Skip to main content
Glama
OpenOSINT

openosint

Official
by OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

Release PyPI PyPI downloads License MIT GitHub Stars MCP MCP Registry Sponsored by IP2Location Sponsored by RapidProxy Sponsored by TestMu AI

โ˜๏ธ OpenOSINT Cloud โ€” zero install

No Python, no binaries, no API keys. Pay per use. Works as MCP tools in Claude, Cursor, and Windsurf via the Apify MCP Server.

Cloud tool

Input

Output

OpenOSINT Email Recon

email address

linked social accounts, breach exposure, generated dorks

โ–ถ Run on Apify

Try OpenOSINT Cloud

Related MCP server: OSINT Tools MCP Server

๐Ÿ’ป Self-host (free, MIT)

pip install openosint
# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

Try the live demo โ†’ โ€” bring your own Anthropic / OpenRouter / Ollama key, no signup.

Cloud or self-host? Cloud: zero setup, pay per call, hosted by us. Self-host: free forever, your own API keys, full control.

๐Ÿ“ฌ Agents & OSINT โ€” the newsletter

One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe โ†’

OpenOSINT globe view: an agent investigation triggered from a chat prompt lands as a point on an interactive 3D globe, clicking the point pivots into a follow-up investigation, and the new entity appears in the entity graph Investigation results land live on the globe โ€” click a point to pivot. Watch the sharper MP4.

IP2Location.io โ€” powers search_ip2location ยท Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

RapidProxy ยท Integration guide

Reliable Residential Proxies for Data Collection & Automation โ€” 90M+ IPs across 200+ countries. 10% off: RAPID10.

TestMu AI

TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.

Open: Breach / Compromised-Credential Data ยท Email / Identity Lookup โ€” see SPONSORSHIP.md.

Usage

Start the REPL and investigate any target โ€” the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_email('target@example.com')
  Found: Spotify, WordPress, Gravatar, Office365

  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_username('johndoe99')   <- pivoted from email findings
  Found: GitHub, Reddit, Twitter

  Report saved -> reports/2026-05-11_14-32-11_report.md

Want the full investigation workflow behind this? โ†’ AI OSINT Complete Kit ($55)

Features

Capability

Details

AI tool chaining

The agent selects and chains tools based on findings; describe the target in plain language

20 modular tools

Email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, live dork search, URL scraping, SERP footprint

Three AI backends

Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)

Native MCP server

All 20 tools exposed to Claude Code, Claude Desktop, and any MCP-compatible client โ€” no extra config

Parallel execution

--parallel runs complementary tools concurrently via asyncio.gather()

Reports

PDF + Markdown auto-saved after every investigation (reportlab optional)

Session history

All REPL sessions saved to ~/.openosint/history/; browse with openosint history

Web UI

Browser-based AI chat with streaming output, tool cards, light/dark theme


Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Tools

Tool

Powered by

What it investigates

search_email

holehe

Social accounts linked to an email address

search_username

sherlock

Username presence across 300+ platforms

search_breach

HaveIBeenPwned v3 API

Data breach exposure

search_whois

python-whois

Domain registrant and DNS info

search_ip

ipinfo.io

Geolocation, ASN, hostname

search_domain

sublist3r

Subdomain enumeration

generate_dorks

built-in

12 targeted Google dork URLs (no network calls)

search_paste

psbdmp.ws

Pastebin dump mentions

search_phone

phoneinfoga

Carrier, country, line type

search_shodan

Shodan API

Open ports, banners, CVEs

search_virustotal

VirusTotal API v3

Verdict from 70+ antivirus engines

search_ip2location

IP2Location.io API

Enhanced IP intel: VPN/Proxy/Tor/datacenter flags (sponsored)

search_censys

Censys Search API

Internet-facing infrastructure, certificates

search_abuseipdb

AbuseIPDB v2 API

IP abuse reputation: confidence score, reports, country, ISP

search_github

GitHub REST API

Profile, repos, commit-discovered emails, username/keyword search

search_dns

dnspython (built-in)

A/AAAA/MX/NS/TXT/CNAME/SOA records; SPF, DMARC, DKIM analysis

search_gdelt_geo

GDELT GEO 2.0 API

Worldwide geolocated news coverage, GeoJSON output

search_dorks_live

Bright Data SERP API

Live Google search results for dork queries (title, URL, snippet)

scrape_url

Bright Data Web Unlocker

Fetch any URL bypassing Cloudflare/CAPTCHA โ€” returns clean Markdown

search_footprint

Bright Data SERP API

Entity-type-aware public search-engine footprint: detects email/username/domain/phone/name and returns structured results + Entity Correlation Graph nodes/edges

Full per-tool documentation, CLI flags, and output formats: openosint.tech.

search_email

Enumerates online services linked to an email address using holehe.

openosint email target@example.com
[+] Spotify        https://open.spotify.com/user/target
[+] WordPress      https://wordpress.com/target
[+] Gravatar       https://gravatar.com/target
[+] Office365      email used

search_username

Searches for a username across 300+ platforms using sherlock.

openosint username johndoe99
[+] GitHub         https://github.com/johndoe99
[+] Twitter        https://twitter.com/johndoe99
[+] Reddit         https://reddit.com/user/johndoe99

search_breach

Checks data breach exposure via HaveIBeenPwned v3 API. Requires HIBP_API_KEY.

[+] LinkedIn (2016-05-05) โ€” leaked: Email addresses, Passwords
[+] Adobe (2013-10-04) โ€” leaked: Email addresses, Password hints

search_whois

Retrieves WHOIS data using python-whois.

[+] Registrar: ICANN
[+] Created: 1995-08-14
[+] Expires: 2024-08-13
[+] Name Servers: A.IANA-SERVERS.NET

search_ip

Retrieves geolocation and ASN data via ipinfo.io. Free tier: 50k/month.

[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View, CA, US

search_domain

Enumerates subdomains using sublist3r.

[+] mail.example.com
[+] dev.example.com
[+] api.example.com

generate_dorks

Generates 12 targeted Google dork URLs for any target. No network calls.

[+] "johndoe" site:linkedin.com
    https://www.google.com/search?q=%22johndoe%22+site%3Alinkedin.com
[+] "johndoe" leaked OR breach OR dump
    https://www.google.com/search?q=%22johndoe%22+leaked+OR+breach+OR+dump

search_paste

Searches Pastebin dumps via psbdmp.ws.

[+] https://pastebin.com/aB1cD2eF (2023-04-12)
[+] https://pastebin.com/xY3zA4bC (2022-11-08)

search_phone

Gathers phone intelligence using phoneinfoga. Use E.164 format.

