OpenOSINT

Community

An AI-powered OSINT MCP server for authorized security research

How to install ↓ Compare GitHub source repository ↗

Category: Other #179 of 230
Stars: ★ 1.8k Very popular
Transport: stdio (local process)
Runtime: Python
Credentials: Optional API key
License: MIT
Last commit: 3 days ago
Tools: 18

45FMRS · D

The supplied materials describe OpenOSINT as an stdio MCP server exposing 18 OSINT investigation tools, with documented Claude Desktop and Claude Code usage. It offers broad coverage but depends on external binaries, third-party APIs, and sensitive investigation data, so authorization, compliance, credential security, and service costs should be reviewed before deployment.

Strongest · Documentation 11/20 Weakest · Reliability 6/20

Reliability

6/20

Security and permissions

7/20

Maintenance

11/20

Documentation

11/20

Setup experience

10/20

Why each score

Reliability 6/20: Only the README and manifest are provided; there is no verifiable server source, CI, or test evidence for MCP initialization, tool-list handshakes, or failure paths. The manifest declares 16 tools while the README declares 18, and version references range from 2.19.0 and 2.19.1 assets to 2.25.0, reducing confidence that the declared behavior matches the implementation.
Security and permissions 7/20: Credentials are supplied through environment variables and marked secret, and the listed tools appear primarily query-oriented without delete, payment, or deployment actions. However, the server can enumerate emails, usernames, phones, and breach data, and can use Bright Data to bypass Cloudflare/CAPTCHA while scraping arbitrary URLs. Fine-grained permissions, target scoping, sensitive-data handling, audit controls, and confirmation mechanisms are not evidenced, so points are deducted.
Maintenance 11/20: The project is not archived, claims an MIT license, and provides a maintainer, contribution path, repository, and commercial support channel with version information. The supplied material does not verify release cadence, commit activity, dependency maintenance, security-response procedures, or issue handling quality; version declarations are also inconsistent.
Documentation 11/20: The README covers installation, major tools, API keys, external binaries, examples, limitations, and MCP client configuration. Points are deducted because the README and manifest disagree on tool count and versions, the manifest omits several credentials documented in the README, and there is no reviewable detail on tool schemas, MCP error behavior, privacy/data boundaries, or systematic troubleshooting.
Setup experience 10/20: PyPI installation, a stdio manifest, Claude Code/Desktop configuration examples, and local-model options provide a reasonably clear basic path. Setup still requires several external binaries and optional dependencies, involves many API configurations, lacks platform-specific detail, and has no verifiable end-to-end connection evidence; static review therefore limits the score.

Static review · not runListed 2026-07-29

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

Security researchers and analysts
SOC, threat-intelligence, and fraud investigation teams
Developers who need MCP-based tool orchestration
OSINT practitioners conducting lawful authorized investigations

Not for

Unauthorized monitoring of people or organizations
Illegal data collection, intrusion, or privacy violations
Users who do not want external APIs, third-party services, or local investigation tools
Workflows requiring all findings to come from a single verified data source

Required permissions

Requires launching a local Python MCP server over stdio.
The default AI agent requires ANTHROPIC_API_KEY; Ollama or an OpenAI-compatible backend can also be used.
Optional tools require credentials for HIBP, IPInfo, IP2Location, AbuseIPDB, Shodan, VirusTotal, Censys, GitHub, or Bright Data.
Requires network access to relevant services; some features depend on holehe, sherlock, sublist3r, and phoneinfoga being available in PATH.
The REPL saves sessions in ~/.openosint/history/ and reports in reports/.

Risks and side effects

Use is limited to legal and authorized security research.
Investigations may process emails, phone numbers, usernames, IPs, breach records, and other sensitive data.
Third-party APIs may impose rate limits, charges, data-retention terms, or service restrictions.
Live dork searches and URL scraping use Bright Data APIs, and calls may be billable.
External sources may be incomplete, outdated, or produce false positives; findings require human verification.

Setup

Before you start

Runtime：Python

ANTHROPIC_API_KEY optionalsecret Anthropic API key for the AI agent REPL/Web UI (not needed for raw MCP tool calls); get it at console.anthropic.com

OPENAI_API_KEY optionalsecret API key for the OpenAI-compatible endpoint; local servers may ignore it

HIBP_API_KEY optionalsecret HaveIBeenPwned v3 key for search_breach; get one at haveibeenpwned.com/API/Key (paid)

IPINFO_TOKEN optionalsecret ipinfo.io token for higher search_ip rate limits; free tier is 50k/month

SHODAN_API_KEY optionalsecret Shodan API key for search_shodan; register at account.shodan.io (free tier)

VIRUSTOTAL_API_KEY optionalsecret VirusTotal API v3 key for search_virustotal (free tier)

IP2LOCATION_API_KEY optionalsecret IP2Location.io key for search_ip2location (sponsored integration); Security Plan adds VPN/Tor detection

CENSYS_API_ID optionalsecret Censys API ID, paired with CENSYS_SECRET for search_censys (free tier)

CENSYS_SECRET optionalsecret Censys API secret, paired with CENSYS_API_ID for search_censys

ABUSEIPDB_API_KEY optionalsecret AbuseIPDB v2 key for search_abuseipdb IP abuse reputation checks (free tier)

GITHUB_TOKEN optionalsecret Optional GitHub token raising search_github rate limit from 60 to 5000 req/h

BRIGHTDATA_API_KEY optionalsecret Bright Data key for search_dorks_live, scrape_url and search_footprint (free tier: 5,000 req/month)

Other optional settings (4)

OPENAI_BASE_URL optional Base URL of an OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, etc.)

OPENAI_MODEL optional Model name to request, defaults to gpt-4o-mini

BRIGHTDATA_SERP_ZONE optional Bright Data SERP zone name used by search_dorks_live and search_footprint

BRIGHTDATA_UNLOCKER_ZONE optional Bright Data Web Unlocker zone name used by scrape_url

Install the Python package with pip install openosint. Configure Claude Desktop to launch python with the project’s openosint/mcp_server.py, then set API keys as needed. Some tools also require the external binaries holehe, sherlock, sublist3r, and phoneinfoga.

claude_desktop_config.json

{"mcpServers":{"openosint":{"command":"python","args":["/absolute/path/to/OpenOSINT/openosint/mcp_server.py"]}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "openosint": {
      "command": "python",
      "args": [
        "/absolute/path/to/OpenOSINT/openosint/mcp_server.py"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add openosint -- python /absolute/path/to/OpenOSINT/openosint/mcp_server.py

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Confirm the openosint tools (e.g. search_email, search_dns) appear in your client's tool list, then ask the AI to run a DNS lookup for example.com — returned A/MX records prove the connection works.

Troubleshooting

Confirm the Python package is installed and required external binaries are available in PATH.
Check the Claude Desktop command, absolute script path, and JSON syntax.
Verify required API keys; individual tools may be unavailable without their optional credentials.
Check third-party API quotas, rate limits, and Bright Data zone configuration.
Run openosint tools or openosint config to inspect tool status and configuration.

Things to try

Once connected, you can ask your AI assistant things like:

Investigate [email protected]: find which platforms it's registered on and check for data breach exposure
Look up the username johndoe99 across platforms and pivot on any GitHub findings
Analyze the IP 8.8.8.8: geolocation, ASN, and its abuse confidence score on AbuseIPDB
Enumerate subdomains of example.com and analyze its DNS records including SPF and DMARC

Tools 18

search_email read-only

Enumerates online services linked to an email address using holehe.

search_username read-only

Checks username presence across 300+ platforms using sherlock.

search_breach read-only

Checks email breach exposure through the HaveIBeenPwned v3 API.

search_whois read-only

Retrieves domain registrar, creation, expiry, and nameserver information with python-whois.

search_ip read-only

Retrieves IP geolocation, ASN, and hostname data through ipinfo.io.

search_domain read-only

Enumerates domain subdomains using sublist3r.

generate_dorks read-only

Generates 12 targeted Google dork URLs without making network calls.

search_paste read-only

Searches Pastebin dump mentions through psbdmp.ws.

Show 10 more tools

search_phone read-only

Uses phoneinfoga to gather a phone number’s country, carrier, and line type.

search_shodan read-only

Uses Shodan for IPv4 host ports, banners, and CVEs, or for banner and keyword searches.

search_virustotal read-only

Checks an IP, domain, URL, or file hash through VirusTotal API v3.

search_ip2location read-only

Queries IP2Location.io for geolocation, ISP, ASN, and available VPN, proxy, Tor, and datacenter flags.

search_censys read-only

Uses Censys to query exposed hosts, services, ASN data, or domain certificates.

search_abuseipdb read-only

Checks AbuseIPDB for abuse confidence, report count, country, ISP, and last reported time.

search_github read-only

Uses the GitHub REST API for profiles, repositories, commit-discovered emails, and user or keyword searches.

search_dns read-only

Queries A, AAAA, MX, NS, TXT, CNAME, and SOA records and analyzes SPF, DMARC, and DKIM.

search_dorks_live read-only

Runs live Google dork queries through the Bright Data SERP API and returns titles, URLs, and snippets.

scrape_url read-only

Fetches URL content through Bright Data Web Unlocker and returns clean Markdown, including support for Cloudflare or CAPTCHA bypass.

Use cases

Authorized security research and open-source intelligence investigations

Entity correlation for threat-intelligence, SOC, and fraud investigations

Multi-stage investigations starting from an email, username, domain, IP, or phone number

Connecting OSINT tools to Claude Desktop or Claude Code

Supported clients

Claude Desktop

Claude Code

Listed from the project's documentation, not tested by this site.

Overview

OpenOSINT is an MIT-licensed AI-powered OSINT agent and MCP server with an interactive REPL, CLI, Web UI, and 18 investigation tools. It provides natural-language orchestration for email, username, breach, IP, WHOIS, DNS, Shodan, GitHub, malware-reputation, and related investigations, with Anthropic Claude, Ollama, and OpenAI-compatible backends. It is intended only for legal and authorized security research.

Similar servers

Hevy MCP 77 · B

Manage your Hevy workout data from AI assistants via MCP.

★ 517 · Tools 26 Compare with this →

Firecrawl MCP Server 75 · B

Firecrawl's official MCP server for web search, scraping, and structured extraction for AI agents

★ 7.6k · Tools 11 Compare with this →

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →

Compartment 75 · B

Encrypted, fully offline long-term memory for AI agents

★ 583 · Tools 14 Compare with this →

Compare with other MCP servers

Source revision e89e8f1f7a2c Data synced 2026-10-19 Read the FMRS scoring method