# OSINT MCP [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/rjn32s/osint-mcp  
**GitHub Stars:** 2  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/osint-mcp

## Description
26 free OSINT tools as MCP tools for AI agents. Auto-installs everything on first run.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "osint-mcp": {
    "command": "uvx",
    "args": ["osint-mcp"]
  }
}
```

## Documentation

## What OSINT MCP MCP server does

OSINT MCP packages 26 open-source intelligence utilities as MCP tools for AI agents. Its coverage includes network and DNS lookups, passive subdomain discovery, certificate transparency, username and email investigation, historical web snapshots, phone-number information, threat intelligence, and repository secret scanning.

The tool set combines local programs, Python libraries, and public or key-protected web APIs. Examples include WHOIS, DNS record lookup, Nmap port scanning, Sherlock and Maigret username searches, the Wayback Machine, VirusTotal, Shodan, and TruffleHog. The server also provides utility tools for checking installation status and managing stored API keys.

An OSINT MCP MCP server is most appropriate for security research, initial footprinting, IOC enrichment, bug-bounty workflows, and learning-oriented investigations. Port scanning and secrets scanning are available, but they should be used only against systems and code you are authorized to assess.

## How it works

The package starts an MCP server over stdio. At startup, it discovers registered tool implementations and presents them to the connected MCP client. Individual tools invoke their underlying binaries, Python packages, or HTTP APIs and return the resulting information to the agent.

The first `uvx osint-mcp` launch detects whether the host is macOS or Linux and installs the supported dependencies through mechanisms such as Homebrew, apt, Go, or pip. If a required binary is missing later, the affected tool reports that it is unavailable and points to the installation command instead of terminating the server.

Most tools do not require credentials. Shodan, VirusTotal, ipinfo.io, HaveIBeenPwned, and urlscan.io can use optional free API keys for their respective services; some provide reduced functionality or require a key for access. The server can store and manage these keys through CLI commands or MCP configuration tools.

## Setup and configuration

The shortest setup is:

```bash
uvx osint-mcp
```

This launches the stdio server after installing the package and its OSINT dependencies. For a manually managed Python environment, install the package with pip, run `osint-mcp install`, inspect availability with `osint-mcp status`, and start it with `osint-mcp serve`.

Claude Desktop can connect by adding an `osint-mcp` entry whose command is `uvx` and whose argument is `osint-mcp`. The README provides separate configuration locations for macOS and Linux. The project targets Python 3.10 or newer and supports macOS and Linux.

Optional credentials can be stored with commands such as `osint-mcp config set shodan_key=YOUR_KEY`. Agents can also use `osint_config_set`; `osint_config_get` masks stored values, and `osint_config_list` lists configured keys.

## Tools and capabilities

The available tools include:

- WHOIS, DNS records, IP details, ASN data, port and service scanning, and passive subdomain enumeration.
- Amass mapping, certificate-transparency searches, theHarvester collection, and DNS reconnaissance.
- Sherlock and Maigret username searches, plus email-account and breach checks.
- Wayback snapshots, urlscan.io analysis, Shodan host and query searches, and VirusTotal lookups.
- PhoneInfoga phone checks, TruffleHog repository or path scans, and Gitleaks history scanning.
- Installation status plus API-key storage and listing utilities.

The OSINT MCP MCP server marks tools as available or unavailable through its status function, which helps an agent check prerequisites before starting an investigation.

## Limitations and notes

Several capabilities depend on external services, rate limits, or API credentials. Free tiers and access requirements differ by provider, so results may be narrower without keys.

Although the default workflow emphasizes passive reconnaissance, the tool list includes active port scanning and secrets scanning. API keys are optional for some services but required for Shodan, VirusTotal, and other provider-specific operations as documented by the project.

_Full upstream README: https://allmcps.com/mcp/osint-mcp/readme_