[+] Country: United States
[+] Carrier: AT&T
[+] Line type: Mobile

search_shodan

IPv4 input โ†’ host lookup (open ports, org, CVEs). Any other query โ†’ banner/keyword search. Requires SHODAN_API_KEY.

openosint shodan 8.8.8.8
openosint shodan "apache port:80 country:DE"
[+] Org: Google LLC  |  Open ports: 53, 443

search_virustotal

Checks an IP, domain, URL, or file hash against VirusTotal's 70+ engines. Auto-detects input type. Requires VIRUSTOTAL_API_KEY.

openosint virustotal 8.8.8.8
openosint virustotal example.com
openosint virustotal 44d88612fea8a8f36de82e1278abb02f
[VirusTotal] Malicious: 0 / Harmless: 72

search_ip2location

Queries IP2Location.io for enhanced IP intelligence: geolocation, ISP, ASN, and โ€” on the Security Plan โ€” VPN/Proxy/Tor/datacenter detection. Sponsored integration. Requires IP2LOCATION_API_KEY.

openosint ip2location 8.8.8.8
[IP2Location] City: Mountain View, CA, US  |  ISP: Google LLC
[IP2Location] VPN: No  |  Proxy: No  |  TOR: No  |  Datacenter: Yes

search_censys

IPv4 โ†’ host view (open ports, services, ASN). Domain โ†’ certificate search (SANs, issuer). Requires CENSYS_API_ID and CENSYS_SECRET.

openosint censys 8.8.8.8
openosint censys example.com
[Censys] Open Ports: 53, 443, 853  |  ASN: AS15169 Google LLC

search_abuseipdb

Checks an IP against AbuseIPDB v2. Returns abuse confidence score, total reports, country, ISP, and last reported timestamp. Requires ABUSEIPDB_API_KEY.

openosint abuseipdb 198.51.100.1
[AbuseIPDB] Abuse Confidence Score: 87%  |  Total Reports: 143
โš ๏ธ  HIGH ABUSE CONFIDENCE โ€” flagged by AbuseIPDB

Warning appears when abuseConfidenceScore exceeds 50%.

search_github

Queries GitHub REST API. Username โ†’ profile, repos, commit-discovered emails. Keyword โ†’ user/repo search. Optional GITHUB_TOKEN raises rate limit from 60 to 5000 req/h.

openosint github johndoe99
[GitHub] Repos: 42  |  Followers: 128
[GitHub] Commit email: johndoe@example.com

search_dns

Queries A/AAAA/MX/NS/TXT/CNAME/SOA records and analyzes SPF, DMARC, and DKIM configuration using dnspython (no external API).

openosint dns example.com
[DNS] A: 93.184.216.34
[DNS] MX: mail.example.com (priority 10)
[DNS] SPF: v=spf1 include:_spf.google.com ~all

search_dorks_live

Executes live Google dork queries through the Bright Data SERP APIยน, returning structured results (title, URL, snippet). Defaults to 5 dorks per run; each is a separate billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint search-dorks-live "john doe" --max-dorks 3
[+] Dork: "john doe" site:linkedin.com
    Title:   John Doe | LinkedIn
    URL:     https://www.linkedin.com/in/john-doe-12345

scrape_url

Fetches any public URL through Bright Data Web Unlockerยน, bypassing Cloudflare/CAPTCHA. Returns clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE.

openosint scrape https://example.com
[Web Unlocker] Remote status: 200
# Example Domain
This domain is for use in illustrative examples in documents.

search_footprint

Collects a target's public search-engine footprint via Bright Data SERP APIยน. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results plus Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint footprint johndoe99

Graph module (optional)

An additive FollowTheMoney entity graph โ€” statement-level provenance, an append-only store, non-destructive same_as deduplication, and a human review queue โ€” sits alongside the tools above without changing anything about them. Opt in with pip install "openosint[graph]" (Python 3.10+) or "openosint[graph-dedup]" (adds same_as scoring, needs Python 3.11+), then use it via three MCP tools: graph_export, graph_neighbors, graph_review_candidates. See docs/graph.md for the full guide and a worked example.

The same workflow is shown end to end โ€” including the .ftm export that passes ftm validate โ€” in the terminal demo in docs/graph.md; the web UI walkthrough is the demo at the top of this README.


Interfaces

Web UI

pip install "openosint[web]"
openosint web
# Opens http://localhost:8080 automatically

Browser-based AI chat with streaming tool output, inline result cards, light/dark theme toggle. Supports local inference via Ollama or any OpenAI-compatible endpoint โ€” no Anthropic API key required.

# Fully local (no API key) โ€” requires Ollama runtime: https://ollama.com
ollama pull llama3.2
openosint web
# Settings -> Ollama (local) -> model: llama3.2

# OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)
export OPENAI_BASE_URL="http://localhost:4000/v1"
openosint web
# Settings -> OpenAI API

Breaking change (v2.28+): key usage now follows bind address, not an env var. Bound to 127.0.0.1/localhost (the default) โ€” no change: keys in your .env work as before. Bound to any other interface (--host 0.0.0.0, which already requires --allow-remote) โ€” the web UI never uses a key from your environment to serve a request; every caller must supply their own, and breach lookups (search_breach) are disabled outright. This applies regardless of any env var, including OPENOSINT_DEMO_MODE, which can only add restriction, never remove it. If you were exposing the web UI on a LAN with your own keys and no per-caller auth in front of it, that access pattern no longer works.

Running behind a reverse proxy? A loopback bind (127.0.0.1) only means the OS accepted the connection from this machine โ€” it says nothing about who can reach it if something in front (nginx, Caddy, a Docker/K8s sidecar, a tunnel) forwards requests to it from elsewhere. By default, a request that carries proxy-forwarding headers (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host, Forwarded, CF-Connecting-IP) is treated exactly like a non-loopback bind: your local keys are never used, breach lookups are blocked, and the caller is told why. If you deliberately serve this through a reverse proxy and want it to behave like a normal local instance for requests relayed by that proxy, set OPENOSINT_TRUSTED_PROXY=true. This is a separate variable from the existing TRUSTED_PROXY (which only affects which IP a rate-limit bucket is attributed to โ€” a low-stakes, already-loosely-scoped setting some self-hosters already have on). Reusing that flag here would have silently upgraded an existing rate-limit-only configuration into one that also permits credentialed access, without asking. OPENOSINT_TRUSTED_PROXY gets its own explicit opt-in for that reason. Setting it does not blindly trust the forwarded headers' content โ€” internally inconsistent values (e.g. two disagreeing X-Forwarded-Proto values on one request) are still treated as public regardless. Setting OPENOSINT_TRUSTED_PROXY=true means you are choosing to serve credentialed lookups to whoever your reverse proxy relays to this instance โ€” you are the controller for their queries, the same way OpenOSINT Cloud is for its customers. Put real authentication in front of it if "whoever the proxy relays" is broader than you intend.

Interactive REPL

Run openosint with no arguments to start the AI-powered REPL:

REPL commands:

Command

Description

<target>

Investigate any target โ€” email, username, domain, IP, name

clear

Reset conversation memory

save

Save last report to reports/

tools

List available tools and their status

config

Show current configuration

history

Browse saved sessions

help

Show all commands

exit / Ctrl-D

Exit

All sessions are auto-saved to ~/.openosint/history/. Browse with openosint history.

