OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

OpenOSINT An OSINT (Open Source Intelligence) agent for security researchers and analysts: 21 investigation tools behind a natural-language interface, plus an MCP (Model Context Protocol) server so any MCP-compatible AI client can drive them directly. Use it as a REPL, CLI, MCP server, or browser Web UI. Tool results come from real executions, and every finding is shown with the tool call that produced it. AI summaries are leads to verify, not proof.

Hosted version — OpenOSINT Monitor. Weekly external checks of your domain's email authentication (SPF/DKIM/DMARC), TLS, security headers and lookalike domains. Ownership-verified; free for one domain. Prefer to run it yourself? Everything below is free and MIT-licensed.

Self-host (free, MIT)

pip install openosint

# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

Try the live demo → — bring your own Anthropic / OpenRouter / Ollama key, no signup.

Usage

Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_github('johndoe99')   <- pivoted from breach findings
  Found: profile, 14 repos, commit-discovered emails

  Report saved -> reports/2026-05-11_14-32-11_report.md

Features

Capability	Details
AI tool chaining	The agent selects and chains tools based on findings; describe the target in plain language
21 modular tools	Email, username, breach, WHOIS, RDAP, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, GDELT news geo, live dork search, URL scraping, SERP footprint
Three AI backends	Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)
Native MCP server	Passive tools (20) exposed by default, all 25 with --allow-active (Passive by default); runs with uvx, no separate install
Parallel execution	--parallel runs complementary tools concurrently via asyncio.gather()
Reports	PDF + Markdown auto-saved after every investigation (reportlab optional)
Session history	All REPL sessions saved to ~/.openosint/history/; browse with openosint history
Web UI	Browser-based AI chat with streaming output, tool cards, light/dark theme

Investigation results land live on the globe — click a point to pivot. Watch the sharper MP4.

Deterministic, synthetic-data demo — every entity shown is fictional; regenerate with demo/web_demo.py. The entities are seeded at the statement layer, not produced by today's mappers — see demo/README.md.

---

Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Tools