MCP server intelligence profile

openosint MCP Server

AI-powered OSINT framework exposing 10 tools (email, username, breach, WHOIS, IP, subdomain, phone, Shodan, dorks, Pastebin) as an MCP server for Claude Code and Claude Desktop, with an autonomous agent REPL and direct CLI

Local OnlyOfficial distributionOpenOSINT
Verified cleanPypi · 2.27.0

Our scanner tested version 2.27.0 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

1Distribution channel
23Independently observed tools
0Linked remote endpoints
AvailableVersion intelligence

Install and connect

Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.

Install openosint from PyPI

Install exact version 2.27.0. The executable name has not been verified, so it is intentionally not guessed.

python -m pip install 'openosint==2.27.0'

Identity

Canonical slugopenosint-51f447faDeploymentLocal Only
Canonical packagepypi:openosintRepositoryOpenOSINT/OpenOSINT
First publishedJul 13, 2026Latest releaseAug 26, 2026
Last security verification—Classification confidence90%
PublicationPublishedOfficial distributionYes

Distributions

ChannelIdentifierCurrent versionVersionsSource
pypiopenosint2.27.04Repository

Current release

PackageVersionPublished / observedInventorySecurity scan
pypiopenosint2.27.0CurrentAug 26, 202623 toolsSucceeded · 0 resources · 0 promptsFailed
Enterprise protection

Continuously monitor this MCP for security risk

Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.

  • Independent exact-version security scans
  • Continuous release and vulnerability monitoring
  • Risk-change alerts with capability context
  • Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.

Current version evidence

Provenanceartifact_hash_verifiedSignature—
MCP SDK— Artifact SHA-256425aefd1d042642c7a4a5859cdd38e719fd2c2c3091a3a3cebf178abbbcf0927
Scannermcp-proof-engine 0.1.0Scan completedAug 26, 2026
Security rating—Methodology—

Current protocol inventory

2025-06-18Negotiated protocol
openosintServer-reported name
2Capability groups
Aug 26, 2026Observed

Tools 23

ToolCategoryAnnotationsRisk
generate_dorksGenerate targeted Google dork URLs for any target (name, email, username, domain).
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
graph_exportExport the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'.
Input schema
{
  "type": "object",
  "properties": {
    "exclude_datasets": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Dataset names to omit entirely, e.g. ['openosint:hibp']."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  }
}
——
graph_neighborsTraverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'.
Input schema
{
  "type": "object",
  "properties": {
    "entity_id": {
      "type": "string"
    },
    "depth": {
      "type": "integer",
      "description": "Hops to traverse (default 1, capped at 5)."
    },
    "cross_layer": {
      "type": "boolean",
      "description": "Include bridge links into the raw infra graph."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "entity_id"
  ]
}
——
graph_review_candidatesHuman review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges — only this action can write judgement='positive'.
Input schema
{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "list",
        "decide"
      ]
    },
    "schema": {
      "type": "string",
      "enum": [
        "Person",
        "LegalEntity",
        "Organization",
        "UserAccount"
      ],
      "description": "list filter: restrict to one FtM schema."
    },
    "min_score": {
      "type": "number",
      "description": "list filter: minimum score."
    },
    "max_score": {
      "type": "number",
      "description": "list filter: maximum score."
    },
    "dataset": {
      "type": "string",
      "description": "list filter: either entity must carry a statement from this dataset."
    },
    "entity_id": {
      "type": "string",
      "description": "decide: first entity of the pair."
    },
    "canonical_id": {
      "type": "string",
      "description": "decide: second entity of the pair."
    },
    "decision": {
      "type": "string",
      "enum": [
        "accept",
        "reject"
      ]
    },
    "reviewer_id": {
      "type": "string",
      "description": "decide: reviewer identifier, recorded if given."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "action"
  ]
}
——
investigate_multiInvestigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Requires ANTHROPIC_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "targets": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of OSINT targets (emails, usernames, domains, IPs). Max 10."
    }
  },
  "required": [
    "targets"
  ]
}
——
scrape_urlFetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and bot-protection. Returns the page as clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "url"
  ]
}
——
search_abuseipdbCheck an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0–100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Requires ABUSEIPDB_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_breachCheck if an email appears in data breaches via HaveIBeenPwned. Requires HIBP_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "email": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "email"
  ]
}
——
search_censysSearch Censys for internet-facing infrastructure data. IP address → open ports, services, ASN, country. Domain → certificate history, SANs, issuer, first/last seen. Requires CENSYS_API_ID and CENSYS_SECRET env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_dnsComprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——
search_domainEnumerate subdomains of a target domain using sublist3r.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——
search_dorks_liveExecute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default — each is a billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_emailEnumerate accounts linked to an email using holehe.
Input schema
{
  "type": "object",
  "properties": {
    "email": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "email"
  ]
}
——
search_footprintCollect a target's public search-engine footprint via the Bright Data SERP API. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results and Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "max_queries": {
      "type": "integer",
      "description": "Max SERP queries (default 3, each is billable)."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_githubSearch GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_ipRetrieve geolocation and ASN data for an IP address via ipinfo.io.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_ip2locationEnhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Requires IP2LOCATION_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_pasteSearch Pastebin dumps for an email or username via psbdmp.ws.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_phoneGather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format.
Input schema
{
  "type": "object",
  "properties": {
    "phone": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "phone"
  ]
}
——
search_shodanQuery Shodan for host intelligence or banner search. IP address → host lookup (open ports, org, CVEs). Any other string → keyword/service search. Requires SHODAN_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_usernameEnumerate platforms where a username is registered using sherlock.
Input schema
{
  "type": "object",
  "properties": {
    "username": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "username"
  ]
}
——
search_virustotalCheck IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Requires VIRUSTOTAL_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_whoisRetrieve WHOIS registration data for a domain.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——

Resources 0

  • None observed.

Resource templates 0

  • None observed.

Prompts 0

  • None observed.

Remote endpoints

EndpointTransportAuthenticationHealthObserved
No verified remote endpoint is linked.

openosint MCP Server questions

How do I install openosint MCP Server?

Install the selected package version with: python -m pip install 'openosint==2.27.0'

What tools does openosint MCP Server provide?

openosint MCP Server exposed 23 tools during independent protocol observation, including generate_dorks, graph_export, graph_neighbors, graph_review_candidates, investigate_multi, scrape_url, search_abuseipdb, search_breach, and others.

Is openosint MCP Server secure?

Our scanner tested version 2.27.0 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

Explore related MCP server guides

Curated product and capability guides containing this catalog record.

Official vs Community MCP Servers

Let’s talk about MCP security.

Share your details and our security team will contact you.