For the REPL/CLI with an OpenAI-compatible backend:

pip install "openosint[openai]"
openosint --provider openai \
  --openai-base-url http://localhost:4000/v1 \
  --openai-model gpt-4o-mini

Live Documentation

Full per-tool reference, CLI flags, and configuration options at openosint.tech.

MCP Server

Expose all 20 OpenOSINT tools to any MCP-compatible AI client. Once connected, Claude can natively invoke all 20 tools during conversations.

Claude Code:

claude mcp add openosint python /absolute/path/to/OpenOSINT/openosint/mcp_server.py
claude mcp list

Claude Desktop โ€” add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "openosint": {
      "command": "python",
      "args": ["/absolute/path/to/OpenOSINT/openosint/mcp_server.py"],
      "env": { "OPENOSINT_ENV_FILE": "/absolute/path/to/your/.env" }
    }
  }
}

MCP hosts launch this server with a cwd that has nothing to do with your .env (often your home directory, or wherever the host itself runs from). The server falls back to a repo-root .env for a source checkout, then an upward search from that arbitrary cwd โ€” but for a pip installed openosint, neither is reliable. Setting OPENOSINT_ENV_FILE in the client's own env block above, as shown, is the one option guaranteed to work regardless of how the host launches the process.

Prefer zero setup? The OpenOSINT Email Recon Actor is also available as a hosted MCP tool via the Apify MCP Server โ€” no server to run, no config file to edit. Try for free.

Agentic use via Claude Code:

$ claude
> Investigate target@example.com. Trace any username found
  across other platforms and compile a full report.

Installation

# From PyPI (recommended)
pip install openosint

# Updating
pip install --upgrade openosint

# From source
git clone https://github.com/OpenOSINT/OpenOSINT.git
cd OpenOSINT
pip install -e .

External binaries (must be in PATH):

Binary

Purpose

Install

holehe

Email account enumeration

pip install holehe

sherlock

Username enumeration (300+ platforms)

pip install sherlock-project

sublist3r

Subdomain enumeration

pip install sublist3r

phoneinfoga

Phone number intelligence

Download binary

If a binary is absent, the corresponding tool returns a descriptive error. All other tools remain operational.

Don't want to install these locally? The OpenOSINT Email Recon Actor runs email recon in Apify's cloud โ€” zero dependencies, zero local setup.

Optional Python packages:

Package

Purpose

Install

ollama

Local LLM backend (no API key)

pip install "openosint[ollama]" (also requires Ollama runtime)

openai

OpenAI-compatible backend

pip install "openosint[openai]"

shodan

Shodan API client

pip install "openosint[shodan]"

reportlab

PDF report export

pip install "openosint[pdf]"

censys

Censys API client

pip install "openosint[censys]"

Configuration

Copy .env.example to .env and fill in your keys. .env is read from the directory you run openosint from (searched upward, like git finds .git) โ€” it does not need to be at any particular "project root", and a regular pip install works the same way as running from a source checkout. Set OPENOSINT_ENV_FILE=/path/to/.env to point at an explicit file instead (useful for the MCP server, which is launched by its host with an arbitrary working directory). A real environment variable always takes priority over a value in .env.

Variable

Tool

Required

Purpose

ANTHROPIC_API_KEY

AI agent

Yes (or Ollama / OpenAI)

Anthropic API key

ANTHROPIC_MODEL

AI agent

Optional

Model name to request (default: claude-sonnet-5). Replaces the deprecated OPENOSINT_MODEL.

OPENAI_BASE_URL

AI agent

Optional

Base URL of an OpenAI-compatible endpoint (e.g. http://localhost:4000/v1)

OPENAI_API_KEY

AI agent

Optional

API key for the endpoint (local servers may ignore it)

OPENAI_MODEL

AI agent

Optional

Model name to request (default: gpt-4o-mini)

OPENOSINT_ENV_FILE

All

Optional

Explicit path to a .env file, overriding the directory search above

HIBP_API_KEY

search_breach

Optional

HaveIBeenPwned v3 โ€” get one

IPINFO_TOKEN

search_ip

Optional

ipinfo.io higher rate limits

SHODAN_API_KEY

search_shodan

Optional

Shodan API โ€” get one

VIRUSTOTAL_API_KEY

search_virustotal

Optional

VirusTotal API v3 โ€” get one

IP2LOCATION_API_KEY

search_ip2location

Optional

IP2Location.io โ€” get one (sponsored)

CENSYS_API_ID + CENSYS_SECRET

search_censys

Optional

Censys โ€” get one

ABUSEIPDB_API_KEY

search_abuseipdb

Optional

AbuseIPDB v2 โ€” get one

GITHUB_TOKEN

search_github

Optional

GitHub API โ€” raises rate limit 60 โ†’ 5000 req/h โ€” get one

BRIGHTDATA_API_KEY

search_dorks_live, scrape_url, search_footprint

Optional

Bright Data โ€” get oneยน (free tier: 5,000 req/month)

BRIGHTDATA_SERP_ZONE

search_dorks_live, search_footprint

Optional

Your Bright Data SERP zone name (e.g. serp_api1)

BRIGHTDATA_UNLOCKER_ZONE

scrape_url

Optional

Your Bright Data Web Unlocker zone name (e.g. web_unlocker1)

CLI Reference

Flag / Subcommand

Description

openosint

Interactive AI REPL (default)

openosint web [--port N] [--no-browser]

Launch browser UI

openosint email ADDRESS [-t N]

Direct email scan

openosint username HANDLE [-t N]

Direct username scan

openosint shodan QUERY [-t N]

Shodan lookup

openosint virustotal TARGET [-t N]

VirusTotal lookup

openosint censys TARGET [-t N]

Censys lookup

openosint ip2location IP [-t N]

IP2Location lookup

openosint abuseipdb IP [-t N]

AbuseIPDB reputation check

openosint github QUERY [-t N]

GitHub profile/repo/email discovery

openosint dns DOMAIN [-t N]

DNS records + email security analysis

openosint multi TARGETS

Parallel multi-target investigation (max 10)

openosint history [--all] [open N] [clear]

View/manage REPL session history

-v, --verbose

Enable debug logging to stderr

-t, --timeout N

Override subprocess timeout (seconds)

--api-key KEY

Anthropic API key (overrides env var)

--parallel

Run complementary tools concurrently

--json

Output results as structured JSON

--provider {anthropic,ollama,openai}

AI provider (default: anthropic)

--ollama-model MODEL

Ollama model name (default: llama3.2)

--ollama-host URL

Ollama server URL (default: http://localhost:11434)

--openai-base-url URL

OpenAI-compatible endpoint base URL (env: OPENAI_BASE_URL)

--openai-model MODEL

Model to request from the endpoint (default: gpt-4o-mini; env: OPENAI_MODEL)

--openai-api-key KEY

API key for the endpoint (env: OPENAI_API_KEY)

--no-pdf

Disable automatic PDF generation

Docker

# Build and run
docker compose up --build

# One-off command
docker compose run --rm openosint email target@example.com --json

Set ANTHROPIC_API_KEY (and optionally HIBP_API_KEY, IPINFO_TOKEN) in a .env file or export them before running docker compose. Reports are persisted to ./reports/ via a volume mount.

