mcp-name: io.github.OpenOSINT/openosint

Investigation results land live on the globe — click a point to pivot. Watch the sharper MP4.

Featured Integrations

IP2Location.io — powers search_ip2location · Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

RapidProxy · Integration guide

Reliable Residential Proxies for Data Collection & Automation — 90M+ IPs across 200+ countries. 10% off: RAPID10.

TestMu AI

TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.

Open: Breach / Compromised-Credential Data · Email / Identity Lookup — see SPONSORSHIP.md.

pip install openosint

Paid: Complete Kit — $55 (prompts + playbook, bundled) · Setup Sprint — $350 (done-for-you install) · Commercial License — from €300/yr (vendor contract, SLA, indemnification)

Quick Start

# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

New to OSINT methodology? Grab the free 5-prompt starter set or the free Playbook edition before your first run.

📬 Agents & OSINT — the newsletter

One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe →

Run in the cloud (no install)

No Python, no holehe / sherlock / sublist3r / phoneinfoga binaries in PATH, no API keys — run OpenOSINT Email Recon from your browser, or as an MCP tool in Claude, Cursor, and Windsurf via the Apify MCP Server. Try for free.

Try OpenOSINT Email Recon on Apify →

Usage

Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_email('target@example.com')
  Found: Spotify, WordPress, Gravatar, Office365

  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_username('johndoe99')   <- pivoted from email findings
  Found: GitHub, Reddit, Twitter

  Report saved -> reports/2026-05-11_14-32-11_report.md

Features

Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Custom Integrations

Need OpenOSINT wired into your SOC, fraud, threat-intel, or AI-agent stack? I build bespoke OSINT integrations for teams — you bring the data sources and compliance requirements, I deliver a working integration.

→ Get in touch

Tools

Full per-tool documentation, CLI flags, and output formats: openosint.tech.

search_email

Enumerates online services linked to an email address using holehe.

openosint email target@example.com

[+] Spotify        https://open.spotify.com/user/target
[+] WordPress      https://wordpress.com/target
[+] Gravatar       https://gravatar.com/target
[+] Office365      email used

search_username

Searches for a username across 300+ platforms using sherlock.

openosint username johndoe99

[+] GitHub         https://github.com/johndoe99
[+] Twitter        https://twitter.com/johndoe99
[+] Reddit         https://reddit.com/user/johndoe99

search_breach

Checks data breach exposure via HaveIBeenPwned v3 API. Requires HIBP_API_KEY.

[+] LinkedIn (2016-05-05) — leaked: Email addresses, Passwords
[+] Adobe (2013-10-04) — leaked: Email addresses, Password hints

search_whois

Retrieves WHOIS data using python-whois.

[+] Registrar: ICANN
[+] Created: 1995-08-14
[+] Expires: 2024-08-13
[+] Name Servers: A.IANA-SERVERS.NET

search_ip

Retrieves geolocation and ASN data via ipinfo.io. Free tier: 50k/month.

[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View, CA, US

search_domain

Enumerates subdomains using sublist3r.

[+] mail.example.com
[+] dev.example.com
[+] api.example.com

generate_dorks

Generates 12 targeted Google dork URLs for any target. No network calls.

[+] "johndoe" site:linkedin.com
    https://www.google.com/search?q=%22johndoe%22+site%3Alinkedin.com
[+] "johndoe" leaked OR breach OR dump
    https://www.google.com/search?q=%22johndoe%22+leaked+OR+breach+OR+dump

search_paste

Searches Pastebin dumps via psbdmp.ws.

[+] https://pastebin.com/aB1cD2eF (2023-04-12)
[+] https://pastebin.com/xY3zA4bC (2022-11-08)

search_phone

Gathers phone intelligence using phoneinfoga. Use E.164 format.

[+] Country: United States
[+] Carrier: AT&T
[+] Line type: Mobile

search_shodan

IPv4 input → host lookup (open ports, org, CVEs). Any other query → banner/keyword search. Requires SHODAN_API_KEY.

openosint shodan 8.8.8.8
openosint shodan "apache port:80 country:DE"

[+] Org: Google LLC  |  Open ports: 53, 443

search_virustotal

Checks an IP, domain, URL, or file hash against VirusTotal's 70+ engines. Auto-detects input type. Requires VIRUSTOTAL_API_KEY.

openosint virustotal 8.8.8.8
openosint virustotal example.com
openosint virustotal 44d88612fea8a8f36de82e1278abb02f

