Skip to main content
Glama
Sign In
MCP OSINT Server

MCP OSINT Server

by abrahamhl
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

MCP OSINT Server

This is a Model Context Protocol (MCP) server that exposes powerful Open Source Intelligence (OSINT) tools to AI agents.

Why MCP?

The Model Context Protocol (MCP) allows AI agents like Claude and Gemini to access external tools in a standardized way. By exposing OSINT tools via MCP, AI agents can perform automated threat intelligence, vulnerability analysis, and digital forensics directly from their chat interfaces.

Related MCP server: mrholmes

Tools Exposed

Tool

Description

Input

Output

sanctions_screen

Screen a name against EU sanctions lists

{ name: string, birth_year?: number }

{ matches: Array<{listed_name, score, reasons[]}>, total_screened: number }

cve_brief

Get prioritized vulnerability brief

{ watchlist?: string[], max_items?: number, lang?: 'en'|'nl'|'es' }

{ priorities: {act_now: [], this_week: [], watch: []}, generated_at: string }

evidence_verify

Verify evidence chain integrity

{ case_id: string, evidence_dir: string }

{ verified: boolean, chain_length: number, broken_links: string[] }

chronolocate_sun

Calculate sun position for verification

{ lat: number, lon: number, time: string }

{ azimuth: number, elevation: number, shadow_bearing: number, shadow_ratio: number }

ioc_search

Search indicators of compromise

{ query: string, type?: 'ip'|'domain'|'hash'|'url' }

{ results: Array<{value, type, source, first_seen, tags[]}> }

Installation & Usage

  1. Build the server:

    pnpm install
pnpm build

  2. Add to your AI Agent's configuration (e.g. claude_desktop_config.json):

    {
  "mcpServers": {
    "osint": {
      "command": "node",
      "args": ["/path/to/mcp-osint-server/dist/index.js"]
    }
  }
}

Architecture

flowchart TD
    Agent[AI Agent\nClaude/Gemini] <-->|MCP Protocol| Server[MCP OSINT Server\nNode.js]
    Server --> |Spawn Subprocess| Sub1[sanctions.py]
    Server --> |Spawn Subprocess| Sub2[cve.py]
    Server --> |Spawn Subprocess| Sub3[evidence.py]
    Server --> |Spawn Subprocess| Sub4[chronolocate.py]
    Server --> |Spawn Subprocess| Sub5[ioc.py]

Scope & Limitations

  • These tools are thin wrappers around underlying Python tools. The Python tools must be installed and accessible in the environment.

  • The server currently executes Python scripts as subprocesses without maintaining a long-lived Python environment.

Available Tools

5 tools
chronolocate_sunC

Calculate sun position for verification

Inputs: lat (required), lon (required), time (required).

cve_briefC

Get prioritized vulnerability brief

Inputs: lang, max_items, watchlist.

evidence_verifyC

Verify evidence chain integrity

Inputs: case_id (required), evidence_dir (required).

ioc_searchC

Search indicators of compromise

Inputs: query (required), type.

sanctions_screenC

Screen a name against EU sanctions list

Inputs: name (required), birth_year.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    C2.7/5.0

    Scored across 5 tools

    Disambiguation4/5

    Each tool targets a distinct OSINT capability (sanctions screening, vulnerability brief, evidence verification, sun position, IOC search), with minimal overlap. The only potential confusion is between evidence_verify and chronolocate_sun (both verification-related), but they operate at different levels of abstraction.

    Naming Consistency3/5

    All names use snake_case, but the word order varies: sanctions_screen (noun+verb), cve_brief (noun+noun), evidence_verify (noun+verb), chronolocate_sun (verb+noun), ioc_search (noun+verb). There is no consistent verb_noun pattern, making it mixed but still readable.

    Tool Count5/5

    Five tools is within the ideal 3–15 range. Each addresses a distinct need without redundancy, making the set well-scoped for a focused OSINT toolkit.

    Completeness2/5

    For an OSINT server, the surface lacks many standard capabilities such as DNS/WHOIS lookups, domain/IP enrichment, social media search, and reverse image search. While it covers sanctions, CVE, IOC, and verification, these gaps will likely cause agent failures on common OSINT tasks.

    Maintenance

    ActivitySlowing
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • osint-mcp-server

      badchars
      A
      license
      A
      quality
      C
      maintenance
      Provides AI agents with 37 OSINT tools and 12 data sources to perform unified reconnaissance, domain analysis, and attack surface mapping. It enables agents to query, correlate, and reason across platforms like Shodan, VirusTotal, and Censys in parallel.
      37
      364 npm
      60
      MIT

    • mrholmes

      SSGREAPER
      A
      license
      A
      quality
      B
      maintenance
      Enables users to execute OSINT tasks from 88 catalogued repositories through safe command surfaces, supporting authorized research and threat intelligence workflows.
      1
      MIT

    • Clearfront MCP Server

      scottmartinanderson
      A
      license
      A
      quality
      C
      maintenance
      Enables AI-driven open-source intelligence investigations by exposing 30 tools for scanning emails, usernames, domains, IPs, and more, with real subprocess execution.
      31
      39 PyPI
      12
      MIT