DigitalOcean App Platform: see .do/app.yaml for App Platform configuration.

Integrations

Service

URL

Tool

Tier

Auth

IP2Location.io

https://www.ip2location.io

search_ip2location

Featured (sponsored)

API key โ€” free tier

RapidProxy

https://www.rapidproxy.io/?ref=openosint

โ€”

Featured (sponsored)

โ€”

AbuseIPDB

https://www.abuseipdb.com

search_abuseipdb

Community

API key โ€” free tier

Censys

https://censys.io

search_censys

Community

API key โ€” free tier

GitHub

https://github.com

search_github

Community

Token optional

HaveIBeenPwned

https://haveibeenpwned.com

search_breach

Community

API key โ€” paid

holehe

https://github.com/megadose/holehe

search_email

Community

None โ€” local binary

ipinfo.io

https://ipinfo.io

search_ip

Community

Token optional

phoneinfoga

https://github.com/sundowndev/phoneinfoga

search_phone

Community

None โ€” local binary

psbdmp.ws

https://psbdmp.ws

search_paste

Community

None

sherlock

https://github.com/sherlock-project/sherlock

search_username

Community

None โ€” local binary

Shodan

https://shodan.io

search_shodan

Community

API key โ€” free tier

sublist3r

https://github.com/aboul3la/Sublist3r

search_domain

Community

None โ€” local binary

VirusTotal

https://www.virustotal.com

search_virustotal

Community

API key โ€” free tier

WHOIS (IANA)

https://www.iana.org/whois

search_whois

Community

None

DNS (system resolver)

โ€”

search_dns

Community

None

Google Search

https://www.google.com

generate_dorks

Community

None

Resources

Purchases directly fund OpenOSINT's development.

Sponsor this project

OpenOSINT is used by OSINT practitioners, security researchers, and developers actively evaluating intelligence APIs. Every time a user configures an integration, the docs route them to that provider's sign-up page โ€” high-intent exposure at the moment of adoption.

Featured Integration ($2,000/year or $220/month): recommended/default provider for one tool category, exclusive. Logo + badge across README, docs, CLI banner, and Web UI. One vendor per category.

Current sponsors and open categories are listed in the sponsor block at the top of this README. Full media kit, pricing, and the referral funnel: SPONSORSHIP.md.

Open Collective ยท commercial@openosint.tech ยท SPONSORSHIP.md

Affiliate program

Earn 30โ€“45% commission promoting the AI OSINT Prompt Pack, Operator's Playbook, and Complete Kit. Good fit for OSINT/infosec newsletter authors, security YouTube channels, and tool-directory maintainers.

โ†’ Affiliate program details & terms

Commercial License & Support

OpenOSINT is free and MIT-licensed for everyone โ€” personal projects, commercial products, SaaS, and closed-source are all covered with no purchase required. Organizations that additionally need a vendor contract, written warranty, indemnification, SLA, or priority support for procurement and compliance can purchase a commercial plan. Three tiers available from โ‚ฌ300/year โ€” see COMMERCIAL.md for full details and pricing. Contact: commercial@openosint.tech.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md for the development workflow, integration registration checklist, and coding conventions. Please read DISCLAIMER.md before contributing.

Regenerating the demo GIF/MP4

export OPENOSINT_DEMO_KEY=sk-ant-...   # your Anthropic key โ€” never committed
openosint web &                        # start the web server on :8080
make demo                              # record -> encode -> write docs/assets/demo-web-graph.*
git add docs/assets/demo-web-graph.*

See scripts/record-demo/README.md for full prerequisites and pipeline details.

Maintainer

Tommaso Bertocchi

Contributors

Contributor

Contribution

@consocio

venv/uv-tool binary resolution fix โ€” co-installed tools are now found without a separate activation step (#6)

License

OpenOSINT is open source under the MIT License โ€” free for any use, including personal, commercial, academic, and closed-source.


ยน Bright Data links in this README are affiliate/referral links โ€” OpenOSINT earns a commission if you sign up through them, at no extra cost to you.

For authorized security research only. See DISCLAIMER.md.

OpenOSINT v2.29.0 โ€” September 2026

Star History

Star History Chart

Available Tools

24 tools
generate_dorksA

Generate targeted Google dork URLs for any target (name, email, username, domain).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral transparency. It only states the generation function and does not disclose any behavioral traits such as whether it is read-only, requires authentication, or has rate limits. The description lacks sufficient detail for an agent to understand side effects or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is front-loaded with the key action and resource. Every word contributes meaning, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description adequately explains what the tool does given its simplicity (2 params, no output schema). However, it does not describe the return format (e.g., list of URLs, JSON structure) or provide any context on how the URLs are generated. For a tool with no output schema, this omission leaves the agent partially uninformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 50% of parameters (json_output has a description). The description adds significant value by clarifying the 'target' parameter, providing concrete examples ('name, email, username, domain') that are not in the schema. This helps the agent understand acceptable inputs beyond the raw type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Generate') and the resource ('targeted Google dork URLs'), and specifies the types of targets it accepts ('name, email, username, domain'). This distinguishes it from sibling search tools that query databases rather than generate URLs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used for generating dork URLs, distinct from the sibling search tools that perform actual searches. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide any exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_exportA

Export the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'.

ParametersJSON Schema
NameRequiredDescriptionDefault
json_outputNoReturn result as structured JSON.
exclude_datasetsNoDataset names to omit entirely, e.g. ['openosint:hibp'].

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It does this well by stating the graph is additive, the exact output format (NDJSON, one FtM entity per line), and that whole datasets can be omitted via exclude_datasets. It also warns about the installation requirement. It does not mention what happens when no data exists or whether output is streamed, but these are minor omissions for an export tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry all essential information: the action, the resource, the output format, the optional exclusion mechanism, and the installation prerequisite. It is front-loaded with the main purpose and contains no filler or redundant statements. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two optional parameters and no output schema, the description provides a clear picture of what the tool emits and how to control dataset exclusion. The only notable gap is the interplay between json_output and the default NDJSON export: the schema says json_output returns structured JSON, but the description does not reconcile this with the NDJSON line-by-line format. Still, the agent can call the tool correctly with just this description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers both parameters with descriptions, so the baseline is 3. The description adds value by giving a concrete exclude_datasets example and clarifying that excluding a dataset removes 'every breach-derived fact'. It does not add much to json_output, but that parameter is already well described in the schema. Overall, the description meaningfully enriches the parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Export'), a specific resource ('the additive FollowTheMoney entity graph'), and the output format (newline-delimited JSON, .ftm-compatible). It clearly distinguishes itself from the sibling graph tools like graph_neighbors and graph_review_candidates, which are about querying or reviewing rather than exporting the whole graph.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus the graph_neighbors or search_* siblings. It does explain a prerequisite ('Requires the graph extra') and an optional exclusion pattern, but does not state when exporting is appropriate or when another tool would be a better fit. The usage context is only implied by the tool name and the export-focused wording.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_neighborsA

Traverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'.

