osint-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OTX_API_KEY | No | API key for AlienVault OTX pulses and indicator enrichment | |
| GITHUB_TOKEN | No | GitHub token for higher rate limit | |
| HIBP_API_KEY | No | API key for Have I Been Pwned breached-account lookups | |
| HUNTER_API_KEY | No | API key for Hunter email discovery (planned) | |
| SHODAN_API_KEY | No | API key for Shodan search/host tools | |
| VIRUSTOTAL_API_KEY | No | API key for VirusTotal reputation (planned) | |
| OSINT_MCP_TRANSPORT | No | Transport mode: 'stdio' (default) or 'http' | stdio |
| OSINT_MCP_AUTH_TOKEN | No | Bearer token required when using HTTP transport |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dns_lookupA | Resolve DNS records for a hostname (A, AAAA, MX, TXT, NS, SOA, CNAME, CAA, SRV). |
| dns_lookup_allA | Resolve all common record types for a hostname at once. |
| whois_domainB | Domain registration data (registrar, dates, nameservers) via RDAP. |
| whois_ipA | IP network allocation data via RDAP (network name, CIDR, country). |
| crtsh_searchA | Discover subdomains via certificate transparency logs (crt.sh). |
| hackertarget_hostsearchB | Find hosts/subdomains with resolved IPs via HackerTarget. |
| email_securityA | Analyze a domain's SPF/DMARC/DKIM email-authentication and spoofing risk. |
| geoipB | IP geolocation: country, region, city, ISP, ASN, proxy/hosting flags. |
| bgp_asnC | ASN details and announced IPv4/IPv6 prefixes. |
| bgp_ipB | IP to prefix/ASN routing lookup. |
| wayback_urlsA | Discover archived URLs for a domain via the Wayback Machine CDX API. |
| github_user_infoA | Get public GitHub profile metadata for a user. |
| github_user_reposA | List public GitHub repositories for a user. |
| github_commit_emailsB | Extract email addresses from a user's public GitHub events. |
| github_repo_commitsB | Extract committer emails from a repo's recent commit history. |
| reddit_userA | Get public Reddit profile metadata (account age, karma, mod status). |
| reddit_user_postsB | List a Reddit user's recent public posts. |
| keybase_lookupA | Look up a Keybase user and their linked social accounts / public keys. |
| username_enumerateA | Probe ~20 major platforms to see if a username is taken. |
| gravatar_lookupB | Look up the public Gravatar profile for an email address. |
| email_permutationsC | Generate common corporate email address permutations. |
| domain_email_searchA | Heuristically scrape a domain's public pages for exposed emails. |
| check_password_breachA | Check if a password appeared in a breach (k-anonymity; password never leaves the machine). |
| check_email_breachesA | Check an email against HaveIBeenPwned breaches (needs HIBP_API_KEY). |
| search_darkwebA | Search the dark web via Ahmia.fi (.onion index). Metadata only. |
| shodan_internetdbB | Free Shodan InternetDB lookup: open ports, hostnames, CVEs, tags. |
| cisa_kev_catalogA | Fetch the CISA Known Exploited Vulnerabilities catalog. |
| otx_search_pulsesB | Fetch recent AlienVault OTX threat pulses (needs OTX_API_KEY). |
| otx_indicatorB | Enrich an indicator (IP/domain/URL/hash) via AlienVault OTX. |
| osint_list_sourcesA | List all data sources, which are free, and which API keys are configured. |
| osint_domain_reconA | All-in-one free reconnaissance for a domain (DNS, WHOIS, crt.sh, hosts, email security, geoip). |
| osint_ip_reconA | All-in-one free reconnaissance for an IP (geo, rdap, bgp, shodan internetdb). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 32 tools
Most tools map to a distinct source or entity (WHOIS, BGP, GitHub, Reddit, OTX), so an agent can usually choose correctly. However, dns_lookup and dns_lookup_all appear near-identical, crtsh_search and hackertarget_hostsearch both target subdomains, and the all-in-one recon tools duplicate many individual lookups.
The set mostly follows a clean snake_case source_or_object convention (github_user_repos, check_email_breaches, otx_indicator). Minor inconsistencies such as dns_lookup vs dns_lookup_all, hackertarget_hostsearch, and osint_list_sources are easy to learn but break the pattern slightly.
At 32 tools, the surface is heavy and likely to increase prompt and selection cost for an agent; while each tool represents a plausible OSINT data source, the count exceeds the range where an agent can quickly scan and disambiguate options. Consolidating the recon aggregators or reducing similar lookups would help.
The server covers a coherent OSINT workflow: DNS/WHOIS/subdomain enumeration, IP/BGP/geo enrichment, social and username lookup, breach checking, and threat-intel feeds. Some broader OSINT categories such as phone numbers, image search, or mainstream social platforms beyond GitHub/Reddit/Keybase are absent, but the core domain is well covered.