[VirusTotal] Malicious: 0 / Harmless: 72

search_ip2location

Queries IP2Location.io for enhanced IP intelligence: geolocation, ISP, ASN, and — on the Security Plan — VPN/Proxy/Tor/datacenter detection. Sponsored integration. Requires IP2LOCATION_API_KEY.

openosint ip2location 8.8.8.8

[IP2Location] City: Mountain View, CA, US  |  ISP: Google LLC
[IP2Location] VPN: No  |  Proxy: No  |  TOR: No  |  Datacenter: Yes

search_censys

IPv4 → host view (open ports, services, ASN). Domain → certificate search (SANs, issuer). Requires CENSYS_API_ID and CENSYS_SECRET.

openosint censys 8.8.8.8
openosint censys example.com

[Censys] Open Ports: 53, 443, 853  |  ASN: AS15169 Google LLC

search_abuseipdb

Checks an IP against AbuseIPDB v2. Returns abuse confidence score, total reports, country, ISP, and last reported timestamp. Requires ABUSEIPDB_API_KEY.

openosint abuseipdb 198.51.100.1

[AbuseIPDB] Abuse Confidence Score: 87%  |  Total Reports: 143
⚠️  HIGH ABUSE CONFIDENCE — flagged by AbuseIPDB

Warning appears when abuseConfidenceScore exceeds 50%.

search_github

Queries GitHub REST API. Username → profile, repos, commit-discovered emails. Keyword → user/repo search. Optional GITHUB_TOKEN raises rate limit from 60 to 5000 req/h.

openosint github johndoe99

[GitHub] Repos: 42  |  Followers: 128
[GitHub] Commit email: johndoe@example.com

search_dns

Queries A/AAAA/MX/NS/TXT/CNAME/SOA records and analyzes SPF, DMARC, and DKIM configuration using dnspython (no external API).

openosint dns example.com

[DNS] A: 93.184.216.34
[DNS] MX: mail.example.com (priority 10)
[DNS] SPF: v=spf1 include:_spf.google.com ~all

search_dorks_live

Executes live Google dork queries through the Bright Data SERP API¹, returning structured results (title, URL, snippet). Defaults to 5 dorks per run; each is a separate billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint search-dorks-live "john doe" --max-dorks 3

[+] Dork: "john doe" site:linkedin.com
    Title:   John Doe | LinkedIn
    URL:     https://www.linkedin.com/in/john-doe-12345

scrape_url

Fetches any public URL through Bright Data Web Unlocker¹, bypassing Cloudflare/CAPTCHA. Returns clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE.

openosint scrape https://example.com

[Web Unlocker] Remote status: 200
# Example Domain
This domain is for use in illustrative examples in documents.

search_footprint

Collects a target's public search-engine footprint via Bright Data SERP API¹. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results plus Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint footprint johndoe99

Graph module (optional)

An additive FollowTheMoney entity graph — statement-level provenance, an append-only store, non-destructive same_as deduplication, and a human review queue — sits alongside the tools above without changing anything about them. Opt in with pip install "openosint[graph]" (Python 3.10+) or "openosint[graph-dedup]" (adds same_as scoring, needs Python 3.11+), then use it via three MCP tools: graph_export, graph_neighbors, graph_review_candidates. See docs/graph.md for the full guide and a worked example.

The same workflow is shown end to end — including the .ftm export that passes ftm validate — in the terminal demo in docs/graph.md; the web UI walkthrough is the demo at the top of this README.

Interfaces

Web UI

pip install "openosint[web]"
openosint web
# Opens http://localhost:8080 automatically

Browser-based AI chat with streaming tool output, inline result cards, light/dark theme toggle. Supports local inference via Ollama or any OpenAI-compatible endpoint — no Anthropic API key required.

# Fully local (no API key) — requires Ollama runtime: https://ollama.com
ollama pull llama3.2
openosint web
# Settings -> Ollama (local) -> model: llama3.2

# OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)
export OPENAI_BASE_URL="http://localhost:4000/v1"
openosint web
# Settings -> OpenAI API

Breaking change (v2.28+): key usage now follows bind address, not an env var. Bound to 127.0.0.1/localhost (the default) — no change: keys in your .env work as before. Bound to any other interface (--host 0.0.0.0, which already requires --allow-remote) — the web UI never uses a key from your environment to serve a request; every caller must supply their own, and breach lookups (search_breach) are disabled outright. This applies regardless of any env var, including OPENOSINT_DEMO_MODE, which can only add restriction, never remove it. If you were exposing the web UI on a LAN with your own keys and no per-caller auth in front of it, that access pattern no longer works.