ParametersJSON Schema
NameRequiredDescriptionDefault
depthNoHops to traverse (default 1, capped at 5).
entity_idYes
cross_layerNoInclude bridge links into the raw infra graph.
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it discloses return contents, the optional cross-layer behavior, and the installation prerequisite. It does not discuss failure behavior, performance at max depth, or output format defaults, but the read-oriented nature of traversal is apparent from the wording.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: one states the core action and output, one explains the optional cross-layer behavior, and one gives the installation prerequisite. Information is front-loaded and there is no redundant phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description is sufficiently complete: it states what is returned, the key optional behavior, and the required dependency. Missing details such as exact JSON shape or invalid entity handling are non-critical for invoking the tool correctly given the schema covers depth and output flags.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so the baseline is 3. The description adds meaning for entity_id ("from one entity id") and enriches cross_layer ("surface bridge links into the raw infra correlation graph - IPs, domains, hashes"), going beyond the terse schema text. It appropriately does not need to restate depth or json_output since the schema already documents them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: "Traverse the FollowTheMoney entity graph from one entity id out to a given depth," and states the output contents (entities, edges, per-edge provenance). It is clear and distinct from the sibling tools in focus, though it does not explicitly name a sibling alternative to distinguish against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you need to traverse from a known entity id and see connected entities with provenance. It also gives context for setting cross_layer=true and mentions the 'graph' extra requirement, but it does not explicitly compare to alternatives like graph_export or investigate_multi or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_review_candidatesA

Human review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges โ€” only this action can write judgement='positive'.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
schemaNolist filter: restrict to one FtM schema.
datasetNolist filter: either entity must carry a statement from this dataset.
decisionNo
entity_idNodecide: first entity of the pair.
max_scoreNolist filter: maximum score.
min_scoreNolist filter: minimum score.
json_outputNoReturn result as structured JSON.
reviewer_idNodecide: reviewer identifier, recorded if given.
canonical_idNodecide: second entity of the pair.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and does so well: it reveals that reject permanently excludes future suggestions, that accept merges, that no auto-merge happens, and that this is the only write path for judgement='positive'. These are exactly the side effects an agent needs before calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every clause carries information: purpose, action modes, filters, verdict semantics, side effects, and authority. It front-loads the core purpose and uses punctuation to separate related facts without wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no output schema or annotations, the description provides enough to invoke list or decide correctly and understand consequences. The main gap is that return values are not described beyond the candidate fields listed, though json_output hints at structured output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 80%, so the schema already handles most parameter meaning. The description adds value beyond schema by grouping parameters into list filters (schema, score range, dataset) and decide fields (pair, decision, reviewer), and by mapping decision values to judgement outcomes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a precise resource (human review queue for graph-dedup same_as matches) and the two actions it supports. This clearly distinguishes it from graph_export/graph_neighbors and the search_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditions for each action: action='list' for pending candidates and filters, action='decide' for recording accept/reject verdicts. It does not name sibling alternatives that would cover the same job, hence 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

investigate_multiA

Investigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Uses ANTHROPIC_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetsYesList of OSINT targets (emails, usernames, domains, IPs). Max 10.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does substantial work: it discloses parallel execution, per-target report generation, summary generation, the 10-target cap, and the ANTHROPIC_API_KEY dependency. It does not detail how reports are returned or whether artifacts persist, but the core operational traits are clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, each carrying a distinct fact: action, output artifacts, limit, and authentication requirement. The purpose statement is front-loaded and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the single parameter well and reveals major behavioral details, but with no output schema it should also explain how the agent receives or accesses the generated reports. That missing return-value detail makes this minimally viable but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description only restates the 10-target limit already in the schema and adds no additional meaning about target formatting, type validation, or edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (investigate) with a clear resource (multiple targets) and a distinguishing mode (parallel execution using the full OSINT tool chain). The per-target report files and summary report further differentiate it from the single-source search_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when to use the tool: batch investigation of multiple targets in parallel, with a hard limit of 10. It does not explicitly name excluded alternatives, but the batch-vs-single-target framing provides a strong selection signal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scrape_urlA

Fetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and bot-protection. Returns the page as clean Markdown. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses key behaviors: bypassing Cloudflare/CAPTCHA/bot-protection and returning clean Markdown. However, it does not mention the json_output parameter's effect (JSON return), nor failure modes, rate limits, or consequences of non-public URLs. This leaves gaps in what an agent should expect when invoking the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no fluff. The primary action is front-loaded ('Fetch any public URL'), and the key capabilities and dependencies are stated immediately. Every word earns its place, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with no output schema, the description covers the main action and return format, but omits the conditional json_output behavior. It also does not mention error handling, timeout limits, or what counts as 'public'. These gaps could lead an agent to misassume behavior, especially when json_output=true is set. The description is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (json_output has a description, url does not). The description adds the 'public' constraint to the url parameter, which is useful but minimal. It does not clarify URL format requirements or how json_output interacts with the Markdown output. The added semantic value is modest and does not fully compensate for the undocumented url parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Fetch') and resource ('any public URL'), and clearly distinguishes the tool from the sibling search tools (search_*, graph_*) by being the only generic URL fetcher. It also states the value proposition (bypasses bot protections, returns clean Markdown), leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies usage for fetching arbitrary public URLs when bot protection is a barrier. It does not explicitly name alternatives or provide when-not-to-use conditions, but the context of a URL-scraping tool among search and intelligence tools makes the usage context clear. No exclusions are stated, but none are obviously needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_abuseipdbA

Check an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0โ€“100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Uses ABUSEIPDB_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral disclosure burden and largely succeeds: it states the data source (AbuseIPDB v2), the exact fields returned, the warning behavior above a 50% threshold, and the authentication dependency on ABUSEIPDB_API_KEY. It does not mention error handling, rate limits, or what happens when the API key is missing, which keeps it from a perfect score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three focused sentences that front-load the core purpose, then list the return fields and key behaviors. Every sentence contributes meaning, with no repetition of schema details or filler text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, no annotations, and only two parameters, the description adequately covers the tool's function, outputs, authentication mechanism, and a notable behavioral rule. It is missing explicit usage guidance relative to sibling tools and details about the json_output parameter, but these are minor given the tool's limited complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% because json_output has a description but ip does not; the description clarifies that ip should be an IP address, but it does not discuss the json_output parameter at all. The description adds minimal value beyond the schema for ip and no new information for json_output, so it only partially compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Check' with the resource 'an IP address against the AbuseIPDB v2 API', and enumerates concrete outputs such as abuse confidence score, total reports, and ISP. This makes the tool's purpose immediately distinguishable from sibling IP-lookup tools like search_ip, search_virustotal, or search_ip2location.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use itโ€”whenever an IP's AbuseIPDB reputation is requiredโ€”but does not explicitly compare it to alternatives or state when not to use it. Sibling tools like search_virustotal and search_censys are not referenced, so an agent must infer the distinguishing criteria from the API name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_breachA

