# OSINT MCP Server

A comprehensive Model Context Protocol (MCP) server providing a wide range of OSINT (Open Source Intelligence) tools.

## Features

- **IP Intelligence**: Geolocation (ip-api.com), Shodan, GreyNoise, AlienVault OTX, MAC Address Lookup
- **Domain Intelligence**: WHOIS (RDAP, Shodan, History), DNS (Robtex, HackerTarget, Direct), SSL Certificates (crt.sh), Subdomain Enumeration, Wayback Machine (Archive.org)
- **Social & Identity**: GitHub (Profile, Repos, Commit Emails, Repo Commits), Reddit (Profile, Posts), Fandom (Profile, Contributions), Username Search (20+ platforms), Keybase Lookup
- **Web Intelligence**: Technology Stack Detection, Social Metadata Scraping, Wayback Machine, Exa Search, VirusTotal, EXIF Metadata Extraction
- **Email OSINT**: HaveIBeenPwned, Hunter.io, Email Permutator, Domain Email Search, Social Profile Check (Gravatar)
- **Crypto & Phone**: Bitcoin/Ethereum Wallet Lookup, Phone Number Intelligence
- **Image OSINT**: Reverse Image Search (SauceNAO), Image Tagging (Imagga), Visual Analysis (Google Vision), EXIF Metadata

## Prerequisites

- Node.js 20+
- API Keys for various services (optional but recommended for full functionality)

## Installation

1. Clone the repository
2. Install dependencies:
   ```bash
   npm install
   ```
3. Build the project:
   ```bash
   npm run build
   ```

## Configuration

You can configure API keys using environment variables or a `config.json` file in the root directory.

### Example `config.json`

```json
{
  "SHODAN_API_KEY": "your_shodan_key",
  "HIBP_API_KEY": "your_hibp_key",
  "EXA_API_KEY": "your_exa_key",
  "VIRUSTOTAL_API_KEY": "your_vt_key",
  "HUNTER_API_KEY": "your_hunter_key",
  "GREYNOISE_API_KEY": "your_greynoise_key",
  "ALIENVAULT_API_KEY": "your_otx_key",
  "SECURITYTRAILS_API_KEY": "your_st_key",
  "ZOOMEYE_API_KEY": "your_zoomeye_key",
  "SAUCENAO_API_KEY": "your_saucenao_key",
  "IMAGGA_API_KEY": "your_imagga_key",
  "IMAGGA_API_SECRET": "your_imagga_secret",
  "GOOGLE_CLOUD_API_KEY": "your_google_key",
  "GITHUB_TOKEN": "your_github_pat",
  "WHOISXML_API_KEY": "your_whoisxml_key",
  "ABSTRACT_PHONE_API_KEY": "your_abstract_key",
  "PORT": 3000,
  "HOST": "0.0.0.0"
}
```

## Usage

### Stdio Transport (Default for many MCP clients)

```bash
node dist/index.js --stdio
```

### HTTP Transport

```bash
npm start
```
The server will be available at `http://localhost:3000/mcp`.

## Tools

| Tool Name | Description |
|-----------|-------------|
| `ip_geolocation` | Get geolocation data for an IP address |
| `whois_lookup` | Perform RDAP WHOIS lookup for a domain |
| `whois_history` | Lookup WHOIS history for a domain |
| `dns_lookup_passive` | Get passive DNS records from Robtex |
| `dns_lookup_direct` | Real-time DNS lookup (A, MX, TXT, etc.) |
| `reverse_dns` | Lookup hostname for an IP address |
| `check_breaches` | Check if an email has been compromised (HIBP) |
| `shodan_host` | Get host details from Shodan |
| `shodan_whois` | Perform WHOIS lookup via Shodan Labs |
| `ssl_certs` | Lookup SSL certificates on crt.sh |
| `url_reputation` | Check URL reputation on VirusTotal |
| `dns_enumeration` | Perform DNS enumeration via HackerTarget |
| `subdomain_enum` | Find subdomains using multiple sources |
| `hunter_domain_search` | Search for email addresses on a domain |
| `greynoise_ip_context` | Get IP context from GreyNoise |
| `otx_indicator_details` | Get threat intel from AlienVault OTX |
| `securitytrails_subdomains` | Find subdomains via SecurityTrails |
| `zoomeye_host_search` | Search hosts on ZoomEye |
| `reverse_image_search_anime` | Search anime/art images on SauceNAO |
| `image_tagging` | Tag and categorize images with Imagga |
| `google_vision_analyze` | Analyze images with Google Vision |
| `github_user_info` | Get detailed GitHub user metadata |
| `github_user_repos` | List public GitHub repositories for a user |
| `github_commit_emails` | Extract email addresses from public events |
| `github_repo_commits` | Scan a specific repo for commit emails |
| `username_search` | Search for a username across 20+ platforms |
| `fandom_user_info` | Get Fandom/Wiki user data |
| `fandom_user_contributions` | List recent Fandom wiki contributions |
| `archive_org_snapshot` | Check for Wayback Machine snapshots |
| `mac_lookup` | Lookup vendor for a MAC address |
| `keybase_lookup` | Lookup Keybase identity and linked accounts |
| `reddit_user_details` | Get basic Reddit user profile info |
| `reddit_user_posts` | List recent Reddit posts for a user |
| `url_metadata` | Scrape OpenGraph and meta tags from a URL |
| `url_tech_stack` | Detect technologies used on a website |
| `email_permutator` | Generate possible email address combinations |
| `domain_email_search` | Search for emails associated with a domain |
| `email_social_check` | Find social profiles linked to an email |
| `btc_lookup` | Check Bitcoin address balance and transactions |
| `eth_lookup` | Check Ethereum address balance |
| `phone_lookup` | Lookup phone number carrier and location |
| `exif_metadata` | Extract EXIF data from an image URL |
| `web_search` | Perform web search via Exa |

## License

MIT