OSINT MCP Server

A comprehensive Model Context Protocol (MCP) server providing a wide range of OSINT (Open Source Intelligence) tools.

Features

IP Intelligence: Geolocation (ip-api.com), Shodan, GreyNoise, AlienVault OTX, MAC Address Lookup
Domain Intelligence: WHOIS (RDAP, Shodan, History), DNS (Robtex, HackerTarget, Direct), SSL Certificates (crt.sh), Subdomain Enumeration, Wayback Machine (Archive.org)
Social & Identity: GitHub (Profile, Repos, Commit Emails, Repo Commits), Reddit (Profile, Posts), Fandom (Profile, Contributions), Username Search (20+ platforms), Keybase Lookup
Web Intelligence: Technology Stack Detection, Social Metadata Scraping, Wayback Machine, Exa Search, VirusTotal, EXIF Metadata Extraction
Email OSINT: HaveIBeenPwned, Hunter.io, Email Permutator, Domain Email Search, Social Profile Check (Gravatar)
Crypto & Phone: Bitcoin/Ethereum Wallet Lookup, Phone Number Intelligence
Image OSINT: Reverse Image Search (SauceNAO), Image Tagging (Imagga), Visual Analysis (Google Vision), EXIF Metadata

Prerequisites

Node.js 20+
API Keys for various services (optional but recommended for full functionality)

Installation

Clone the repository
Install dependencies:
```
npm install
```
Build the project:
```
npm run build
```

Configuration

You can configure API keys using environment variables or a config.json file in the root directory.

Example `config.json`

{
  "SHODAN_API_KEY": "your_shodan_key",
  "HIBP_API_KEY": "your_hibp_key",
  "EXA_API_KEY": "your_exa_key",
  "VIRUSTOTAL_API_KEY": "your_vt_key",
  "HUNTER_API_KEY": "your_hunter_key",
  "GREYNOISE_API_KEY": "your_greynoise_key",
  "ALIENVAULT_API_KEY": "your_otx_key",
  "SECURITYTRAILS_API_KEY": "your_st_key",
  "ZOOMEYE_API_KEY": "your_zoomeye_key",
  "SAUCENAO_API_KEY": "your_saucenao_key",
  "IMAGGA_API_KEY": "your_imagga_key",
  "IMAGGA_API_SECRET": "your_imagga_secret",
  "GOOGLE_CLOUD_API_KEY": "your_google_key",
  "GITHUB_TOKEN": "your_github_pat",
  "WHOISXML_API_KEY": "your_whoisxml_key",
  "ABSTRACT_PHONE_API_KEY": "your_abstract_key",
  "PORT": 3000,
  "HOST": "0.0.0.0"
}

Usage

Stdio Transport (Default for many MCP clients)

node dist/index.js --stdio

HTTP Transport

npm start

The server will be available at http://localhost:3000/mcp.

Tools

Tool Name	Description
`ip_geolocation`	Get geolocation data for an IP address
`whois_lookup`	Perform RDAP WHOIS lookup for a domain
`whois_history`	Lookup WHOIS history for a domain
`dns_lookup_passive`	Get passive DNS records from Robtex
`dns_lookup_direct`	Real-time DNS lookup (A, MX, TXT, etc.)
`reverse_dns`	Lookup hostname for an IP address
`check_breaches`	Check if an email has been compromised (HIBP)
`shodan_host`	Get host details from Shodan
`shodan_whois`	Perform WHOIS lookup via Shodan Labs
`ssl_certs`	Lookup SSL certificates on crt.sh
`url_reputation`	Check URL reputation on VirusTotal
`dns_enumeration`	Perform DNS enumeration via HackerTarget
`subdomain_enum`	Find subdomains using multiple sources
`hunter_domain_search`	Search for email addresses on a domain
`greynoise_ip_context`	Get IP context from GreyNoise
`otx_indicator_details`	Get threat intel from AlienVault OTX
`securitytrails_subdomains`	Find subdomains via SecurityTrails
`zoomeye_host_search`	Search hosts on ZoomEye
`reverse_image_search_anime`	Search anime/art images on SauceNAO
`image_tagging`	Tag and categorize images with Imagga
`google_vision_analyze`	Analyze images with Google Vision
`github_user_info`	Get detailed GitHub user metadata
`github_user_repos`	List public GitHub repositories for a user
`github_commit_emails`	Extract email addresses from public events
`github_repo_commits`	Scan a specific repo for commit emails
`username_search`	Search for a username across 20+ platforms
`fandom_user_info`	Get Fandom/Wiki user data
`fandom_user_contributions`	List recent Fandom wiki contributions
`archive_org_snapshot`	Check for Wayback Machine snapshots
`mac_lookup`	Lookup vendor for a MAC address
`keybase_lookup`	Lookup Keybase identity and linked accounts
`reddit_user_details`	Get basic Reddit user profile info
`reddit_user_posts`	List recent Reddit posts for a user
`url_metadata`	Scrape OpenGraph and meta tags from a URL
`url_tech_stack`	Detect technologies used on a website
`email_permutator`	Generate possible email address combinations
`domain_email_search`	Search for emails associated with a domain
`email_social_check`	Find social profiles linked to an email
`btc_lookup`	Check Bitcoin address balance and transactions
`eth_lookup`	Check Ethereum address balance
`phone_lookup`	Lookup phone number carrier and location
`exif_metadata`	Extract EXIF data from an image URL
`web_search`	Perform web search via Exa

License

MIT

OSINT MCP Server

OSINT MCP Server

Features

Prerequisites

Installation

Configuration

Example `config.json`

Usage

Stdio Transport (Default for many MCP clients)

HTTP Transport

Tools

License

Latest Blog Posts

MCP directory API

OSINT MCP Server

Features

Prerequisites

Installation

Configuration

Example config.json

Usage

Stdio Transport (Default for many MCP clients)

HTTP Transport

Tools

License

Latest Blog Posts

MCP directory API

Example `config.json`