Running behind a reverse proxy? A loopback bind (127.0.0.1) only means the OS accepted the connection from this machine — it says nothing about who can reach it if something in front (nginx, Caddy, a Docker/K8s sidecar, a tunnel) forwards requests to it from elsewhere. By default, a request that carries proxy-forwarding headers (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host, Forwarded, CF-Connecting-IP) is treated exactly like a non-loopback bind: your local keys are never used, breach lookups are blocked, and the caller is told why. If you deliberately serve this through a reverse proxy and want it to behave like a normal local instance for requests relayed by that proxy, set OPENOSINT_TRUSTED_PROXY=true. This is a separate variable from the existing TRUSTED_PROXY (which only affects which IP a rate-limit bucket is attributed to — a low-stakes, already-loosely-scoped setting some self-hosters already have on). Reusing that flag here would have silently upgraded an existing rate-limit-only configuration into one that also permits credentialed access, without asking. OPENOSINT_TRUSTED_PROXY gets its own explicit opt-in for that reason. Setting it does not blindly trust the forwarded headers' content — internally inconsistent values (e.g. two disagreeing X-Forwarded-Proto values on one request) are still treated as public regardless. Setting OPENOSINT_TRUSTED_PROXY=true means you are choosing to serve credentialed lookups to whoever your reverse proxy relays to this instance — you are the controller for their queries, the same way OpenOSINT Cloud is for its customers. Put real authentication in front of it if "whoever the proxy relays" is broader than you intend.

Interactive REPL

Run openosint with no arguments to start the AI-powered REPL:

REPL commands:

All sessions are auto-saved to ~/.openosint/history/. Browse with openosint history.

For the REPL/CLI with an OpenAI-compatible backend:

pip install "openosint[openai]"
openosint --provider openai \
  --openai-base-url http://localhost:4000/v1 \
  --openai-model gpt-4o-mini

Live Documentation

Full per-tool reference, CLI flags, and configuration options at openosint.tech.

MCP Server

Expose all 20 OpenOSINT tools to any MCP-compatible AI client. Once connected, Claude can natively invoke all 20 tools during conversations.

Claude Code:

claude mcp add openosint python /absolute/path/to/OpenOSINT/openosint/mcp_server.py
claude mcp list

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "openosint": {
      "command": "python",
      "args": ["/absolute/path/to/OpenOSINT/openosint/mcp_server.py"]
    }
  }
}

Prefer zero setup? The OpenOSINT Email Recon Actor is also available as a hosted MCP tool via the Apify MCP Server — no server to run, no config file to edit. Try for free.

Agentic use via Claude Code:

$ claude
> Investigate target@example.com. Trace any username found
  across other platforms and compile a full report.

Installation

# From PyPI (recommended)
pip install openosint

# From source
git clone https://github.com/OpenOSINT/OpenOSINT.git
cd OpenOSINT
pip install -e .

External binaries (must be in PATH):

If a binary is absent, the corresponding tool returns a descriptive error. All other tools remain operational.

Don't want to install these locally? The OpenOSINT Email Recon Actor runs email recon in Apify's cloud — zero dependencies, zero local setup.

Optional Python packages:

Configuration

Store keys in a .env file at the project root (copy .env.example). python-dotenv loads it automatically at startup.

CLI Reference

Docker

# Build and run
docker compose up --build

# One-off command
docker compose run --rm openosint email target@example.com --json

Set ANTHROPIC_API_KEY (and optionally HIBP_API_KEY, IPINFO_TOKEN) in a .env file or export them before running docker compose. Reports are persisted to ./reports/ via a volume mount.

DigitalOcean App Platform: see .do/app.yaml for App Platform configuration.

Integrations

Get the Method

OpenOSINT is the tool. The AI OSINT Complete Kit ($55) is the method: the Prompt Pack and the Operator's Playbook, bundled.

→ Get the Complete Kit ($55)

AI OSINT Prompt Pack

OpenOSINT gives you the tooling. The AI OSINT Prompt Pack gives you the method: 30+ tested prompts across 8 target types, with one repeatable collect → pivot → verify → document flow for running OpenOSINT investigations.

• Email, username, domain, IP, phone, company due-diligence, image & reporting prompts

• One repeatable investigation flow + an ethics & legal primer

• Instant download · pairs directly with OpenOSINT

→ Get the Prompt Pack ($29)

AI OSINT Operator's Playbook

Step-by-step workflows for running investigations with ChatGPT, Claude, and OpenOSINT.

