Skip to main content
Glama
OSINT MCP Server

OSINT MCP Server

by glitch-cc

OSINT MCP Server

Unified Open Source Intelligence MCP server for Claude. Combines multiple data sources into a single, powerful intelligence gathering toolkit.

Features

Infrastructure Intelligence

  • Censys - Host data, certificates, services, ASN info

  • Shodan - Ports, services, vulnerabilities, DNS

  • DNS/WHOIS - Domain records and registration data

Email & Identity

  • Hunter.io - Email finder, verification, company emails

  • HIBP - Data breach checking

  • Holehe - Email service detection

  • Sherlock - Username enumeration across platforms

Person Intelligence

  • Apollo.io - Person enrichment (email, title, social)

  • LinkedIn - Profile data, experience, education

  • Perplexity - AI-powered research synthesis

Company Intelligence

  • Apollo.io - Company enrichment (size, tech stack, industry)

  • LinkedIn - Company profiles

  • Perplexity - AI-powered company research

Installation

pip install -e .

Configuration

Create a .env file with your API keys:

# Infrastructure
CENSYS_API_TOKEN=your_censys_token
SHODAN_API_KEY=your_shodan_key

# Email & Identity
HUNTER_API_KEY=your_hunter_key
HIBP_API_KEY=your_hibp_key

# Person/Company
APOLLO_API_KEY=your_apollo_key
RAPIDAPI_KEY=your_rapidapi_key  # For LinkedIn

# AI
PERPLEXITY_API_KEY=your_perplexity_key

Usage with Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "osint": {
      "command": "osint-mcp",
      "env": {
        "CENSYS_API_TOKEN": "...",
        "SHODAN_API_KEY": "...",
        "HUNTER_API_KEY": "...",
        "APOLLO_API_KEY": "...",
        "RAPIDAPI_KEY": "...",
        "PERPLEXITY_API_KEY": "..."
      }
    }
  }
}

Available Tools

Tool

Description

osint_censys_host

Censys host lookup

osint_censys_search

Censys query search

osint_shodan_host

Shodan host lookup

osint_shodan_domain

Shodan DNS/subdomains

osint_dns_lookup

DNS records

osint_whois

WHOIS registration

osint_email_search

Find company emails

osint_email_finder

Find person's email

osint_email_verify

Verify email validity

osint_breach_check

HIBP breach lookup

osint_email_services

Holehe service detection

osint_username_search

Sherlock username search

osint_person_enrich

Apollo person lookup

osint_linkedin_find

Find LinkedIn URL

osint_linkedin_profile

Get LinkedIn profile

osint_person_research

AI person research

osint_company_enrich

Apollo company lookup

osint_company_people

Find people at company

osint_linkedin_company

LinkedIn company data

osint_company_research

AI company research

osint_api_status

Check API availability

osint_query

General AI query

Development

# Install with dev dependencies
pip install -e ".[dev]"

# Run in dev mode
fastmcp dev src/osint_mcp/server.py

# Run tests
pytest

License

MIT

Available Tools

22 tools
osint_api_statusB

Check which OSINT APIs are configured and available.

Inputs: no named parameters. Returns: object

osint_breach_checkB

Check if email has been in data breaches (Have I Been Pwned).

Args: email: Email to check

Inputs: email (required). Returns: object

osint_censys_hostC

Get Censys data for an IP address - services, ports, certificates, ASN.

Args: ip: IP address to look up

Inputs: ip (required). Returns: object

osint_company_enrichB

Enrich company data using Apollo.io - size, industry, tech stack.

Args: domain: Company website domain

Inputs: domain (required). Returns: object

osint_company_peopleC

Find people at a company using Apollo.io.

Args: organization: Company name domain: Company domain titles: Filter by titles (e.g., ["CEO", "CTO"]) limit: Max results

Inputs: organization, domain, titles, limit. Returns: object

osint_company_researchC

AI-powered company research using Perplexity.

Args: company: Company name domain: Company domain

Inputs: company (required), domain. Returns: object

osint_dns_lookupC

Perform DNS lookups - A, MX, NS, TXT records.

Args: domain: Domain to look up

Inputs: domain (required). Returns: object

osint_email_finderB

Find someone's work email address.

Args: domain: Company domain first_name: Person's first name last_name: Person's last name

Inputs: domain (required), first_name (required), last_name (required). Returns: object

osint_email_servicesC

Detect which services an email is registered with using Holehe.

Args: email: Email to check

Inputs: email (required). Returns: object

osint_email_verifyB

Verify if an email address is valid and deliverable.

Args: email: Email to verify

Inputs: email (required). Returns: object

osint_linkedin_companyB

Get LinkedIn company data.

Args: linkedin_url: Company LinkedIn URL domain: Company domain (alternative)

Inputs: linkedin_url, domain. Returns: object

osint_linkedin_findC

Find someone's LinkedIn profile URL.

Args: name: Full name company: Company for disambiguation

Inputs: name (required), company. Returns: object

osint_linkedin_profileB

Get full LinkedIn profile - experience, education, skills.

Args: linkedin_url: LinkedIn profile URL

Inputs: linkedin_url (required). Returns: object

osint_person_enrichC

Enrich person data using Apollo.io - find email, title, social profiles.

Args: first_name: Person's first name last_name: Person's last name organization: Company name domain: Company domain

Inputs: first_name (required), last_name (required), organization, domain. Returns: object

osint_person_researchC

AI-powered person research using Perplexity - synthesizes web info.

Args: name: Person's name context: Additional context (company, role, etc.)

Inputs: name (required), context. Returns: object

osint_queryC

General AI-powered OSINT query using Perplexity.

Args: prompt: Research question or query

Inputs: prompt (required). Returns: object

osint_shodan_domainC

Get Shodan DNS data - subdomains and DNS records.

Args: domain: Domain to look up

Inputs: domain (required). Returns: object

osint_shodan_hostC

Get Shodan data for an IP - ports, services, vulnerabilities.

Args: ip: IP address to look up

Inputs: ip (required). Returns: object

osint_whoisB

Get WHOIS registration data for a domain.

Args: domain: Domain to look up

Inputs: domain (required). Returns: object

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    B3.4/5.0

    Scored across 22 tools

    Disambiguation4/5

    Most tools have distinct purposes targeting specific OSINT resources like email, domain, IP, company, or person, with clear boundaries. However, some overlap exists between company enrichment tools (osint_company_enrich, osint_company_research) and email tools (osint_email_finder, osint_email_search), which could cause minor confusion.

    Naming Consistency5/5

    All tools follow a consistent 'osint_verb_noun' or 'osint_noun_noun' pattern with snake_case throughout. This predictable naming convention makes it easy to understand each tool's function at a glance, such as osint_dns_lookup or osint_username_search.

    Tool Count3/5

    With 22 tools, the count is borderline high for an OSINT server, potentially overwhelming. While OSINT is a broad domain, this many tools might feel heavy and could be streamlined by merging overlapping functionalities, though it covers many aspects comprehensively.

    Completeness5/5

    The toolset provides excellent coverage of the OSINT domain, including email, domain, IP, company, and person research with multiple data sources and methods. It supports core workflows from basic lookups to AI-powered research, with no obvious gaps that would hinder agent operations.

    Related MCP Connectors