osint-mcp-server

Instructions

Implementation Reference

• src/m365/index.ts:57-83 (handler)

  The core logic for the m365_userrealm tool, which performs a request to Microsoft's getuserrealm.srf endpoint to detect if a domain is Managed or Federated.

  export async function m365UserRealm(domain: string): Promise<M365UserRealmResult> {
    try {
      const res = await fetch(
        `https://login.microsoftonline.com/getuserrealm.srf?login=test@${encodeURIComponent(domain)}&json=1`,
      );
      if (!res.ok) return { domain, found: false };
  
      const data = await res.json();
  
      // NameSpaceType 0 = Unknown, 1 = Managed, 2 = Federated
      let namespaceType: string | undefined;
      if (data.NameSpaceType === "Managed" || data.NameSpaceType === 1) namespaceType = "Managed";
      else if (data.NameSpaceType === "Federated" || data.NameSpaceType === 2) namespaceType = "Federated";
      else if (data.NameSpaceType !== undefined) namespaceType = String(data.NameSpaceType);
  
      return {
        domain,
        found: namespaceType !== undefined,
        namespaceType,
        federationBrandName: data.FederationBrandName,
        federationActiveAuthUrl: data.AuthURL ?? data.STSAuthUrl,
        cloudInstanceName: data.CloudInstanceName ?? data.CloudInstanceIssuerUri,
      };
    } catch {
      return { domain, found: false };
    }
  }

• src/protocol/tools.ts:448-455 (registration)

  The registration and definition of the m365_userrealm tool, including its schema and execution handler.

  const m365UserRealmTool: ToolDef = {
    name: "m365_userrealm",
    description: "Detect authentication type for a domain's Microsoft 365 tenant. Returns namespace type (Managed/Federated), federation brand name, and auth endpoints.",
    schema: {
      domain: z.string().describe("Domain to check user realm for"),
    },
    execute: async (args) => json(await m365UserRealm(args.domain as string)),
  };

• src/m365/index.ts:13-20 (schema)

  The interface definition for the result returned by m365UserRealm.

  interface M365UserRealmResult {
    domain: string;
    found: boolean;
    namespaceType?: string; // "Managed" or "Federated"
    federationBrandName?: string;
    federationActiveAuthUrl?: string;
    cloudInstanceName?: string;
  }