osint-toolbox-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ALL_PROXY | No | Passed on to the tools; whether a tool uses them depends on the tool | |
| HTTP_PROXY | No | Passed on to the tools; whether a tool uses them depends on the tool | |
| HTTPS_PROXY | No | Passed on to the tools; whether a tool uses them depends on the tool | |
| OSINT_GHUNT | No | Full path to the GHunt tool, when it isn't on PATH | |
| OSINT_HOLEHE | No | Full path to the Holehe tool, when it isn't on PATH | |
| OSINT_MAIGRET | No | Full path to the Maigret tool, when it isn't on PATH | |
| OSINT_EXIFTOOL | No | Full path to the ExifTool tool, when it isn't on PATH | |
| OSINT_SHERLOCK | No | Full path to the Sherlock tool, when it isn't on PATH | |
| OSINT_PHONEINFOGA | No | Full path to the PhoneInfoga tool, when it isn't on PATH | |
| OSINT_THEHARVESTER | No | Full path to the theHarvester tool, when it isn't on PATH | |
| OSINT_BLACKBIRD_DIR | No | Folder of the Blackbird checkout | |
| OSINT_SPIDERFOOT_DIR | No | Folder of the SpiderFoot checkout | |
| OSINT_BLACKBIRD_PYTHON | No | Python to run the Blackbird checkout with; by default its .venv, then python on PATH | |
| OSINT_MAX_OUTPUT_CHARS | No | Longest result returned to the model, 100000 by default; 0 for no limit | 100000 |
| OSINT_SPIDERFOOT_PYTHON | No | Python to run the SpiderFoot checkout with; by default its .venv, then python on PATH |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sherlock_username_searchA | Find accounts that use a username on 400+ social networks and websites (Sherlock). