Log inSubmit server
OSINT MCP logo

OSINT MCP

Runs 26 free OSINT utilities through MCP, with automatic installation and optional API-key configuration.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install OSINT MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "osint-mcp": {
      "command": "uvx",
      "args": [
        "osint-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx osint-mcp

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 7d ago.

Overview

OSINT MCP MCP server exposes 26 free open-source intelligence tools to AI agents over MCP stdio. It installs the package and supported command-line dependencies automatically on macOS or Linux when launched with uvx. Tools cover domains, DNS, usernames, email, URLs, IPs, phone numbers, secrets, and threat intelligence, with optional keys for several services. Reach for it when an agent needs conversational reconnaissance or investigation workflows rather than manually managing many separate OSINT utilities.

Use cases

  • Enumerate subdomains and DNS records for an authorized domain
  • Investigate usernames, email addresses, and phone numbers
  • Enrich IPs, URLs, domains, and hashes with threat intelligence
  • Review historical pages and certificate transparency records
  • Scan authorized repositories for exposed secrets

Key features

  • 26 OSINT tools exposed through MCP
  • Automatic dependency installation on macOS and Linux
  • Passive domain, DNS, username, email, and web investigation
  • Optional API-key support for external intelligence services
  • Installation status and configuration management tools
  • Stdio transport for MCP-compatible clients

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · osint-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
Last commit4mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How OSINT MCP works

What OSINT MCP MCP server does

OSINT MCP packages 26 open-source intelligence utilities as MCP tools for AI agents. Its coverage includes network and DNS lookups, passive subdomain discovery, certificate transparency, username and email investigation, historical web snapshots, phone-number information, threat intelligence, and repository secret scanning.

The tool set combines local programs, Python libraries, and public or key-protected web APIs. Examples include WHOIS, DNS record lookup, Nmap port scanning, Sherlock and Maigret username searches, the Wayback Machine, VirusTotal, Shodan, and TruffleHog. The server also provides utility tools for checking installation status and managing stored API keys.

An OSINT MCP MCP server is most appropriate for security research, initial footprinting, IOC enrichment, bug-bounty workflows, and learning-oriented investigations. Port scanning and secrets scanning are available, but they should be used only against systems and code you are authorized to assess.

How it works

The package starts an MCP server over stdio. At startup, it discovers registered tool implementations and presents them to the connected MCP client. Individual tools invoke their underlying binaries, Python packages, or HTTP APIs and return the resulting information to the agent.

The first uvx osint-mcp launch detects whether the host is macOS or Linux and installs the supported dependencies through mechanisms such as Homebrew, apt, Go, or pip. If a required binary is missing later, the affected tool reports that it is unavailable and points to the installation command instead of terminating the server.

Most tools do not require credentials. Shodan, VirusTotal, ipinfo.io, HaveIBeenPwned, and urlscan.io can use optional free API keys for their respective services; some provide reduced functionality or require a key for access. The server can store and manage these keys through CLI commands or MCP configuration tools.

Setup and configuration

The shortest setup is:

bash
uvx osint-mcp

This launches the stdio server after installing the package and its OSINT dependencies. For a manually managed Python environment, install the package with pip, run osint-mcp install, inspect availability with osint-mcp status, and start it with osint-mcp serve.

Claude Desktop can connect by adding an osint-mcp entry whose command is uvx and whose argument is osint-mcp. The README provides separate configuration locations for macOS and Linux. The project targets Python 3.10 or newer and supports macOS and Linux.

Optional credentials can be stored with commands such as osint-mcp config set shodan_key=YOUR_KEY. Agents can also use osint_config_set; osint_config_get masks stored values, and osint_config_list lists configured keys.

Tools and capabilities

The available tools include:

  • WHOIS, DNS records, IP details, ASN data, port and service scanning, and passive subdomain enumeration.
  • Amass mapping, certificate-transparency searches, theHarvester collection, and DNS reconnaissance.
  • Sherlock and Maigret username searches, plus email-account and breach checks.
  • Wayback snapshots, urlscan.io analysis, Shodan host and query searches, and VirusTotal lookups.
  • PhoneInfoga phone checks, TruffleHog repository or path scans, and Gitleaks history scanning.
  • Installation status plus API-key storage and listing utilities.

The OSINT MCP MCP server marks tools as available or unavailable through its status function, which helps an agent check prerequisites before starting an investigation.

Limitations and notes

Several capabilities depend on external services, rate limits, or API credentials. Free tiers and access requirements differ by provider, so results may be narrower without keys.

Although the default workflow emphasizes passive reconnaissance, the tool list includes active port scanning and secrets scanning. API keys are optional for some services but required for Shodan, VirusTotal, and other provider-specific operations as documented by the project.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about OSINT MCP

OSINT MCP is an MCP server that connects AI agents to 26 free OSINT utilities, including WHOIS, DNS, subdomain, username, email, phone, Wayback, Shodan, VirusTotal, port-scan, and secrets-scanning tools. It runs over stdio and can install its dependencies automatically on supported macOS and Linux systems.

Run `uvx osint-mcp`. On its first launch, it installs the package and supported OSINT dependencies, detects macOS or Linux, and starts the stdio server. A manual alternative is `pip install osint-mcp`, followed by `osint-mcp install` and `osint-mcp serve`.

Yes, OSINT MCP works with Claude Desktop through a stdio configuration entry. Add `uvx` as the command and `osint-mcp` as its argument in the platform-specific Claude Desktop configuration file, then restart Claude Desktop.

It supports optional keys for Shodan, VirusTotal, ipinfo.io, HaveIBeenPwned, and urlscan.io. Keys can be saved with `osint-mcp config set` or through the `osint_config_set` MCP tool. Some services require a key, while others offer reduced access without one.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewOSINT MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/osint-mcp?style=directory)](https://allmcps.com/mcp/osint-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/osint-mcp"><img src="https://allmcps.com/api/badge/osint-mcp?style=directory" alt="OSINT MCP on AllMCPs" /></a>