Log inSubmit server
OpenOSINT logo

OpenOSINT

OpenOSINT provides 21 OSINT investigation tools over MCP for public-data research, including breach, DNS, IP, GitHub, and threat-intelligence lookups.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install OpenOSINT

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "openosint": {
      "command": "uvx",
      "args": [
        "--from",
        "openosint",
        "openosint-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 20 tools correctly (18d ago).

Overview

The OpenOSINT MCP server connects AI clients to 21 OSINT tools for investigating public information across email, usernames, domains, IPs, breaches, DNS, GitHub, and threat-intelligence services. It runs locally through the OpenOSINT package and exposes passive tools by default, with active or target-touching operations requiring explicit enablement. Results come from live tool executions, while generated summaries are intended as leads to verify. Reach for it when an MCP-compatible client needs structured reconnaissance and public-data investigation workflows.

Use cases

  • Investigate an email address for breach and public-account exposure
  • Enumerate domain records, subdomains, certificates, and internet-facing services
  • Enrich an IP address with location, ASN, reputation, and hosting indicators
  • Pivot from GitHub profiles and commits to related public identifiers
  • Generate and inspect public search-engine footprints for an entity

Key features

  • 21 OSINT investigation tools over MCP
  • Passive tools enabled by default
  • Email, username, breach, domain, DNS, and IP investigation
  • Shodan, VirusTotal, Censys, AbuseIPDB, and GitHub lookups
  • Structured search footprint and entity graph results
  • Live dork search and optional URL scraping

Tools20

What OpenOSINT lets your agent do. Expand a tool for its parameters.

Verified live~2.8k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

50/52 checks healthy over the last 91d

What it can do

From the 20 tools this server returned when we ran it.

Runs commands · 1Handles credentials · 3Makes network requests · 7Read-only tools · 19
Network at startup2 connections
Files written at startup15

Observed 2026-10-22 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · openosint (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1.9kStargazers on the source repository.
Last commit4d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed20Callable tools this server registers over MCP.
Directory activity9 viewsConfig copies, upvotes, and views on AllMCPs.

How OpenOSINT works

What OpenOSINT does

The OpenOSINT MCP server provides an MCP interface to an open-source intelligence toolkit for security researchers and analysts. It covers identity pivots, infrastructure checks, breach exposure, public search, and threat-intelligence lookups. The project is listed in the Security category and is intended for legal, authorized use.

Its 21 tools include email and username searches, breach checks, WHOIS and RDAP lookups, IP intelligence, DNS analysis, subdomain enumeration, paste searches, GitHub investigation, and searches through Shodan, VirusTotal, Censys, AbuseIPDB, and IP2Location. It also supports GDELT geographic news results, live dork searches, URL retrieval, and entity-aware search footprints.

How it works

The OpenOSINT MCP server lets an MCP-compatible AI client call investigation tools directly. In the broader application, an agent can select and chain tools based on findings, such as pivoting from breach results to a GitHub search. Tool outputs come from real executions, and findings include the tool call that produced them. AI-generated interpretations should be treated as leads rather than confirmed evidence.

Passive operation is the default. Email, username, subdomain, and phone checks are marked noisy or disabled by default, while URL scraping is disabled because it contacts the target. The project documentation states that passive tools are exposed by default and that active tools can be enabled with --allow-active.

Setup and configuration

Install the package from PyPI with:

Terminal
pip install openosint

The MCP server can run through uvx, without a separate application installation, according to the project documentation. OpenOSINT also offers a local interactive REPL, a web interface, and direct command-line tool execution, but those interfaces are separate from using the MCP endpoint.

Some capabilities depend on external services and their APIs. The documented providers include Have I Been Pwned, ipinfo.io, Shodan, VirusTotal, IP2Location.io, Censys, AbuseIPDB, GitHub, Bright Data, and others. RDAP, DNS, and GDELT tools are described as keyless or built-in where applicable.

Tools and capabilities

  • Investigate email accounts, usernames, breach exposure, phone details, and paste mentions.
  • Query domain ownership, RDAP registration data, DNS records, SPF, DMARC, DKIM, and subdomains.
  • Enrich IP addresses with location, ASN, hostname, abuse reputation, VPN, proxy, Tor, and datacenter indicators.
  • Inspect exposed services, banners, certificates, CVEs, antivirus verdicts, GitHub profiles, repositories, and commit-discovered emails.
  • Generate Google dork URLs without network calls, or retrieve live search results through the dork-search tool.
  • Produce structured search-footprint results and Entity Correlation Graph nodes and edges.
  • Return recent geolocated news in GeoJSON format and fetch web pages as clean Markdown when active scraping is enabled.

Limitations and notes

The OpenOSINT MCP server is designed for public-information research, not as proof of identity, ownership, compromise, or attribution. Several lookups can be noisy, and the phone tool's network behavior is explicitly described as unverified. Registrant contacts from RDAP are redacted by policy.

External API availability, quotas, result quality, and sponsored services affect individual tools. IP2Location is identified as sponsored, and Bright Data powers live SERP, scraping, and footprint capabilities. Use the OpenOSINT MCP server only for lawful and authorized investigations, and verify findings independently before acting on them.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about OpenOSINT

OpenOSINT is an MCP server that connects AI clients to 21 OSINT tools for public-data investigation. Its main tools cover email, username, breach, WHOIS, RDAP, DNS, IP, GitHub, Shodan, VirusTotal, Censys, AbuseIPDB, search footprints, dorks, and URL retrieval, with passive tools enabled by default.

Install OpenOSINT from PyPI with `pip install openosint`. The MCP server can also run through `uvx` without a separate application installation. Consult the project documentation for the exact client configuration and any provider credentials required by individual tools.

Yes, OpenOSINT is intended for any MCP-compatible AI client, which includes Cursor. Configure the client to launch the OpenOSINT MCP server using the project’s documented command, then account for any API credentials required by selected external services.

Yes, passive operation is the default. Passive tools are exposed to MCP clients automatically, while active tools can be enabled with `--allow-active`. Noisy searches and URL scraping are disabled by default, and scraping is marked as target-touching because it fetches the URL.

OpenOSINT requires provider access only for tools that use external services, such as Shodan, VirusTotal, Censys, AbuseIPDB, GitHub, Have I Been Pwned, Bright Data, and IP2Location. RDAP, DNS, and GDELT are documented as keyless or built-in where applicable.

Related MCP servers

All in Communication All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewOpenOSINT AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/openosint?style=directory)](https://allmcps.com/mcp/openosint)
HTML Embed
<a href="https://allmcps.com/mcp/openosint"><img src="https://allmcps.com/api/badge/openosint?style=directory" alt="OpenOSINT on AllMCPs" /></a>