OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

Quickstart

Needs uv. No API keys for the default flow.

Claude Code plugin (skills plus a passive MCP server):

/plugin marketplace add OpenOSINT/OpenOSINT/plugin install openosint@openosint/openosint:osint example.com

Any agent (Codex, Gemini CLI, Cursor and other Agent Skills clients):

npx skills add OpenOSINT/OpenOSINT

MCP server or pip (other clients):

claude mcp add openosint -- uvx --from openosint openosint-mcppip install openosint && openosint exposure example.com

What you can do

Real output, captured 2026-11-04 on v2.37.0 and trimmed. None of these commands needs an API key or an AI provider.

$ openosint exposure example.comGrade: B  Score: 88/100Checks:  email OK [passive] · registration OK [passive] · tls OK [touches target] · http_headers OK [touches target]  [LOW] DMARC has no aggregate report address (dmarc_no_rua)  [LOW] Strict-Transport-Security header missing (hsts_missing)  [INFO] Domain registered 31.2 years ago (domain_age)
$ openosint dns example.com[DNS] NS: elliott.ns.cloudflare.com., hera.ns.cloudflare.com.[DNS] SPF: v=spf1 -all[DNS] DMARC: "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"[DNS] DKIM not checked: selector probing is enumeration (needs --allow-active).
$ openosint rdap example.com[+] Registrar: RESERVED-Internet Assigned Numbers Authority[+] Registered: 1995-08-14T04:00:00Z[+] Expires: 2027-08-13T04:00:00Z[+] Name servers: elliott.ns.cloudflare.com, hera.ns.cloudflare.com
$ openosint ip 8.8.8.8[+] Hostname: dns.google[+] Org: AS15169 Google LLC[+] City: Mountain View
$ openosint gdelt example.comNo geolocated coverage found for 'example.com'. Coverage: the last 15 min (...)$ openosint gdelt ukraine[+] White House, District Of Columbia, United States (38.8951, -77.0364) — 1 article(s)

The same commands are what the skill runs for an agent. All of them are in the CLI reference.

Why OpenOSINT

• Real tool executions. Tools are Python code; only their actual output reaches the model.
• Provenance. Every finding is shown with the tool call that produced it. AI summaries are leads to verify, not proof.
• Passive by default, with noise labels. Tools that touch the target or are noisy are not even offered to the agent until you opt in.
• Works with no keys. exposure, dns, rdap, whois, ip, gdelt and dorks need no account.

SpiderFoot is the better choice when you want a large standalone scanner. OpenOSINT is for agents that need a small set of real, labelled tools.

Tools

Level is the noise label: passive tools are on by default; anything else needs --allow-active. Per-tool docs: openosint.tech/tools.

Sherlock, holehe, sublist3r and phoneinfoga are wrapped as local binaries; install them yourself and enable active tools to use them.

Setting up the three Bright Data tools: Using OpenOSINT with Bright Data.

Passive by default

Agents and MCP clients are only offered tools that query third-party data sources or compute locally. Anything that touches the target or sends many requests from your IP is off until you opt in, and is not listed in an MCP client's tools/list at all.

Enable active tools with openosint --allow-active …, OPENOSINT_ALLOW_ACTIVE=1, Web UI Settings (loopback only), or openosint-mcp --allow-active. Passive is not private: every service you query sees the query. Per-tool "what it sends" table and the tool-call cap: Safety.

Go deeper

Web UI + globe

openosint web starts a local browser app with streaming chat, tool cards, a news globe and a graph view. Docs.

[OpenOSINT globe view: an agent investigation lands as a point on an interactive 3D globe, clicking it pivots into a follow-up investigation, and the new entity appears in the entity graph]

An agent investigation landing live on the globe; click a point to pivot. Sharper MP4 · Live demo (bring your own key, no signup).

Entity graph

A FollowTheMoney entity graph with statement-level provenance and a human review queue for same_as candidates. Docs.

External exposure report (beta)

openosint exposure example.com grades email authentication, TLS, registration and security headers A to F. Docs.

Installation

pip install openosint, or run without installing: uvx openosint web. Python 3.10+. Install guide.

MCP Server

Works in Claude Desktop, Claude Code, Cursor and any MCP client: uvx --from openosint openosint-mcp. Client configs.

Configuration

Keys go in the web UI Settings, ~/.openosint/config.env or the environment; the app starts with none. All variables · CLI reference · Limitations.

Docker

docker compose up --build, then open http://localhost:8080. Docker notes.

Moved from this README: per-tool details are at openosint.tech/tools; CLI flags (old #cli-reference) at /docs/cli; limitations (#limitations) at /docs/troubleshooting; integrations (#integrations) at /tools; the graph module (#graph-module-optional) at /docs/entity-graph.

Hosted versions

Built on this engine. The open-source project stays free and MIT-licensed.

• Monitor: scheduled external checks of your domain, with an email when something gets worse. Free for one domain.
• Diligence: due-diligence signals for UK companies and LEI holders, from official registries, each with its source.
• Cloud: hosted REST and MCP API for IP and domain infrastructure intelligence (invite-only).

Sponsors

Featured Integrations

[IP2Location.io logo]

IP2Location.io — powers search_ip2location · Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

[TestMu AI logo]

TestMu AI

TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.

Open: Breach / Compromised-Credential Data · Email / Identity Lookup · Residential Proxies — see SPONSORSHIP.md.

Sponsor on Open Collective · tiers in SPONSORSHIP.md · commercial license and support: COMMERCIAL.md.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md (workflow, demo regeneration, conventions) and read DISCLAIMER.md first. Maintainer: Tommaso Bertocchi · @openosint_oss · [email protected]. Contributors: @consocio (#6).

License

MIT. See LICENSE. For authorized security research only; see DISCLAIMER.md.

¹ Bright Data links in this README are affiliate/referral links: OpenOSINT earns a commission if you sign up through them, at no extra cost to you.

OpenOSINT v2.38.0 — November 2026

Star History

[Star History Chart]