This server provides a single MCP tool (mrholmes) as a unified interface for the Mr. Holmes OSINT suite — an 88-repository OSINT/cybersecurity collection — allowing you to safely discover, query, and execute tools.
status — Check the current state of the suite and which repositories are present and operational.
catalog — Browse all 88+ catalogued repositories, their roles, risk postures, and automation classifications without executing anything.
run — Execute safe, pre-validated commands via mrholmes_suite.py by passing an argv array (e.g., domain lookups, username profiling, hash identification, dork generation). Supports an optional timeout (1–300 seconds).
tracker — Monitor and review suite operations via the live/passive validation ledger.
manifest — Retrieve the MRHOLMES-SUITE-MANIFEST.json, containing full catalogue metadata including repo roles and automation posture.
live_test — Run passive/live validation checks against suite components to verify their operational status.
cleanup — Clean up the suite environment, with an optional dry_run mode to preview changes before applying them.
full_report — Generate a comprehensive report covering suite status, catalogue state, and validation results in one consolidated output.
Provides OSINT tools (domain, username, email, etc.) for the Hermes AI agent platform via MCP.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mrholmes Search for username johndoe across social media"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
One tool. Full operator kit. Turnkey.
Legion is a single local OSINT product for authorized research, threat intelligence enrichment, and defensive investigations. It replaces the old multi-repo wrapper catalogue with a native kit — GUI, CLI, and MCP — that runs out of the box on Python 3.10+ with zero pip dependencies.
Scope: passive / public-source by default. No phishing, malware, C2, credential theft, or exploit execution.
Install Python 3.10+ and enable Add Python to PATH.
Double-click install.bat once.
Launch the Legion OSINT desktop shortcut (or LegionOSINT.bat).
Browser opens at http://127.0.0.1:8899.
git clone https://github.com/Reaper-Legion/mrholmes-osint-suite.git
cd mrholmes-osint-suite
python -m legion gui # GUI + vault
python -m legion status # health
python -m legion example.com # auto-investigate any targetRelated MCP server: osint-mcp-server
Surface | Entry | Purpose |
GUI |
| Tactical dashboard, quick investigate, vault |
CLI |
| Scriptable JSON tools |
MCP |
| Single agent tool for Hermes / Cursor / etc. |
Vault |
| Targets, sessions, runs, findings, IOCs |
Tool | Does |
| Detect type → multi-tool pipeline |
| Public profile presence probes |
| Platform maps, name leads |
| DNS, TLS, HTTP, RDAP |
| Passive CT via crt.sh |
| PTR, geo hint, HTTP probe |
| Normalize + mail/host leads + dorks |
| Google / Bing / DDG dork generator |
| Identify / decode / local wordlist crack |
| Ahmia onion-index search + blacklist check |
| Header / title probe |
| Extract IPs, domains, URLs, emails, hashes |
| Built-in playbooks & checklists |
| Markdown BLUF skeleton |
python -m legion tools
python -m legion detect user@example.com
python -m legion investigate example.com --save
python -m legion run domain example.com
python -m legion run username jdoe --save
python -m legion run dorks acme.com --kind domain
python -m legion run hash 5d41402abc4b2a76b9719d911017c592 --mode hash-type
python -m legion run darkweb ransomware --limit 5
python -m legion run ioc "contact admin@evil.test from 203.0.113.8"
python -m legion run knowledge username{
"mcpServers": {
"legion": {
"command": "python",
"args": ["-m", "legion", "mcp"],
"cwd": "/absolute/path/to/mrholmes-osint-suite"
}
}
}Send one JSON object per line, for example:
{"action":"run","tool":"domain","target":"example.com"}Actions: status, catalog, manifest, run, runs.
Loopback-only HTTP server (127.0.0.1).
No shell invocation for kit tools (in-process).
Passive defaults; no port scans, no mail VRFY, no Tor auto-start.
Wordlist cracking confined to .legion/wordlists.
Evidence receipts (SHA-256) stored with every saved run.
See docs/ETHICS_AND_SCOPE.md and SECURITY.md.
legion/ ← the product
kit/ ← native tools
web/ ← GUI
knowledge/ ← playbooks
app.py cli.py store.py mcp_server.py
legacy_archive/ ← previous wrapper-suite snapshot (not required)
install.bat ← one-time Windows setup
LegionOSINT.bat/.vbs ← launchersPython 3.10+
Network access for live modules (domain, username, darkweb, CT, RDAP)
No pip install required for core operation
MIT — see LICENSE.
Use only with authorization. Public-source intelligence is still subject to law, ToS, and ethics.
Single safe utility-suite tool for the consolidated Mr.Holmes OSINT/MrHolmes Suite integration. Use action=status/catalog/run/tracker/manifest/live_test/cleanup/full_report. The run action accepts argv for mrholmes_suite.py safe commands only.
| Name | Required | Description | Default |
|---|---|---|---|
| argv | No | For action=run only: argv passed to mrholmes_suite.py, e.g. ['mrholmes','domain','example.com','--timeout','180'] | |
| action | No | status | |
| dry_run | No | For action=cleanup. | |
| timeout | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It repeatedly claims the tool is 'safe' and lists actions like 'cleanup' and 'live_test' without explaining side effects, required permissions, or destructive potential. The description gives hints but lacks necessary behavioral detail for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose and immediately listing actions. Every sentence provides essential information with no wasted words, achieving high conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, no output schema, and no annotations, the description is incomplete. It does not explain what each action does, what return values look like, or error handling. A tool with multiple actions requires more detail for the agent to use it correctly without trial and error.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%. The description adds an example for the 'argv' parameter and enumerates the enum values of 'action', but the schema already lists the enum. For other parameters ('dry_run', 'timeout'), no additional meaning is provided. The example is helpful but the compensation for low coverage is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a single safe utility-suite tool for the Mr.Holmes OSINT integration, listing all available actions. This provides a specific verb and resource, and even without siblings, the purpose is distinct and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent to use the tool with one of the eight listed actions, and specifies that the 'run' action accepts argv for safe commands only. This gives clear context for when to use each action, but lacks explicit 'when not to use' or alternatives since no sibling tools exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
With only one tool, there is no possibility of confusing it with another tool. The agent simply selects this single tool, so disambiguation is perfect.
There is only one tool, so naming consistency is not applicable. No inconsistency exists within the tool set.
The tool count is only 1, which is too few for the apparent scope of a consolidated OSINT suite. Typically, such a suite would benefit from multiple dedicated tools rather than a single mega-tool with many actions.
The single tool exposes multiple actions (status, catalog, run, tracker, manifest, live_test, cleanup, full_report) that seem to cover a wide range of OSINT operations, suggesting good coverage for the domain.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
SSRF-safe web intelligence: 4 outcomes, 43 paid x402 tools, 3 free tools and a URL preview.
A read-only verified record of agent-operable GTM tools: search, fetch, compare, track changes.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/SSGREAPER/mrholmes-osint-suite'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