→ Get the Playbook ($39)

Buying directly funds OpenOSINT's development.

AI OSINT Prompts — Free Starter Set

New to AI-assisted OSINT? The free starter set gives you 5 structured prompts — one per stage of a real investigation — that make ChatGPT and Claude collect real public data instead of hallucinating it.

• Scope → Collect → Pivot → Verify → Document

• Works with any AI assistant (Claude, ChatGPT, Gemini)

• Instant PDF, no card required

→ Get the free starter set

AI OSINT Operator's Playbook — Free Edition

The free edition walks the 5-phase method once, end to end, on a single worked case: scope → collect → pivot → verify → document. Includes one sample prompt and the confidence rubric used to grade findings.

• Free edition: the method + one worked investigation

• Full edition ($39): 12 complete workflows, per-tool playbooks, reporting templates, and the legal/ethics primer

→ Get the free edition · Full Playbook ($39) →

Sponsor this project

OpenOSINT is used by OSINT practitioners, security researchers, and developers actively evaluating intelligence APIs. Every time a user configures an integration, the docs route them to that provider's sign-up page — high-intent exposure at the moment of adoption.

Featured Integration ($2,000/year or $220/month): recommended/default provider for one tool category, exclusive. Logo + badge across README, docs, CLI banner, and Web UI. One vendor per category.

Current sponsors and open categories are listed in the sponsor block at the top of this README. Full media kit, pricing, and the referral funnel: SPONSORSHIP.md.

Open Collective · commercial@openosint.tech · SPONSORSHIP.md

Affiliate program

Earn 30–45% commission promoting the AI OSINT Prompt Pack, Operator's Playbook, and Complete Kit. Good fit for OSINT/infosec newsletter authors, security YouTube channels, and tool-directory maintainers.

→ Affiliate program details & terms

SERVICES

The framework is free and MIT-licensed. This is an optional paid setup service offered by the maintainer.

OSINT-MCP Setup Sprint — done-for-you installation and configuration of an autonomous OSINT-MCP pipeline on your environment. Fully async, no calls required.

Includes:

• Pre-configured OpenOSINT setup tailored to your stack (Claude Code, Claude Desktop, or any MCP client)

• API keys wired in (Shodan, VirusTotal, IP2Location, HaveIBeenPwned, and others as needed)

• One investigation workflow built around your use case

• Written step-by-step setup guide + screen-recorded walkthrough

Delivery: 3–5 days, fully async.

For: SOC analysts · threat-intel teams · fraud/AML · pentesters · OSINT investigators

Need it set up for you?

Get OpenOSINT wired into your stack in 3–5 days — done-for-you, fully async, no calls.

Book the Setup Sprint → $350 (founding price, first 5 teams)

→ Or email commercial@openosint.tech · LinkedIn

For authorized use only. See DISCLAIMER.md.

Commercial License & Support

OpenOSINT is free and MIT-licensed for everyone — personal projects, commercial products, SaaS, and closed-source are all covered with no purchase required. Organizations that additionally need a vendor contract, written warranty, indemnification, SLA, or priority support for procurement and compliance can purchase a commercial plan. Three tiers available from €300/year — see COMMERCIAL.md for full details and pricing. Contact: commercial@openosint.tech.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md for the development workflow, integration registration checklist, and coding conventions. Please read DISCLAIMER.md before contributing.

Regenerating the demo GIF/MP4

export OPENOSINT_DEMO_KEY=sk-ant-...   # your Anthropic key — never committed
openosint --web &                      # start the web server on :8080
make demo                              # record -> encode -> write docs/assets/demo-web-graph.*
git add docs/assets/demo-web-graph.*

See scripts/record-demo/README.md for full prerequisites and pipeline details.

Maintainer

Tommaso Bertocchi

• X (personal): https://x.com/SonoTommy_

• X (OpenOSINT): https://x.com/openosint_oss

• LinkedIn: https://www.linkedin.com/company/openosintoss

• Email: commercial@openosint.tech

Contributors

License

OpenOSINT is open source under the MIT License — free for any use, including personal, commercial, academic, and closed-source.

¹ Bright Data links in this README are affiliate/referral links — OpenOSINT earns a commission if you sign up through them, at no extra cost to you.

For authorized security research only. See DISCLAIMER.md.

OpenOSINT v2.27.0 — August 2026

Star History