Check if an email appears in data breaches via HaveIBeenPwned. Uses HIBP_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYes
json_outputNoReturn result as structured JSON.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses the external dependency (HaveIBeenPwned) and the environment-variable auth requirement, but it doesn't say what the default output looks like, whether a plain-text vs JSON result is returned, or how errors/rate limits surface. This is partial but not full disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler; the core purpose is front-loaded and the auth prerequisite is appended without clutter. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter lookup with no output schema and no annotations, the description gives the essential purpose and a key prerequisite, but it omits the return format and error behavior. An agent could call the tool correctly, but would be guessing about what the response contains unless it sets json_output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%; json_output already has a description, while email has only a type. The description adds meaning by identifying email as the address to check, but doesn't specify format, normalization, or how json_output changes the response. It doesn't fully compensate for the undocumented email parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise action ('Check if an email appears') and a specific resource ('data breaches via HaveIBeenPwned'), which distinguishes it from sibling tools like search_email. The name 'search_breach' is reinforced rather than merely restated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the toolโ€”any time an email's breach status is neededโ€”but it doesn't explicitly name alternatives, exclusions, or the conditions that would route to a sibling tool. The HIBP_API_KEY prerequisite is mentioned, which is helpful operational context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_censysA

Search Censys for internet-facing infrastructure data. IP address โ†’ open ports, services, ASN, country. Domain โ†’ certificate history, SANs, issuer, first/last seen. Uses CENSYS_API_ID and CENSYS_SECRET env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the CENSYS_API_ID and CENSYS_SECRET env var dependency and what data categories come back, which is useful. However, it does not explicitly state read-only behavior, output format, or failure/rate-limit behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three compact sentences with no filler. It front-loads the main purpose, then gives concrete examples of inputs and outputs, then mentions the required environment variables. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description is reasonably informative: it covers authentication and result categories. Still, it omits explicit return shape, usage boundaries, and any limitations, leaving an agent with moderate uncertainty when choosing among many reconnaissance siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%; the description compensates for the undocumented target parameter by explaining IP and domain use cases. The json_output parameter is already explained in the schema, so the description adds value to the key parameter but does not fully cover all semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Search Censys') and then details the exact data returned for IP and domain targets. This clearly separates it from generic sibling tools like search_ip or search_domain by naming the source and the output categories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance about when to use this tool over alternatives like search_shodan or search_virustotal. The description implies usefulness for internet-facing infrastructure recon but never states when-not or names a competing tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_dnsA

Comprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool performs live DNS queries without requiring external APIs or credentials, which implies read-only behavior. However, it does not mention potential limitations like rate limiting, caching, or query timeout. The explanation of email security misconfigurations adds useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the primary action and record types, followed by additional valuable information (email security and credentials). No superfluous words; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, no output schema, no annotations), the description covers the purpose, scope, and a key constraint (no credentials). It could mention the response format or potential delays, but overall it provides adequate context for an agent to understand the tool's capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: only 'json_output' has a description. The description adds overall context but does not directly explain the 'domain' parameter beyond what is implied. For 'json_output', the schema already provides meaning. The description's mention of DNS enumeration indirectly covers the domain parameter, but it does not add explicit parameter-level detail. Baseline is 3 due to moderate schema coverage combined with some contextual support.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it performs comprehensive DNS record enumeration and lists specific record types (A, AAAA, MX, NS, TXT, CNAME, SOA). It also highlights additional email security checks, making the purpose very specific and distinguishable from sibling tools that deal with other data sources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates that no external API or credentials are required, which is a clear usage guideline. However, it does not explicitly state when to use this tool versus alternatives like 'search_censys' or 'search_shodan', though the context implies it's for DNS enumeration. A slight lack of exclusion criteria prevents a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_domainB

Enumerate subdomains of a target domain using sublist3r.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description merely states the action without disclosing behavioral traits such as rate limits, result format, or side effects. The mention of sublist3r hints at external dependency but insufficient detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single concise sentence, front-loaded with action, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, no annotations, and description does not cover result format, error conditions, or scope of enumeration. Leaves significant gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 50% coverage (json_output described). Description adds 'using sublist3r' but does not clarify the domain parameter's format or constraints. No value beyond schema for the domain parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'enumerate', resource 'subdomains of a target domain', and tool 'sublist3r'. Distinct from sibling tools like search_dns or search_breach.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_dns or search_censys. Implicit usage but lacks explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_dorks_liveA

Execute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default โ€” each is a billable API call. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden and does well: it states the default behavior (up to 5 dorks), the operational cost (each is billable), and the required environment variables. It could add error behavior or result-format details, but the core side effects are transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with key operational details front-loaded. It says what the tool does, how many runs occur, the cost implication, and the auth dependencies without wasting words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity and lack of output schema, the description covers purpose, return fields, default limits, billing impact, and environment prerequisites. The main gap is target semantics, but the overall usage context is strong enough for an agent to call it without critical missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema documents json_output but leaves target undescribed. The description adds only vague target semantics by saying 'for a target' and does not specify the expected format or examples. Since schema coverage is only 50%, the description does not fully compensate for the undocumented target parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise verb and resource: execute Google dork queries via the Bright Data SERP API and return live structured results. It even specifies the result fields (title, URL, snippet), which clearly separates it from siblings like generate_dorks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear functional context: it runs live dork queries and warns about the default limit and billable calls. It does not explicitly say when not to use it or name an alternative tool, but an agent can infer its intended role among the sibling search tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_emailC

Enumerate accounts linked to an email using holehe.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavioral traits. It only says 'enumerate' without explaining whether the tool is read-only, requires permissions, has rate limits, or potentially sends network requests (holehe is a passive enumeration tool but could be interpreted as active).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no unnecessary words. It is appropriately concise for a simple tool, though additional context could be added without harming conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has two parameters and no output schema, the description is incomplete. It does not explain the return format (beyond the json_output flag) or typical response structure (list of accounts, links, or errors). For a simple enumeration tool, more context is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%: json_output has a description, but email does not. The description mentions email in context but does not add format or validation details. The missing email description is partially compensated by the tool's name and context, so score is at baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates accounts linked to an email using holehe, with a specific verb and resource. It distinguishes from sibling tools that search by different identifiers (domain, username, IP, etc.), but could be more precise about what 'accounts' means (e.g., social media profiles).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_breach or search_username. There are no explicit when-to-use or when-not-to-use conditions, nor are alternative tools mentioned for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_footprintA

Collect a target's public search-engine footprint via the Bright Data SERP API. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results and Entity Correlation Graph nodes/edges for discovered domains and profiles. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.
max_queriesNoMax SERP queries (default 3, each is billable).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the external API dependency, required environment variables, query behavior, and the graph-oriented output shape. It does not cover rate limits, failure modes, or cost details, but the schema already mentions billable queries for max_queries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences with no filler. The core purpose is front-loaded, followed by behavior/output details and environment variable requirements. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description covers the main invocation concerns: target semantics, external API, env var prerequisites, and return shape. It is slightly incomplete only in not addressing alternative tool selection or operational caveats like rate limits.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds significant meaning to the undocumented 'target' parameter by listing accepted entity types: email, username, domain, phone, or full name. The other parameters are already described in the schema, so the description compensates for the 67% schema coverage without needing to repeat existing parameter docs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Collect'), a specific resource ('public search-engine footprint via the Bright Data SERP API'), and a distinctive behavior (entity-type detection and entity-type-aware Google queries). This clearly differentiates it from the specialized siblings like search_email, search_username, and search_domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context by explaining that this tool detects the entity type rather than requiring a pre-selected type, which implies it is appropriate for broad or unknown targets. However, it does not explicitly state when not to use it or point to specialized siblings as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_gdelt_geoA

Search worldwide, geolocated news coverage via the GDELT GEO 2.0 API. No API key required. Returns a text summary plus the raw GeoJSON FeatureCollection. Optionally scope to a bounding box.

ParametersJSON Schema
NameRequiredDescriptionDefault
bboxNo[min_lon, min_lat, max_lon, max_lat]
queryYes
timespanNoLookback window in minutes (15-1440). Default 60.
maxpointsNoMax point features to return (1-500). Default 250.
json_outputNoReturn result as structured JSON.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden. It usefully discloses that no API key is needed and that the return is a text summary plus a raw GeoJSON FeatureCollection, but says nothing about rate limits, result freshness, paging/truncation behavior, or what happens when bbox is omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action and data source; each sentence adds distinct information (source, auth, return shape, optional scoping) with no padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter read tool with no output schema, the description covers the essentials: what it searches, that no key is needed, and what comes back. Missing only operational details like rate limits and empty-result behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 80% (bbox, timespan, maxpoints all documented inline), so the schema carries most parameter meaning. The description only echoes the optional bbox scope and adds no format or ordering detail beyond what the schema already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Search') and a well-defined resource ('worldwide, geolocated news coverage via the GDELT GEO 2.0 API'), plus the scope constraint (bounding box). It is easy to distinguish from the other search_* siblings, which target whois, DNS, breach, IP, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes that no API key is required and that bbox scoping is optional, implying when the tool is usable and how to narrow it, but it never states when to prefer this tool over siblings or what kinds of queries it is suited to. Usage is inferred rather than guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_githubA

Search GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It discloses rate limit differences and response variations based on query type. It doesn't explicitly state safety (read-only), but search is inherently non-destructive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the main purpose and provide essential details without fluff. Every sentence adds distinct value: purpose, behavior details, and rate limit info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers main aspects: query types, response content, rate limit. It lacks explicit mention of default output format (likely text vs JSON). Given no output schema, this is a minor gap but overall sufficient for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% with only json_output described. The description adds meaning for the query parameter by explaining its purpose and behavior logic. This compensates for the undocumented query parameter in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches GitHub for a username, email, or keyword. It distinguishes from sibling tools by naming the platform and specifying behavior differences for exact vs non-exact queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on behavior (exact match returns full profile, other queries top 5) and rate limit with GITHUB_TOKEN. It doesn't explicitly state when to use or alternatives among siblings, but the specificity to GitHub implies usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_ipB

Retrieve geolocation and ASN data for an IP address via ipinfo.io.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should fully disclose behavioral traits. It mentions the data source but does not discuss rate limits, authentication requirements, or whether the operation is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that immediately conveys the tool's purpose. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description could hint at the structure of the returned data. It mentions geolocation and ASN but doesn't outline fields, which would help an agent parse results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (only json_output has a description). The tool description adds no extra meaning for the 'ip' parameter, leaving its expected format (IPv4/IPv6) unspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action (retrieve) and the resource (geolocation and ASN data for an IP address), and distinguishes from sibling tools by specifying the data source (ipinfo.io).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like search_ip2location or search_shodan, nor any context on prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_ip2locationB

Enhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Uses IP2LOCATION_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose a third-party dependency, the IP2Location Security Plan, and the IP2LOCATION_API_KEY environment variable. It does not mention whether the operation is read-only, potential rate limits/costs, or what happens when the API key is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the main value proposition and return categories. 'Sponsored integration' is mildly extraneous, but the dependency and env-var note are relevant operational context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter lookup, the description gives enough high-level return content and dependency context to attempt a call. It is incomplete in not explaining response format, error behavior, or how json_output affects the result, especially with no output schema or annotations to fill those gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, and the description adds no explicit meaning for the required ip parameter beyond the tool name/context, nor does it mention json_output. The schema documents json_output, but the description does not compensate for the undocumented ip parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Returns'), a resource (IP intelligence), and concrete data categories (geolocation, ISP, ASN, VPN/proxy/Tor/datacenter detection), which distinguishes it from a plain IP lookup. It does not explicitly name sibling alternatives like search_ip, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by 'Enhanced IP intelligence' and the detection features: an agent can infer this is for richer IP enrichment. However, there is no explicit when-to-use or when-not-to-use guidance relative to siblings such as search_ip, search_shodan, or search_abuseipdb.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_pasteC

Search Pastebin dumps for an email or username via psbdmp.ws.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but only mentions the source (psbdmp.ws), not rate limits, auth, or result behavior; minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no fluff, but slightly under-specified; appropriate length but could be more structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Does not explain output, json_output effect, or differentiate usage from siblings; incomplete for a simple tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%, and description adds no extra meaning beyond the schema; does not explain query format or json_output behavior to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches Pastebin dumps for an email or username via psbdmp.ws, specifying the verb, resource, and source, distinguishing it from siblings like search_email and search_username.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_email or search_username; lacks context for usage decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_phoneA

Gather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format.

ParametersJSON Schema
NameRequiredDescriptionDefault
phoneYes
json_outputNoReturn result as structured JSON.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully carries the burden. It mentions 'gather carrier and geolocation data' but does not disclose side effects, authentication needs, rate limits, or failure modes. Minimal behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no redundancy. The purpose is front-loaded, and the format instruction is directly useful. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist. The description lacks details on return format (beyond 'geolocation data'), error handling, or limitations. Not sufficiently complete for a data-gathering tool with two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds the essential E.164 format requirement for the 'phone' parameter, which is not in the schema. The json_output parameter's schema description is clear but not enhanced. With 50% schema coverage, the description compensates well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gathers carrier and geolocation data for a phone number using phoneinfoga, and the E.164 format requirement. It is specific to phone numbers, distinguishing it from sibling search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description instructs using E.164 format, but provides no guidance on when to use this tool vs alternatives (e.g., for email or domain searches). No when-not or context exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_shodanA

