OpenOSINT

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/openosint-openosint

About

Use cases: deep-research, security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

20 read · 0 write · 0 delete · 5 not yet classified

Secrets

5 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Python package

Tools (25)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• generate_dorks

  Generate targeted Google dork URLs for any target string. Always run this first when investigating a full name to discover real usernames and emails before calling other tools.

• graph_export

  Export the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'.

• graph_neighbors

  Traverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'.

• graph_review_candidates

  Human review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges — only this action can write judgement='positive'.

• investigate_multi

  Investigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Uses ANTHROPIC_API_KEY env var.

• scrape_url

  Fetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and other bot-protection. Returns the page as clean Markdown. Use to retrieve content from URLs discovered by other tools when direct access is blocked. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE.

• search_abuseipdb

  Check an IP address against AbuseIPDB for malicious activity reports, abuse confidence score, total reports, and ISP.

• search_breach

  Check if an email address appears in known data breaches via HaveIBeenPwned. Only call this with a valid email address, never with a name.

• search_censys

  Look up an IP host (open ports, services, ASN) or domain certificates (SANs, issuer, validity dates) via Censys.

• search_dns

  Enumerate DNS records for a domain: A, AAAA, MX, NS, TXT, CNAME, SOA.

• search_domain

  Enumerate subdomains by scraping search engines and aggregators. Noisy: listed only when the operator has enabled active tools.

• search_dorks_live

  Execute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Use after generate_dorks when you need actual search results, not just URLs. Runs up to 5 dorks by default — each is a billable API call. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

• search_email

  Enumerate online accounts and services associated with an email address using holehe. Use when the user provides an email to investigate.

• search_footprint

  Collect a target's public search-engine footprint via the Bright Data SERP API. Detects the entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results (title, URL, snippet) and Entity Correlation Graph nodes/edges for discovered domains and profiles. Use when you need a targeted, type-aware SERP sweep rather than generic dork URLs. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

• search_gdelt_geo

  Search recent, geolocated worldwide news from GDELT's 15-minute article feed (headlines and URLs matched against the query; places come from the articles' location mentions). No API key required. Use for situational awareness of events in a region, or to find geolocated news mentioning a target. The result says how far back it covers; the first call after startup may cover only the last 15 minutes while older articles load. Optionally scope the search to a bounding box (e.g. from a user-selected map area); use query "*" to list all coverage inside it.

Compare and alternatives

• Alternatives to OpenOSINT →

Featured in

• Best MCP servers for threat intelligence

Signals

Stars

1,801

Forks

281

Open issues

13

Contributors

5

Weekly downloads

1,147

Last commit

Oct 22, 2026 (7 days ago)

Last release

Oct 19, 2026 (9 days ago)

Last package publish

Oct 19, 2026 (9 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.OpenOSINT/openosint

Version

2.36.1

Auth

API key

Packages

pypi openosint

License

MIT

Repository

github.com/OpenOSINT/OpenOSINT

Website

openosint.tech

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql