Advanced ARG (Alternate Reality Game) investigation toolkit for Claude Code. Specialized agents for steganography, cryptanalysis, OSINT, media forensics, web analysis, and timeline reconstruction.
Investigate directly first, search community later. ARGBuster's agents probe, analyze, decode, and follow puzzle chains themselves before looking up existing solutions. This ensures original discovery and avoids spoilers.
ARGBuster uses Claude Code's flat agent architecture — no hierarchical orchestration. Each agent works independently, reports findings with structured output, and recommends which agent Claude Code should spawn next.
┌─────────────────────────────────────────────────────────────────┐ │ FLAT AGENT ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ User Request │ │ │ │ │ ▼ │ │ ┌─────────┐ │ │ │ Claude │ Decides which specialist to spawn based on input │ │ │ Code │ │ │ └────┬────┘ │ │ │ │ │ ▼ Spawns ONE agent at a time │ │ ┌─────────────────────────────────────────────────────────┐ │ │ │ SELF-SUFFICIENT AGENTS (work independently) │ │ │ │ │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ │ │ stego │ │ crypto │ │ osint │ │ media │ │ │ │ │ │ analyst │ │ decoder │ │ recon │ │ forensic │ │ │ │ │ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ │ │ web │ │ arg │ │ timeline │ │ │ │ │ │ analyst │ │orchestr. │ │ reconstr.│ │ │ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ │ └─────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ Returns structured findings │ │ ┌─────────┐ │ │ │ Claude │ Reads report, decides next agent to spawn │ │ │ Code │ │ │ └────┬────┘ │ │ │ │ │ ▼ Spawns next recommended agent... │ │ │ │ 📁 ~/Downloads/${ARG_NAME}_ARG_Investigation/ │ │ └── All findings saved to ARG-specific folder │ │ │ └─────────────────────────────────────────────────────────────────┘ | Agent | Model | Color | Purpose |
|---|---|---|---|
| arg-orchestrator | opus | magenta | Investigation guide + direct browser recon |
| web-analyst | opus | blue | HTML source, JavaScript, hidden elements, path fuzzing |
| crypto-decoder | opus | yellow | 50+ cipher types, multi-layer decoding, automated cracking |
| stego-analyst | opus | cyan | LSB extraction, spectrograms, color channel analysis |
| media-forensics | opus | red | File forensics, binwalk, metadata, QR/OCR |
| osint-recon | opus | green | WHOIS, DNS, crt.sh, Wayback Machine, username search |
| timeline-reconstructor | opus | white | Temporal analysis, narrative reconstruction, event correlation |
| Command | Description |
|---|---|
/arg [target] | Full ARG investigation workflow — spawns agents in parallel |
/decode [text] | Quick multi-encoding decode (Base64, ROT, hex, Atbash, Morse, A1Z26) |
/stego:spectrogram [audio] | Generate 5+ spectrogram variants from audio |
/sweep [--install] | Check/install all required ARG analysis tool dependencies |
| Skill | Description |
|---|---|
| arg-patterns | Common ARG hiding techniques and puzzle patterns |
| cipher-identification | Quick cipher type identification by character set |
| puzzle-chain-tracking | Multi-stage investigation state management |
| timeline-reconstruction | Temporal pattern analysis and event correlation |
| Script | Description |
|---|---|
lsb-extract.py | LSB steganography extraction with entropy analysis, sweep mode, bit-plane visualization, zlib decompression, and multiple extraction orders (row/col/zigzag) |
metadata-extract.sh | Comprehensive metadata extraction with SHA256, GPS coordinate extraction, entropy analysis, deep mode, and support for images/audio/video/PDF |
git clone https://github.com/CMLKevin/ClaudeCode_ARGBuster.gitOption A: Run with --plugin-dir
claude --plugin-dir ./ClaudeCode_ARGBusterOption B: Install to local plugins
mkdir -p ~/.claude/plugins/local cp -r ClaudeCode_ARGBuster ~/.claude/plugins/local/arg-investigationThen enable in ~/.claude/settings.json:
{ "enabledPlugins": { "arg-investigation@local": true } }Run the built-in dependency checker:
/sweep --install Or install manually:
# macOS (Homebrew) brew install exiftool binwalk sox ffmpeg zbar tesseract imagemagick foremost mediainfo pngcheck poppler jq wget # Python pip3 install pillowAdd to ~/.claude/settings.json for frictionless investigation:
{ "permissions": { "allow": [ "Bash(curl:*)", "Bash(wget:*)", "Bash(exiftool:*)", "Bash(binwalk:*)", "Bash(sox:*)", "Bash(ffprobe:*)", "Bash(ffmpeg:*)", "Bash(tesseract:*)", "Bash(zbarimg:*)", "Bash(strings:*)", "Bash(xxd:*)", "Bash(file:*)", "Bash(convert:*)", "Bash(dig:*)", "Bash(whois:*)", "Bash(foremost:*)", "Bash(mediainfo:*)", "Bash(pdftotext:*)", "Bash(python3:*)", "Bash(base64:*)", "Bash(md5:*)", "Bash(shasum:*)", "Bash(mkdir:*)", "Bash(brew install:*)", "Bash(pip3 install:*)" ] } }/arg https://mysterious-arg.com /decode SGVsbG8gV29ybGQ= /decode ".... . .-.. .-.. ---" /stego:spectrogram ~/Downloads/mysterious_audio.ogg /sweep /sweep --install python3 scripts/lsb-extract.py image.png --sweep python3 scripts/lsb-extract.py image.png 1 r --mode=col --entropy python3 scripts/lsb-extract.py image.png --bitplane python3 scripts/lsb-extract.py image.png 2 all --decompressbash scripts/metadata-extract.sh suspicious_file.png --deepEach ARG creates its own organized folder:
~/Downloads/${ARG_NAME}_ARG_Investigation/ ├── extracted/ → Downloaded files, binwalk extractions ├── spectrograms/ → Audio spectrograms at multiple ranges ├── clues/ → KEY FINDINGS from all agents │ ├── MASTER_INDEX.md │ ├── decoded_messages.txt │ ├── discovered_urls.txt │ ├── hidden_content.txt │ └── encoded_strings.txt ├── timeline/ → Chronological event maps ├── reports/ → Investigation reports └── logs/ → Raw data dumps - New agent:
timeline-reconstructorfor temporal analysis and narrative reconstruction - New command:
/sweepfor checking and installing all tool dependencies - New skill:
timeline-reconstructionfor temporal pattern analysis - Improved
/decode: Added Atbash, A1Z26, and Morse code decoding; fixed timestamp bug - Improved
lsb-extract.py: Added--sweepmode,--entropyanalysis,--bitplanevisualization,--decompressfor zlib,--mode=col/zigzagextraction orders, file signature detection, email/GPS pattern matching - Improved
metadata-extract.sh: Added SHA256 hashing, GPS coordinate extraction with Google Maps links, entropy analysis, video support, deep mode (--deep), JPEG/PNG EOF data detection, EXIF thumbnail extraction - Fixed:
decode.mdtimestamp bug (was creating multiple output files per run) - Fixed:
stego-analysthardcoded paths now use$ARG_DIRconsistently - Updated: Plugin version and metadata
| Category | Tools |
|---|---|
| Core | exiftool, binwalk, foremost, strings, xxd, file |
| Image | imagemagick (convert), zbar (zbarimg), tesseract, pngcheck |
| Audio/Video | sox, ffmpeg/ffprobe, mediainfo |
| Network | curl, wget, dig, whois, jq |
| Documents | poppler (pdftotext, pdfimages, pdfdetach) |
| Python | pillow (PIL) |
Kevin Lin
MIT