OTInstaller

com.otinstaller由 otinstaller.com 发布v0.16.1更新于 Oct 25, 2026

Install and run open-source OSINT tools in a local sandbox, asking before runs that touch a target.

发布方自己的服务:OTInstaller Registry

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

让助手在本地容器沙箱中安装并运行开源 OSINT 工具,涉及目标的运行会先征求确认。

可以做什么
  • 搜索 OTInstaller 注册表,并安装、更新或移除 OSINT 工具
  • 以类型化输入(用户名、邮箱、域名、电话、IP、URL)运行工具,并以统一 JSON 保存结果
  • 查看历史运行记录,并获得基于本次发现下一步该运行什么的建议
  • 将某次运行的结果生成 24 小时有效的分享链接
  • 运行内置 playbook,或对某个目标自动运行所有匹配的已安装工具
  • 为需要 API 密钥的工具配置密钥,密钥保存在操作系统钥匙串中
适用场景
适合需要助手用经过筛选的开源工具对邮箱、用户名、域名、电话、IP 或 URL 进行 OSINT 查询,而用户不想克隆仓库或管理 Python 环境的场景。
运行要求
作为本地进程在用户桌面运行,ot 可执行文件需在 PATH 中。需要 Docker Desktop 或 Podman 处于运行状态,cosign 可选用于校验镜像签名。部分工具需要 API 密钥,通过命令行配置并保存在操作系统钥匙串。需要网络访问注册表和容器镜像。
安装前请注意
运行会触及外部目标,助手会在运行前询问,但结果会保存在 ./results 并可生成 24 小时分享链接。遥测会上报安装与运行计数(工具、版本、结果、耗时、容器引擎、操作系统、架构),可用 OT_NO_TELEMETRY 或 DO_NOT_TRACK 关闭。API 密钥保存在操作系统钥匙串。OSINT 活动可能受目标相关的法律与伦理限制。

安装

在 SourceWeft 中

  1. 打开 控制台中的 OTInstaller,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

ot

ot is the OSINT package manager. One command installs, runs, updates or removes any tool in the OTInstaller registry, the largest registry built only for OSINT tools (over 130 of them). No more cloning repositories, fixing Python versions and learning each tool's flags: every tool takes the same typed inputs, runs in a container that can't read your files, and saves its result in the same JSON shape.

Get started

Put ot (or ot.exe) somewhere on your PATH. Tools run in containers, so Docker Desktop or Podman must be running; with cosign installed, ot also verifies each image's signature. Then set it up:

sh
ot start      # pick starter packs and tools, AI agents and settings, then installot doctor     # check Docker, cosign, the keychain and the registry

ot start asks at a terminal; ot start --tools <ns/name> --yes does the same from a script, and https://otinstaller.com/start builds the command for you.

Run tools

sh
ot search email                                        # tools that take an email addressot run osintverse-community/holehe e:[email protected]ot runs                                                # every run is saved under ./results; `ot runs <run-id>` shows oneot pivot <run-id>                                      # what to run next on what a run foundot share <run-id>                                      # a link to the run's results that works for 24 hours

Typed inputs fill the matching input of any tool: u: username, e: email, d: domain, p: phone, ip: IP address and url: URL. Or let ot pick: ot auto [email protected] runs every installed tool that takes an email address, and on a fresh machine offers to install a bundled playbook's tools first. ot playbook --list shows the playbooks. Tools that need an API key say so; ot keys setup walks you through them, and keys stay in your OS keychain.

Scripts, CI and AI agents

  • --json (or OT_OUTPUT=json) gives JSON output and one-line JSON errors on stderr, and ot never prompts without a terminal. See https://otinstaller.com/docs/automation.
  • ot mcp install claude (or claude-desktop, cursor, vscode, codex, gemini) adds ot's MCP server to your client. Agents ask you before any run that touches a target. See https://otinstaller.com/docs/agents.

Updates

ot outdated lists installed tools with newer versions and ot update --all installs them. ot self-update installs a new release of ot after checking its signature.

Telemetry

ot counts installs and runs of registry packages, so the registry can show which tools are used and which versions fail. A count carries the tool and its version, how a run ended and how long it took, the container engine, what started it (a command, CI or an AI agent), and your OS, architecture and ot version. It never carries your inputs, targets or results, file paths, run ids, case names, keys or tokens, and tools installed from a local manifest are never counted. The registry keeps daily totals only.

sh
ot telemetry                          # what is sent, and whether it is onot telemetry off                      # or set OT_NO_TELEMETRY=1 or DO_NOT_TRACK=1OT_TELEMETRY_DEBUG=1 ot run <tool> …  # print each count instead of sending it

Turning it off also stops the offer to report a failed run; DO_NOT_TRACK stops the daily update check too. Details: https://otinstaller.com/policy/privacy

Links

Docs: https://otinstaller.com/docs/getting-started · CLI reference: https://otinstaller.com/docs/cli · Bugs and ideas: https://github.com/OTInstaller/feedback/issues · Source: https://github.com/OTInstaller/otinstaller

Licensed under the Apache License 2.0 (LICENSE).

来源:cli/README.md,提交 cd330f6

工具

0
SourceWeft 曾在隔离沙箱中以无凭据方式启动该软件包一次,以列出其工具,但未能完成:该软件包类型无法在沙箱中运行。

版本历史

5
  1. v0.16.1最新Oct 25, 2026
  2. v0.16.0Oct 24, 2026
  3. v0.15.0Oct 23, 2026
  4. v0.14.0Oct 23, 2026
  5. v0.13.1Oct 21, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Otinstaller 集成