Best for
- Security researchers and analysts
- SOC, threat-intelligence, and fraud investigation teams
- Developers who need MCP-based tool orchestration
- OSINT practitioners conducting lawful authorized investigations
O
OpenOSINT
Community
An AI-powered OSINT MCP server for authorized security research
GitHub source repository ↗
45FMRS · D
The supplied materials describe OpenOSINT as an stdio MCP server exposing 18 OSINT investigation tools, with documented Claude Desktop and Claude Code usage. It offers broad coverage but depends on external binaries, third-party APIs, and sensitive investigation data, so authorization, compliance, credential security, and service costs should be reviewed before deployment.
OpenOSINT is an MIT-licensed AI-powered OSINT agent and MCP server with an interactive REPL, CLI, Web UI, and 18 investigation tools. It provides natural-language orchestration for email, username, breach, IP, WHOIS, DNS, Shodan, GitHub, malware-reputation, and related investigations, with Anthropic Claude, Ollama, and OpenAI-compatible backends. It is intended only for legal and authorized security research.
Tools
search_email
Enumerates online services linked to an email address using holehe.
search_username
Checks username presence across 300+ platforms using sherlock.
search_breach
Checks email breach exposure through the HaveIBeenPwned v3 API.
search_whois
Retrieves domain registrar, creation, expiry, and nameserver information with python-whois.
search_ip
Retrieves IP geolocation, ASN, and hostname data through ipinfo.io.
search_domain
Enumerates domain subdomains using sublist3r.
generate_dorks
Generates 12 targeted Google dork URLs without making network calls.
search_paste
Searches Pastebin dump mentions through psbdmp.ws.
search_phone
Uses phoneinfoga to gather a phone number’s country, carrier, and line type.
search_shodan
Uses Shodan for IPv4 host ports, banners, and CVEs, or for banner and keyword searches.
search_virustotal
Checks an IP, domain, URL, or file hash through VirusTotal API v3.
search_ip2location
Queries IP2Location.io for geolocation, ISP, ASN, and available VPN, proxy, Tor, and datacenter flags.
search_censys
Uses Censys to query exposed hosts, services, ASN data, or domain certificates.
search_abuseipdb
Checks AbuseIPDB for abuse confidence, report count, country, ISP, and last reported time.
search_github
Uses the GitHub REST API for profiles, repositories, commit-discovered emails, and user or keyword searches.
search_dns
Queries A, AAAA, MX, NS, TXT, CNAME, and SOA records and analyzes SPF, DMARC, and DKIM.
search_dorks_live
Runs live Google dork queries through the Bright Data SERP API and returns titles, URLs, and snippets.
scrape_url
Fetches URL content through Bright Data Web Unlocker and returns clean Markdown, including support for Cloudflare or CAPTCHA bypass.
Setup
Install the Python package with pip install openosint. Configure Claude Desktop to launch python with the project’s openosint/mcp_server.py, then set API keys as needed. Some tools also require the external binaries holehe, sherlock, sublist3r, and phoneinfoga.
claude_desktop_config.json
{"mcpServers":{"openosint":{"command":"python","args":["/absolute/path/to/OpenOSINT/openosint/mcp_server.py"]}}}
Fit and risk
Not for
- Unauthorized monitoring of people or organizations
- Illegal data collection, intrusion, or privacy violations
- Users who do not want external APIs, third-party services, or local investigation tools
- Workflows requiring all findings to come from a single verified data source
Required permissions
- Requires launching a local Python MCP server over stdio.
- The default AI agent requires ANTHROPIC_API_KEY; Ollama or an OpenAI-compatible backend can also be used.
- Optional tools require credentials for HIBP, IPInfo, IP2Location, AbuseIPDB, Shodan, VirusTotal, Censys, GitHub, or Bright Data.
- Requires network access to relevant services; some features depend on holehe, sherlock, sublist3r, and phoneinfoga being available in PATH.
- The REPL saves sessions in ~/.openosint/history/ and reports in reports/.
Risks and side effects
- Use is limited to legal and authorized security research.
- Investigations may process emails, phone numbers, usernames, IPs, breach records, and other sensitive data.
- Third-party APIs may impose rate limits, charges, data-retention terms, or service restrictions.
- Live dork searches and URL scraping use Bright Data APIs, and calls may be billable.
- External sources may be incomplete, outdated, or produce false positives; findings require human verification.
Troubleshooting
- Confirm the Python package is installed and required external binaries are available in PATH.
- Check the Claude Desktop command, absolute script path, and JSON syntax.
- Verify required API keys; individual tools may be unavailable without their optional credentials.
- Check third-party API quotas, rate limits, and Bright Data zone configuration.
- Run openosint tools or openosint config to inspect tool status and configuration.
Use cases
Authorized security research and open-source intelligence investigations
Entity correlation for threat-intelligence, SOC, and fraud investigations
Multi-stage investigations starting from an email, username, domain, IP, or phone number
Connecting OSINT tools to Claude Desktop or Claude Code
Supported clients
Claude DesktopFull support
Claude CodeFull support