recon

recon

[CI] [PyPI] [Python] [License] [OpenSSF Scorecard] [OpenSSF Best Practices]

Point recon at a domain to see its public technology and identity footprint: email providers and controls, identity indicators, SaaS services, and cloud infrastructure. No credentials, API keys, or active scanning. Use the CLI for a quick lookup, versioned JSON for automation, or the local MCP server from an agent.

recon reports evidence-backed observations, not a complete inventory or a security verdict. A domain does not establish an organization's boundaries.

See the Output

[Synthetic recon output in a modern Linux terminal]

Synthetic illustration, generated, not captured. The real formatter renders a deterministic, no-network fixture for Example Industries Ltd. No real organization is depicted, and no live lookup of reserved example.com reproduces this fixture.

demo@recon:~$ recon example.com    # synthetic fixture, not a captured run6 sources: 5 matched, 1 no matchExample Industries Ltd (unverified)example.comReserved name: results are public residue, not an organization.──────────────────────────────────────────────────────────────────────────────  Provider      Microsoft 365 + Proofpoint gateway  Tenant        a1b2c3d4-e5f6-7890-abcd-ef1234567890 • NA  Tenant domain example-industries.onmicrosoft.example.com  Auth          Federated  Confidence    ●●● High (3 sources)

Services  Email            Microsoft 365, Proofpoint, DMARC reject, DKIM,                   SPF strict, MTA-STS enforce  Identity         Okta  Cloud            Cloudflare (CDN/edge), AWS Route 53 (DNS)  Security         Wiz Security  Data & Analytics Snowflake, Datadog  Collaboration    Slack, Atlassian (Jira/Confluence), GitHub, Zoom                   Evidence roles: --explain

High-signal related domains  login.example.com, support.example.com, status.example.com
Insights  Federated identity observed; identity-vendor indicators: Okta  Email security: observed controls: DMARC reject, DKIM, SPF strict, MTA-STS

Quick Start

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/pueo-labs/recon/main/scripts/install.sh | bash

Windows (PowerShell):

powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/pueo-labs/recon/main/scripts/install.ps1 | iex"

The installer sets up recon for your user account, including Python when needed. Open a new terminal afterward. Python 3.15 is the default development and release runtime; 3.11 through 3.15 remain supported. Already have a supported Python? Use pip install recon-tool in a virtual environment, or uv tool install --python 3.15 recon-tool / pipx install --python python3.15 recon-tool on managed distributions like Arch Linux and Omarchy. For review-before-run instructions, other package managers, updates, and recovery, see the installation guide.

recon --version      # offline install checkrecon doctor         # online connectivity and installation diagnostics

Lookups make DNS queries visible to recursive and authoritative infrastructure. MTA-STS is the only default target-owned HTTP request; Google CSE and BIMI certificate probes require explicit --direct-probes. There is no port scanning or application crawling. Replace the placeholder to start:

recon "<domain-you-want-to-review>"

Ordinary lookups may reuse the 24-hour result cache and say so when they do; a result whose collection had unavailable sources is never reused. Use --no-cache to bypass the cache for both reading and writing; certificate-transparency enrichment has a separate cache. See first lookup and cache behavior.

Common Commands

The bare command stays compact. Request evidence or structured output when needed:

recon example.com                      # compact panelrecon example.com --explain             # evidence and source statusrecon example.com --json                # structured recordrecon example.com --plain               # linear text for screen readers and greprecon review example.com               # fresh, evidence-linked review bundlerecon batch domains.txt --json          # look up a supplied domain listrecon delta example.com                # compare with a cached baselinerecon update                           # update through the original package manager

These examples use reserved domains; real lookups will not reproduce the synthetic illustration above. For multi-domain reviews, recon describes observed similarities and differences without inferring ownership or a corporate relationship. See the evidence-first review workflow and batch guide.

Use with an Agent

The PyPI package installs the CLI and MCP runtime. Connect the local server to Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or Kiro:

recon mcp install --client=claude-desktoprecon mcp doctor

Restart the client and begin with manual tool approvals. Ask for one domain's email and identity indicators, or a service comparison across supplied domains. Missing evidence means "not observed", not "not used"; collection failures remain explicit. Local execution is the default, and the project does not operate a hosted service.

See MCP setup and supported clients and skills, plugins, and their validation status.

Omarchy Desktop Shell Integration

recon includes a thin, keyboard-first desktop shell plugin for Omarchy located in integrations/omarchy/:

• Keyboard-driven workflow: focus domain input automatically, press Enter to run bounded inspection, and press Ctrl+D to toggle baseline delta comparison.
• Direct process invocation: passes structured arguments directly (["recon", domain, "--json"]) without shell interpolation.
• Safe clipboard handling: pasting text never triggers an automatic network request.
• Zero background daemons: runs unprivileged inside Omarchy's Quickshell environment.

See integrations/omarchy/README.md for installation and shortcuts.

Documentation

Contributing and Support

Catalog corrections and documented vendor patterns are especially useful. Start with CONTRIBUTING.md for setup, verification, and contribution requirements; coding agents should also read AGENTS.md. For repeatable catalog work, start with the harness-neutral maintenance skill and offline example.

Use issues for bugs and feature requests. Keep public examples reserved and synthetic; never post evaluated company domains, tenant IDs, or per-domain results. See the private reporting paths and security policy. Intended for defensive use.

License

Apache 2.0.