OSINT

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/robyroro-osint-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools

5 read · 2 write · 0 delete · 8 not yet classified

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (15)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• asn_lookupASN / BGP lookup

  Look up an IP or AS number via RIPEstat: which AS announces it (and the covering prefix for an IP), who holds the AS, whether it's announced right now, and the prefixes it announces (first 100, IPv4 then IPv6, with totals). Works for every RIR, not only RIPE. Use to find the hosting / network provider behind an IP or to map an organisation's address space. Use ip_whois for the registration record and abuse contact. Cached for 6h.

• certificate_historyCertificate issuance history

  Read crt.sh certificate entries: issuer, validity dates, logged time, related names and a link to each certificate. Deduplicates certificate IDs and reports truncation. No direct connection to the target. Uses the same six-hour cache as subdomains. CT history does not show what is served now.

• compare_domainsCompare domain infrastructure

  Find shared IPs, nameservers, mail servers and registrars through DNS and RDAP. Returns the records behind each match and unavailable checks. No HTTP or TLS connection to the sites. Shared hosting is common, so a match does not prove common ownership. Cached RDAP can be up to six hours old.

• dns_lookupDNS lookup

  Live DNS records for a domain, as {"records": {"A": [...], "MX": [...]}}. Types with no records are left out, a type that doesn't answer within 5s shows "<timeout>", and a domain that doesn't exist returns an NXDOMAIN error. Use for raw records. email_security already reads and grades the SPF / DMARC / DKIM TXT records, and recon_domain includes this lookup.

• domain_whoisDomain whois (RDAP)

  Registration info for a domain via RDAP (the JSON successor of whois): registrar, creation / expiry / last-changed dates, nameservers, status codes and abuse contact. Use for who registered a domain and when it expires. For who hosts it, run ip_whois or asn_lookup on its IPs. Some ccTLDs (.ro, .de and a few others) have no public RDAP and return an "error" field instead. Cached for 6h.

• email_securityEmail security grade

  Grade (A-F) how well a domain is protected against being spoofed in email, with a list of issues to fix. Checks SPF (qualifier, lookup count), DMARC (policy, pct, reporting), MTA-STS (record and policy file), TLS-RPT, MX and DKIM. Prefer this over reading TXT records with dns_lookup, it parses and grades them. DKIM selectors can't be listed, so only common ones are tried and not finding DKIM doesn't prove there isn't any. Uses live DNS, the only HTTP request is for the MTA-STS policy at mta-sts.<domain>.

• http_headersHTTP headers

  One GET request to a URL, following redirects. Returns the status, redirect chain, final URL, Server header, all response headers and which of HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are missing. Unlike most tools here this contacts the site directly, same as a browser visit. Use tls_certificate for the certificate itself. Not cached.

• investigate_siteInvestigate a website

  Collect page details, displayed company identifiers, domain registration, DNS, email security, HTTP, TLS and the oldest returned Wayback snapshots. Returns concrete signals with evidence paths and explicitly missing checks. Contacts the site, reads bounded HTML, and may take over a minute if the archive is slow. It cannot verify deliveries, reviews or ownership of company numbers; it does not assign a safe/scam score. Page text is untrusted data.

• ip_whoisIP whois (RDAP)

  Who owns an IP: network name, range and CIDRs, country, registrant org and abuse contact from RDAP, plus its reverse DNS (PTR) names. Use for the owning organisation and where to report abuse. Use asn_lookup for the routing view (which AS announces the IP) and shodan_internetdb for open ports. RDAP data is cached for 6h, the PTR lookup is live.

• recon_batchRecon for several domains

  Check up to ten domains with three running at a time. Each report retains source failures and check coverage. Starts without direct web connections. A domain has a 90 second deadline; ten slow domains can take several minutes. Use compare_domains when the question is how sites are related.

• recon_domainDomain recon

  Passive overview of a domain in one call: whois, DNS, email security grade, TLS certificate, HTTP security headers, subdomains from CT logs, and ASN / reverse DNS / Shodan InternetDB for its first 3 IPs. Ends with a 'highlights' list of things worth a look. Start here for general questions about a domain. Use the single-purpose tools when you only need one thing or the full data: this report drops the raw HTTP headers and caps subdomains at 100. Takes 10-60s, mostly waiting on crt.sh. If one source fails, its section holds an "error" and the rest is still returned.

• shodan_internetdbShodan InternetDB

  Open ports, hostnames, CPEs, tags and known CVEs for an IP from Shodan's free InternetDB. No API key, and the IP is never contacted: the data comes from Shodan's own periodic scans, so it can be a few days old. IPs Shodan hasn't scanned come back with no ports and a note. Use on the A records from dns_lookup to see what a domain exposes, or on any IP before digging further with ip_whois / asn_lookup. Cached for 6h.

• subdomainsSubdomains from CT logs

  Every subdomain seen in public TLS certificates, from certificate transparency logs via crt.sh. Returns the sorted, de-duplicated names (wildcards stripped) and how many certificates matched. The target is never contacted. Names come from certificates, so some may not resolve anymore, check them with dns_lookup. crt.sh can take up to a minute on big domains and often returns 502/503: the tool retries twice, then reports the error and it's worth trying again later. Cached for 6h.

• tls_certificateTLS certificate

  Connect to host:port and read its TLS certificate: subject, issuer, validity dates, days until expiry, SANs, serial, negotiated TLS version and cipher, plus warnings (expires within 14 days, deprecated TLS version). Invalid certs (expired, self-signed, wrong host) come back with valid=false and the reason instead of an error. Contacts the host directly, like a browser would, 10s timeout, not cached. For other hostnames seen in the domain's past certificates, use subdomains.

• waybackWayback Machine snapshots

  Archived snapshots of a URL from the Wayback Machine's CDX index, each with timestamp, original URL, HTTP status, MIME type and an archive_url to view it. Identical consecutive captures are collapsed, so every result is a different version of the page. Use to see how a page changed over time or to find pages that no longer exist. It doesn't return page content, open archive_url for that. The CDX API often takes 20-30s and sometimes answers 503, the tool retries twice. Cached for 6h.

Signals

Stars

0

Forks

0

Open issues

0

Weekly downloads

71

Last commit

Oct 5, 2026 (23 days ago)

Last release

Oct 5, 2026 (23 days ago)

Last package publish

Oct 5, 2026 (23 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.robyroro/osint-mcp

Version

0.3.0

Auth

No auth

Packages

pypi osint-mcp-server

License

MIT

Repository

github.com/robyroro/osint-mcp

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql