This server provides a single MCP tool (mrholmes) as a unified interface for the Mr. Holmes OSINT suite — an 88-repository OSINT/cybersecurity collection — allowing you to safely discover, query, and execute tools.
status — Check the current state of the suite and which repositories are present and operational.
catalog — Browse all 88+ catalogued repositories, their roles, risk postures, and automation classifications without executing anything.
run — Execute safe, pre-validated commands via mrholmes_suite.py by passing an argv array (e.g., domain lookups, username profiling, hash identification, dork generation). Supports an optional timeout (1–300 seconds).
tracker — Monitor and review suite operations via the live/passive validation ledger.
manifest — Retrieve the MRHOLMES-SUITE-MANIFEST.json, containing full catalogue metadata including repo roles and automation posture.
live_test — Run passive/live validation checks against suite components to verify their operational status.
cleanup — Clean up the suite environment, with an optional dry_run mode to preview changes before applying them.
full_report — Generate a comprehensive report covering suite status, catalogue state, and validation results in one consolidated output.
Provides OSINT tools (domain, username, email, etc.) for the Hermes AI agent platform via MCP.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mrholmes Search for username johndoe across social media"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
One tool. Full operator kit. Turnkey.
Legion is a single local OSINT product for authorized research, threat intelligence enrichment, and defensive investigations. It replaces the old multi-repo wrapper catalogue with a native kit — GUI, CLI, and MCP — that runs out of the box on Python 3.10+ with zero pip dependencies.
Scope: passive / public-source by default. No phishing, malware, C2, credential theft, or exploit execution.
Install Python 3.10+ and enable Add Python to PATH.
Double-click install.bat once.
Launch the Legion OSINT desktop shortcut (or LegionOSINT.bat).
Browser opens at http://127.0.0.1:8899.
git clone https://github.com/Reaper-Legion/mrholmes-osint-suite.git
cd mrholmes-osint-suite
python -m legion gui # GUI + vault
python -m legion status # health
python -m legion example.com # auto-investigate any targetRelated MCP server: osint-mcp-server
Surface | Entry | Purpose |
GUI |
| Tactical dashboard, quick investigate, vault |
CLI |
| Scriptable JSON tools |
MCP |
| Single agent tool for Hermes / Cursor / etc. |
Vault |
| Targets, sessions, runs, findings, IOCs |
Tool | Does |
| Detect type → multi-tool pipeline |
| Public profile presence probes |
| Platform maps, name leads |
| DNS, TLS, HTTP, RDAP |
| Passive CT via crt.sh |
| PTR, geo hint, HTTP probe |
| Normalize + mail/host leads + dorks |
| Google / Bing / DDG dork generator |
| Identify / decode / local wordlist crack |
| Ahmia onion-index search + blacklist check |
| Header / title probe |
| Extract IPs, domains, URLs, emails, hashes |
| Built-in playbooks & checklists |
| Markdown BLUF skeleton |
python -m legion tools
python -m legion detect user@example.com
python -m legion investigate example.com --save
python -m legion run domain example.com
python -m legion run username jdoe --save
python -m legion run dorks acme.com --kind domain
python -m legion run hash 5d41402abc4b2a76b9719d911017c592 --mode hash-type
python -m legion run darkweb ransomware --limit 5
python -m legion run ioc "contact admin@evil.test from 203.0.113.8"
python -m legion run knowledge username{
"mcpServers": {
"legion": {
"command": "python",
"args": ["-m", "legion", "mcp"],
"cwd": "/absolute/path/to/mrholmes-osint-suite"
}
}
}Send one JSON object per line, for example:
{"action":"run","tool":"domain","target":"example.com"}Actions: status, catalog, manifest, run, runs.
Loopback-only HTTP server (127.0.0.1).
No shell invocation for kit tools (in-process).
Passive defaults; no port scans, no mail VRFY, no Tor auto-start.
Wordlist cracking confined to .legion/wordlists.
Evidence receipts (SHA-256) stored with every saved run.
See docs/ETHICS_AND_SCOPE.md and SECURITY.md.
legion/ ← the product
kit/ ← native tools
web/ ← GUI
knowledge/ ← playbooks
app.py cli.py store.py mcp_server.py
legacy_archive/ ← previous wrapper-suite snapshot (not required)
install.bat ← one-time Windows setup
LegionOSINT.bat/.vbs ← launchersPython 3.10+
Network access for live modules (domain, username, darkweb, CT, RDAP)
No pip install required for core operation
MIT — see LICENSE.
Use only with authorization. Public-source intelligence is still subject to law, ToS, and ethics.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
Runtime permission, approval, and audit layer for AI agent tool execution.
Offline methodology engine for authorized penetration testing, CTF, and security research.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Reaper-Legion/mrholmes-osint-suite'
If you have feedback or need assistance with the MCP directory API, please join our Discord server