Query Shodan for host intelligence or banner search. IP address โ†’ host lookup (open ports, org, CVEs). Any other string โ†’ keyword/service search. Uses SHODAN_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries the burden. It discloses use of SHODAN_API_KEY env var (auth requirement), and states the dual behavior (IP vs keyword). It adds value by explaining output scope (open ports, org, CVEs) but doesn't mention rate limits, return format, or error behavior. Given zero annotations, this is solid but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, no filler. First sentence states purpose, second gives parameter semantics, third names auth dependency. Every sentence carries weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with no output schema, this is nearly complete. It covers purpose, input semantics, and auth. Missing: what the return value looks like (unstructured text vs JSON default), rate limits, or error handling. Given the tool is a Shodan search with no schema complexity, it's adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the 'query' parameter's semantics in detail: IP โ†’ host lookup, other string โ†’ keyword search. This compensates for the schema's lack of description on 'query'. It also mentions 'json_output' indirectly by saying 'Return result as structured JSON' in the schema. The description goes beyond schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Query Shodan for host intelligence or banner search', provides a concrete mechanism (IP address โ†’ host lookup vs keyword search), and lists what the host lookup yields (open ports, org, CVEs). It also distinguishes from sibling search_* tools by naming the specific service (Shodan). This is a specific verb+resource with clear differentiation from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: IP address โ†’ host lookup, any other string โ†’ keyword/service search. This tells the agent when the tool is relevant (any Shodan query) and is clear on input semantics. However, it doesn't explicitly mention when not to use it vs other sibling tools like search_censys or search_ip, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_usernameB

Enumerate platforms where a username is registered using sherlock.

ParametersJSON Schema
NameRequiredDescriptionDefault
usernameYes
json_outputNoReturn result as structured JSON.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions 'using sherlock' but does not disclose behavioral traits such as network usage, rate limits, accuracy, speed, or any side effects. The verb 'enumerate' implies an interactive process, but details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately states the core purpose. It is front-loaded and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and only two parameters, the description is too sparse. It does not explain what the output looks like, how to interpret results, or any operational details (e.g., network requirements). Given sibling tools, more context would help differentiate use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only json_output has a description). The description does not add meaning for the username parameter, and does not clarify the format or constraints beyond what the schema provides. This is inadequate given the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates platforms where a username is registered using sherlock. It specifies a specific verb (enumerate) and resource (platforms for a username), and it distinguishes from sibling tools that focus on emails, domains, IPs, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, nor are there any exclusions or context about prerequisites. The description simply states what it does without helping the agent decide when it is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_virustotalA

Check IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Uses VIRUSTOTAL_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses the key behavioral trait: auto-detection of input type, and the dependency on VIRUSTOTAL_API_KEY env var. However, it does not disclose rate limits, whether the tool can fail on unknown types, or what the default output format is when json_output is false. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core function is front-loaded, the auto-detection behavior is stated, and the auth dependency is included. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 params and no output schema, the description covers the main purpose and the key behavioral trait (auto-detection) and auth. However, it lacks details on output format when json_output is false, potential error conditions (e.g., invalid target), and rate limits. Given the tool's moderate complexity and the absence of annotations, a bit more context would be needed for fully confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%: the 'target' parameter has no description, while 'json_output' has a basic one. The description adds meaning by explaining that 'target' can be an IP, domain, URL, or file hash and that input type is auto-detected. This compensates partially for the missing schema description, but it doesn't specify formats (e.g., hash type, URL encoding) or the exact effect of json_output beyond 'structured JSON'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Check') and resource ('IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence'). It clearly distinguishes itself from sibling tools like search_ip, search_domain, and search_dns by covering multiple input types and naming VirusTotal specifically. The auto-detection note further clarifies its scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need to check any of the listed indicator types against VirusTotal. It does not explicitly state when not to use it or name alternatives, but the sibling list and the multi-type coverage make the context clear. A small gap is the lack of explicit exclusion guidance (e.g., 'for phone numbers use search_phone').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_whoisC

Retrieve WHOIS registration data for a domain.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must disclose behavioral traits. It only describes the action without mentioning rate limits, data availability, read-only nature, or potential redactions (e.g., GDPR). This is insufficient for informed invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that communicates the core purpose without redundancy. It is appropriately sized, though it could benefit from additional context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is too minimal. It fails to explain what data is returned (e.g., registrar, dates, contacts) or any constraints like domain format. This leaves the agent with insufficient information to handle results properly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, but the tool description adds no extra meaning to either parameter. The 'domain' parameter lacks explanation, and 'json_output' is only partially covered by the schema. The description does not compensate for low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'retrieve' and the resource 'WHOIS registration data' for a domain, which clearly distinguishes it from sibling tools like search_dns or search_domain. It leaves no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like search_domain. There is no mention of prerequisites or context for appropriate use, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev2.28.0
    • Addedsearch_gdelt_geo
  2. 3 tool updatesv2.27.0
    • Addedgraph_export
    • Addedgraph_neighbors
    • Addedgraph_review_candidates
  3. 3 tool updatesv2.23.0
    • Addedscrape_url
    • Addedsearch_dorks_live
    • Addedsearch_footprint
  4. 17 tool updatesv2.16.2
    • First observedgenerate_dorks
    • First observedinvestigate_multi
    • First observedsearch_abuseipdb
    • First observedsearch_breach
    • First observedsearch_censys
    • First observedsearch_dns
    • First observedsearch_domain
    • First observedsearch_email
    • First observedsearch_github
    • First observedsearch_ip
    • First observedsearch_ip2location
    • First observedsearch_paste
    • First observedsearch_phone
    • First observedsearch_shodan
    • First observedsearch_username
    • First observedsearch_virustotal
    • First observedsearch_whois

TDQS

A3.5/5.0

Scored across 24 tools

Disambiguation4/5

Most tools are clearly distinct by target and data source (phone, email, DNS, WHOIS, breach, etc.). The main ambiguity is the cluster of IP-intelligence tools (search_ip, search_ip2location, search_shodan, search_censys, search_abuseipdb) and the two SERP-based search tools, but descriptions do enough to separate them.

Naming Consistency4/5

The dominant search_<target> convention is applied consistently across the majority of tools, making the set predictable. Deviations like graph_export, graph_neighbors, generate_dorks, and investigate_multi are minor and still readable, but they prevent a perfect score.

Tool Count3/5

24 tools is on the heavy side, falling into the borderline range where the set feels large but each integration is defensible for an OSINT aggregator. It is not excessive enough to be chaotic, but it is above the ideal focused scope.

Completeness4/5

The surface covers the core OSINT investigation lifecycle well: phone, email, username, domain, IP, DNS, WHOIS, breaches, paste, GitHub, infrastructure, search, scraping, and graph analysis. Minor gaps exist, such as historical WHOIS or deeper social media content search, but there are no obvious dead ends.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude, enabling sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools.
    237
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server that exposes 108+ omega-cli OSINT tools for reconnaissance, web analysis, threat intelligence, and reporting, enabling AI assistants to perform comprehensive open-source intelligence tasks.
    MIT