Bright Data as the core data layer.