Check if an email appears in data breaches via HaveIBeenPwned. Uses HIBP_API_KEY env var. [passive] One request to haveibeenpwned.com.

Retrieve WHOIS registration data for a domain. [passive] Queries the registry/registrar WHOIS server, not the target.

Retrieve geolocation and ASN data for an IP address via ipinfo.io. [passive] One request to ipinfo.io.

Generate targeted Google dork URLs for any target (name, email, username, domain). [passive] Builds Google search URLs locally; sends nothing.

Search Pastebin dumps for an email or username via psbdmp.ws. [passive] One request to psbdmp.ws.

Query Shodan for host intelligence or banner search. IP address → host lookup (open ports, org, CVEs). Any other string → keyword/service search. Uses SHODAN_API_KEY env var. [passive] Shodan API; reads Shodan's existing index, requests no new scan.

Check IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Uses VIRUSTOTAL_API_KEY env var. [passive] IP, domain and hash lookups read VirusTotal's existing data. URL submission is a separate active mode, off by default: it makes VirusTotal fetch the URL and makes it visible to the VirusTotal community.

Search Censys for internet-facing infrastructure data. IP address → open ports, services, ASN, country. Domain → certificate history, SANs, issuer, first/last seen. Uses CENSYS_API_ID and CENSYS_SECRET env vars. [passive] Censys API; returns data Censys already holds.

Enhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Uses IP2LOCATION_API_KEY env var. [passive] One request to api.ip2location.io.

Check an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0–100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Uses ABUSEIPDB_API_KEY env var. [passive] One request to api.abuseipdb.com.

Search GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h. [passive] A few requests to api.github.com.

Structured domain registration lookup via RDAP (the machine-readable successor to WHOIS): registrar, registration and expiry dates, name servers and status codes. Registrant contact details are redacted by policy. No API key required. [passive] Queries IANA and the registry's RDAP server, not the target.

Comprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required. [passive; DKIM selector probes (enumeration) run only with active tools enabled.] Record lookups go through your DNS resolver; the target's nameservers see the resolver, not you.

Search recent, geolocated worldwide news from GDELT's 15-minute article feed (headlines/URLs matched against the query). No API key required. Returns a text summary plus a GeoJSON FeatureCollection, and says how far back it covers (the first call may cover only the last 15 minutes while older articles load). Optionally scope to a bounding box; query "*" lists everything inside it. [passive] Downloads GDELT's public news feed and filters it locally; your search term never leaves your machine.

Execute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default — each is a billable API call. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars. [passive] Google results via Bright Data; the target is sent to those two services.

Collect a target's public search-engine footprint via the Bright Data SERP API. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results and Entity Correlation Graph nodes/edges for discovered domains and profiles. Uses BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars. [passive] Up to 3 Google queries via Bright Data; the target is sent to those two services.

Export the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'. [passive] Reads the local graph database only.

Traverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'. [passive] Reads the local graph database only.

Human review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges — only this action can write judgement='positive'. [passive] Reads the local graph database only.

Investigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Uses ANTHROPIC_API_KEY env var. [inherits] Runs one agent per target under a shared tool-call cap; passive unless active is enabled.