OSINT MCP Server
Enables AI-powered research synthesis for person and company intelligence, allowing for deep research and general intelligence queries via Perplexity.
Utilizes the RapidAPI platform to access LinkedIn profile and company data, facilitating professional profile lookups and company record retrieval.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@OSINT MCP Server scan example.com for vulnerabilities and find associated company emails"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
OSINT MCP Server
Unified Open Source Intelligence MCP server for Claude. Combines multiple data sources into a single, powerful intelligence gathering toolkit.
Features
Infrastructure Intelligence
Censys - Host data, certificates, services, ASN info
Shodan - Ports, services, vulnerabilities, DNS
DNS/WHOIS - Domain records and registration data
Email & Identity
Hunter.io - Email finder, verification, company emails
HIBP - Data breach checking
Holehe - Email service detection
Sherlock - Username enumeration across platforms
Person Intelligence
Apollo.io - Person enrichment (email, title, social)
LinkedIn - Profile data, experience, education
Perplexity - AI-powered research synthesis
Company Intelligence
Apollo.io - Company enrichment (size, tech stack, industry)
LinkedIn - Company profiles
Perplexity - AI-powered company research
Installation
pip install -e .Configuration
Create a .env file with your API keys:
# Infrastructure
CENSYS_API_TOKEN=your_censys_token
SHODAN_API_KEY=your_shodan_key
# Email & Identity
HUNTER_API_KEY=your_hunter_key
HIBP_API_KEY=your_hibp_key
# Person/Company
APOLLO_API_KEY=your_apollo_key
RAPIDAPI_KEY=your_rapidapi_key # For LinkedIn
# AI
PERPLEXITY_API_KEY=your_perplexity_keyUsage with Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"osint": {
"command": "osint-mcp",
"env": {
"CENSYS_API_TOKEN": "...",
"SHODAN_API_KEY": "...",
"HUNTER_API_KEY": "...",
"APOLLO_API_KEY": "...",
"RAPIDAPI_KEY": "...",
"PERPLEXITY_API_KEY": "..."
}
}
}
}Available Tools
Tool | Description |
| Censys host lookup |
| Censys query search |
| Shodan host lookup |
| Shodan DNS/subdomains |
| DNS records |
| WHOIS registration |
| Find company emails |
| Find person's email |
| Verify email validity |
| HIBP breach lookup |
| Holehe service detection |
| Sherlock username search |
| Apollo person lookup |
| Find LinkedIn URL |
| Get LinkedIn profile |
| AI person research |
| Apollo company lookup |
| Find people at company |
| LinkedIn company data |
| AI company research |
| Check API availability |
| General AI query |
Development
# Install with dev dependencies
pip install -e ".[dev]"
# Run in dev mode
fastmcp dev src/osint_mcp/server.py
# Run tests
pytestLicense
MIT
Available Tools
22 toolsosint_api_statusB
Check which OSINT APIs are configured and available.
Inputs: no named parameters. Returns: object
osint_breach_checkB
Check if email has been in data breaches (Have I Been Pwned).
Args: email: Email to check
Inputs: email (required). Returns: object
osint_censys_hostC
Get Censys data for an IP address - services, ports, certificates, ASN.
Args: ip: IP address to look up
Inputs: ip (required). Returns: object
osint_censys_searchB
Search Censys for hosts matching a query (e.g., certificates, services).
Args: query: Censys query language search limit: Max results (up to 100)
Inputs: query (required), limit. Returns: object
osint_company_enrichB
Enrich company data using Apollo.io - size, industry, tech stack.
Args: domain: Company website domain
Inputs: domain (required). Returns: object
osint_company_peopleC
Find people at a company using Apollo.io.
Args: organization: Company name domain: Company domain titles: Filter by titles (e.g., ["CEO", "CTO"]) limit: Max results
Inputs: organization, domain, titles, limit. Returns: object
osint_company_researchC
AI-powered company research using Perplexity.
Args: company: Company name domain: Company domain
Inputs: company (required), domain. Returns: object
osint_dns_lookupC
Perform DNS lookups - A, MX, NS, TXT records.
Args: domain: Domain to look up
Inputs: domain (required). Returns: object
osint_email_finderB
Find someone's work email address.
Args: domain: Company domain first_name: Person's first name last_name: Person's last name
Inputs: domain (required), first_name (required), last_name (required). Returns: object
osint_email_searchC
Find email addresses for a company domain using Hunter.io.
Args: domain: Company domain limit: Max results
Inputs: domain (required), limit. Returns: object
osint_email_servicesC
Detect which services an email is registered with using Holehe.
Args: email: Email to check
Inputs: email (required). Returns: object
osint_email_verifyB
Verify if an email address is valid and deliverable.
Args: email: Email to verify
Inputs: email (required). Returns: object
osint_linkedin_companyB
Get LinkedIn company data.
Args: linkedin_url: Company LinkedIn URL domain: Company domain (alternative)
Inputs: linkedin_url, domain. Returns: object
osint_linkedin_findC
Find someone's LinkedIn profile URL.
Args: name: Full name company: Company for disambiguation
Inputs: name (required), company. Returns: object
osint_linkedin_profileB
Get full LinkedIn profile - experience, education, skills.
Args: linkedin_url: LinkedIn profile URL
Inputs: linkedin_url (required). Returns: object
osint_person_enrichC
Enrich person data using Apollo.io - find email, title, social profiles.
Args: first_name: Person's first name last_name: Person's last name organization: Company name domain: Company domain
Inputs: first_name (required), last_name (required), organization, domain. Returns: object
osint_person_researchC
AI-powered person research using Perplexity - synthesizes web info.
Args: name: Person's name context: Additional context (company, role, etc.)
Inputs: name (required), context. Returns: object
osint_queryC
General AI-powered OSINT query using Perplexity.
Args: prompt: Research question or query
Inputs: prompt (required). Returns: object
osint_shodan_domainC
Get Shodan DNS data - subdomains and DNS records.
Args: domain: Domain to look up
Inputs: domain (required). Returns: object
osint_shodan_hostC
Get Shodan data for an IP - ports, services, vulnerabilities.
Args: ip: IP address to look up
Inputs: ip (required). Returns: object
osint_username_searchB
Find accounts across platforms for a username using Sherlock.
Args: username: Username to search
Inputs: username (required). Returns: object
osint_whoisB
Get WHOIS registration data for a domain.
Args: domain: Domain to look up
Inputs: domain (required). Returns: object
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 22 tools
Most tools have distinct purposes targeting specific OSINT resources like email, domain, IP, company, or person, with clear boundaries. However, some overlap exists between company enrichment tools (osint_company_enrich, osint_company_research) and email tools (osint_email_finder, osint_email_search), which could cause minor confusion.
All tools follow a consistent 'osint_verb_noun' or 'osint_noun_noun' pattern with snake_case throughout. This predictable naming convention makes it easy to understand each tool's function at a glance, such as osint_dns_lookup or osint_username_search.
With 22 tools, the count is borderline high for an OSINT server, potentially overwhelming. While OSINT is a broad domain, this many tools might feel heavy and could be streamlined by merging overlapping functionalities, though it covers many aspects comprehensively.
The toolset provides excellent coverage of the OSINT domain, including email, domain, IP, company, and person research with multiple data sources and methods. It supports core workflows from basic lookups to AI-powered research, with no obvious gaps that would hinder agent operations.
Related MCP Connectors
OSINT lookups: usernames, social profiles, phones, domains, IPs, crypto wallets and companies.
Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
Enrich and search people and companies, resolve identities, and enrich IP addresses.
Web search, scraping, crawling, research, a browser agent, and company and people data.