← MCP Security Catalog

openosint 2.27.0

pypi · openosint · latest release

Scan failed
Security result
23
Observed tools
—
Version rating
—
Change risk

Independent inventory

Observed 2026-08-26T10:15:22.799Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
generate_dorksGenerate targeted Google dork URLs for any target (name, email, username, domain).
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
graph_exportExport the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'.
Input schema
{
  "type": "object",
  "properties": {
    "exclude_datasets": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Dataset names to omit entirely, e.g. ['openosint:hibp']."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  }
}
——
graph_neighborsTraverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'.
Input schema
{
  "type": "object",
  "properties": {
    "entity_id": {
      "type": "string"
    },
    "depth": {
      "type": "integer",
      "description": "Hops to traverse (default 1, capped at 5)."
    },
    "cross_layer": {
      "type": "boolean",
      "description": "Include bridge links into the raw infra graph."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "entity_id"
  ]
}
——
graph_review_candidatesHuman review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges — only this action can write judgement='positive'.
Input schema
{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "list",
        "decide"
      ]
    },
    "schema": {
      "type": "string",
      "enum": [
        "Person",
        "LegalEntity",
        "Organization",
        "UserAccount"
      ],
      "description": "list filter: restrict to one FtM schema."
    },
    "min_score": {
      "type": "number",
      "description": "list filter: minimum score."
    },
    "max_score": {
      "type": "number",
      "description": "list filter: maximum score."
    },
    "dataset": {
      "type": "string",
      "description": "list filter: either entity must carry a statement from this dataset."
    },
    "entity_id": {
      "type": "string",
      "description": "decide: first entity of the pair."
    },
    "canonical_id": {
      "type": "string",
      "description": "decide: second entity of the pair."
    },
    "decision": {
      "type": "string",
      "enum": [
        "accept",
        "reject"
      ]
    },
    "reviewer_id": {
      "type": "string",
      "description": "decide: reviewer identifier, recorded if given."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "action"
  ]
}
——
investigate_multiInvestigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Requires ANTHROPIC_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "targets": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of OSINT targets (emails, usernames, domains, IPs). Max 10."
    }
  },
  "required": [
    "targets"
  ]
}
——
scrape_urlFetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and bot-protection. Returns the page as clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "url"
  ]
}
——
search_abuseipdbCheck an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0–100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Requires ABUSEIPDB_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_breachCheck if an email appears in data breaches via HaveIBeenPwned. Requires HIBP_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "email": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "email"
  ]
}
——
search_censysSearch Censys for internet-facing infrastructure data. IP address → open ports, services, ASN, country. Domain → certificate history, SANs, issuer, first/last seen. Requires CENSYS_API_ID and CENSYS_SECRET env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_dnsComprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——
search_domainEnumerate subdomains of a target domain using sublist3r.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——
search_dorks_liveExecute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default — each is a billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_emailEnumerate accounts linked to an email using holehe.
Input schema
{
  "type": "object",
  "properties": {
    "email": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "email"
  ]
}
——
search_footprintCollect a target's public search-engine footprint via the Bright Data SERP API. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results and Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "max_queries": {
      "type": "integer",
      "description": "Max SERP queries (default 3, each is billable)."
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_githubSearch GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_ipRetrieve geolocation and ASN data for an IP address via ipinfo.io.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_ip2locationEnhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Requires IP2LOCATION_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "ip"
  ]
}
——
search_pasteSearch Pastebin dumps for an email or username via psbdmp.ws.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_phoneGather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format.
Input schema
{
  "type": "object",
  "properties": {
    "phone": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "phone"
  ]
}
——
search_shodanQuery Shodan for host intelligence or banner search. IP address → host lookup (open ports, org, CVEs). Any other string → keyword/service search. Requires SHODAN_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "query"
  ]
}
——
search_usernameEnumerate platforms where a username is registered using sherlock.
Input schema
{
  "type": "object",
  "properties": {
    "username": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "username"
  ]
}
——
search_virustotalCheck IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Requires VIRUSTOTAL_API_KEY env var.
Input schema
{
  "type": "object",
  "properties": {
    "target": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "target"
  ]
}
——
search_whoisRetrieve WHOIS registration data for a domain.
Input schema
{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string"
    },
    "json_output": {
      "type": "boolean",
      "description": "Return result as structured JSON."
    }
  },
  "required": [
    "domain"
  ]
}
——

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

No completed comparison is available.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: 425aefd1d042642c7a4a5859cdd38e719fd2c2c3091a3a3cebf178abbbcf0927

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.