221B
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BRAVE_API_KEY | No | Brave API key as environment variable. Credential precedence is secret file → BRAVE_API_KEY environment → OS store. | |
| SHODAN_API_KEY | No | Shodan API key as environment variable. Precedence is secret file → environment → OS store. | |
| MCP_221B_CONFIG | No | Override path for configuration. | |
| MCP_221B_LOG_DIR | No | Override path for logs. | |
| MCP_221B_DATA_DIR | No | Override path for data directory (evidence). | |
| BRAVE_API_KEY_FILE | No | Path to a mounted UTF-8 file containing the Brave API key. Credential precedence is secret file → BRAVE_API_KEY environment → OS store. | |
| SHODAN_API_KEY_FILE | No | Path to a mounted UTF-8 file containing the Shodan API key. Precedence is secret file → environment → OS store. | |
| MCP_221B_SEARCH_PROVIDER | No | Search provider to use. Set to 'brave' to use Brave. A key alone does not switch providers. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_usernameA | Find candidate accounts with local Sherlock. depth: light (default) checks 20 curated popular sites; dev checks developer platforms; complete requests all available sites, including adult sites, with a 10-minute deadline. Upstream false-positive exclusions apply. Explicit sites override the preset's selection. Requires the sherlock package extra. A match does not establish the owner's identity. |
| search_webB | Find public mentions; defaults to keyless metasearch. Max 20 results. Supports search operators where the selected engines support them. Optional provider='brave' uses the Brave API and requires a key. Omit provider to use the configured default. |
| inspect_pageA | Fetch a public HTML/text page and extract text, links and emails. No browser rendering. |
| lookup_domainA | Look up A, AAAA, MX, NS and TXT DNS records, plus available RDAP registration data. |
| search_archivesA | Find Wayback captures of an exact URL, deduplicated by digest. At most 100 captures. |
| export_findingsA | Export 1–100 existing evidence record IDs to a new local JSON or Markdown file. |
| lookup_shodan_hostA | Retrieve Shodan's recorded services for a public IP. Requires a Shodan API key. Returns up to 100 services and bounded banner excerpts. Observations are not live checks. |
| search_shodanA | Search Shodan's indexed services using native filters. Requires a Shodan API key. May consume query credits. Fetches one explicit page of up to 100 services; limit (1–100) caps returned evidence, not credit usage. No automatic pagination or retries. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct resource and action: username search, web search, page inspection, DNS/RDAP lookup, archive lookup, evidence export, and two clearly separated Shodan operations. Even search_shodan vs lookup_shodan_host are easy to distinguish by indexed search vs. host-by-IP.
All tool names follow a consistent lower_snake_case verb_noun pattern. search_* indicates discovery-style tools, lookup_* indicates point lookups, and inspect_page/export_findings map one clear action to one clear object.
Eight tools is a well-scoped size for an OSINT investigation toolkit. Each tool adds a distinct source or capability, and there is no apparent bloat or thinness in the set.
The core investigation workflow is well covered: find subjects, search web and archives, inspect pages and domains, enrich with Shodan, and export evidence. Minor gaps remain around direct evidence record management and browser-level page inspection, but agents can work around them using the provided tools.