---
source: https://info.defcon.org/defcon34/content/66515
created: 2026-08-08T14:48:00
github: https://github.com/kdr/overcast
---
- [Kevin "kdrwins" Dela Rosa](https://info.defcon.org/defcon34/people/67246 "Kevin \"kdrwins\" Dela Rosa")
	- Previously at Snapchat, Amazon
	- Now CTO at Cloudglue
URL: [https://overcast.video](https://overcast.video/)

## Overview

Conference talks, earnings calls, product demos, training videos. Organizations put hours of footage online every week, full of things they didn't mean to share: hostnames in terminal windows, org charts on slides, infrastructure details dropped during Q&A. Traditional OSINT can't touch video at scale, and manual review falls apart past a handful of recordings.

Overcast is a CLI agent and skill pack for video OSINT that drops into any agentic harness, such as Claude Code, Codex, or Tinycloud, giving it senses plus recon and targeting reach, organized around an investigation case. Point it at 10 videos or 1,000 and it turns footage into cited evidence: speech, video understanding, on-screen text and objects, faces, and named entities, all accumulating in persistent case memory.

Discovery runs on the same case: scan and monitor sweep sources and surface reviewable findings. Ask across the whole corpus and get answers cited to the exact record and timestamp, backed by tiered retrieval. Match a photo against thousands of clips to find a person. Each subcommand is modular and pluggable, so analysts can drop one into other agent flows, author custom skills, or feed Overcast's media analysis into existing recon and security tooling to complete the mission.

## Notes

### Overcast Is a Video OSINT Agent
- Point it at footage, interrogate it like a case file
	- Who is appearing in this?
	- Where was this filmed?
	- Cite records
- Used via CLI
	- Has a `/` command for skills
- Tools are specific actions
- Skills are markdown + scripts
- 38 providers available
- Perception uses Tinycloud; senses use an API layer to swap in other providers (the repo's own docs point to Cloudglue, Kevin's company, as the perception backend — worth double-checking which is current)

### Structure
- Projects are organized around "cases"
	- Pull in video
	- Sense (OCR, search) so the agent understands the data
- Video needs to be broken down into:
	- Speech
	- Pixels
	- Screen: text + diagrams
	- Time
	- etc.
- Captions or transcripts don't cover all of the above
	- Think conference talks — there are slides, or commands being run
	- A transcript won't capture any of that

### Senses
- Enhance: super resolution is possible

### Workflow
- The setup command walks through what should be stored, what you're looking for, and what senses should be enabled
	- The more specific, the better the results
- It then plans
- If you approve, it implements
- It saves various types of data to various databases:
	- Audio similarity
	- Facial identity
	- Searching by time
	- Pixels

### Additional Features
- Visualizations
	- Camera feed used to identify location and place
- Cockpit
	- VS Code extension
	- Sub-agent with an agent harness
	- npx install
	- Views
		- Case views
- "Share mode" — can use it remotely over Tailscale (tailnet)

### From the Repo
- Perception is organized around modular "senses" (perception verbs): watch (video understanding), listen (speech/audio-scene transcription), see (on-screen text/object detection), face (facial recognition + cross-corpus matching), plus named-entity indexing, audio forensics, voice ID, and media verification
- Each verb emits portable JSON records and can be rebound to a different backend without code changes
- Distributed as an npm package (`@kdrrr/overcast`) or a standalone binary (no Node.js required), plus agent skills for Claude Code, Cursor, and Codex
- Prerequisites: Node.js ≥22, FFmpeg/ffprobe, Cloudglue API credentials for perception backends; optional yt-dlp, ExifTool, Playwright
- Quickstart: `npm i -g @kdrrr/overcast && overcast doctor`, then `overcast case setup --name <case> --target "<subject>" --source web:"<query>"`, then `overcast scan --pull && overcast ask "<question>"`