OSINT MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HIBP_API_KEY | No | API key for Have I Been Pwned (Data breach checking) | |
| RAPIDAPI_KEY | No | RapidAPI key used for LinkedIn profile and company data | |
| APOLLO_API_KEY | No | API key for Apollo.io (Person/company enrichment) | |
| HUNTER_API_KEY | No | API key for Hunter.io (Email finder, verification, company emails) | |
| SHODAN_API_KEY | No | API key for Shodan (Ports, services, vulnerabilities, DNS) | |
| CENSYS_API_TOKEN | No | API token for Censys (Host data, certificates, services, ASN info) | |
| PERPLEXITY_API_KEY | No | API key for Perplexity (AI-powered research synthesis) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tasks | {
"list": {},
"cancel": {},
"requests": {
"tools": {
"call": {}
},
"prompts": {
"get": {}
},
"resources": {
"read": {}
}
}
} |
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| osint_censys_hostC | Get Censys data for an IP address - services, ports, certificates, ASN. Args: ip: IP address to look up |
| osint_censys_searchB | Search Censys for hosts matching a query (e.g., certificates, services). Args: query: Censys query language search limit: Max results (up to 100) |
| osint_shodan_hostC | Get Shodan data for an IP - ports, services, vulnerabilities. Args: ip: IP address to look up |
| osint_shodan_domainC | Get Shodan DNS data - subdomains and DNS records. Args: domain: Domain to look up |
| osint_dns_lookupC | Perform DNS lookups - A, MX, NS, TXT records. Args: domain: Domain to look up |
| osint_whoisB | Get WHOIS registration data for a domain. Args: domain: Domain to look up |
| osint_email_searchC | Find email addresses for a company domain using Hunter.io. Args: domain: Company domain limit: Max results |
| osint_email_finderB | Find someone's work email address. Args: domain: Company domain first_name: Person's first name last_name: Person's last name |
| osint_email_verifyB | Verify if an email address is valid and deliverable. Args: email: Email to verify |
| osint_breach_checkB | Check if email has been in data breaches (Have I Been Pwned). Args: email: Email to check |
| osint_email_servicesC | Detect which services an email is registered with using Holehe. Args: email: Email to check |
| osint_username_searchB | Find accounts across platforms for a username using Sherlock. Args: username: Username to search |
| osint_person_enrichC | Enrich person data using Apollo.io - find email, title, social profiles. Args: first_name: Person's first name last_name: Person's last name organization: Company name domain: Company domain |
| osint_linkedin_findC | Find someone's LinkedIn profile URL. Args: name: Full name company: Company for disambiguation |
| osint_linkedin_profileB | Get full LinkedIn profile - experience, education, skills. Args: linkedin_url: LinkedIn profile URL |
| osint_person_researchC | AI-powered person research using Perplexity - synthesizes web info. Args: name: Person's name context: Additional context (company, role, etc.) |
| osint_company_enrichB | Enrich company data using Apollo.io - size, industry, tech stack. Args: domain: Company website domain |
| osint_company_peopleC | Find people at a company using Apollo.io. Args: organization: Company name domain: Company domain titles: Filter by titles (e.g., ["CEO", "CTO"]) limit: Max results |
| osint_linkedin_companyB | Get LinkedIn company data. Args: linkedin_url: Company LinkedIn URL domain: Company domain (alternative) |
| osint_company_researchC | AI-powered company research using Perplexity. Args: company: Company name domain: Company domain |
| osint_api_statusB | Check which OSINT APIs are configured and available. |
| osint_queryC | General AI-powered OSINT query using Perplexity. Args: prompt: Research question or query |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 22 tools
Most tools have distinct purposes targeting specific OSINT resources like email, domain, IP, company, or person, with clear boundaries. However, some overlap exists between company enrichment tools (osint_company_enrich, osint_company_research) and email tools (osint_email_finder, osint_email_search), which could cause minor confusion.
All tools follow a consistent 'osint_verb_noun' or 'osint_noun_noun' pattern with snake_case throughout. This predictable naming convention makes it easy to understand each tool's function at a glance, such as osint_dns_lookup or osint_username_search.
With 22 tools, the count is borderline high for an OSINT server, potentially overwhelming. While OSINT is a broad domain, this many tools might feel heavy and could be streamlined by merging overlapping functionalities, though it covers many aspects comprehensively.
The toolset provides excellent coverage of the OSINT domain, including email, domain, IP, company, and person research with multiple data sources and methods. It supports core workflows from basic lookups to AI-powered research, with no obvious gaps that would hinder agent operations.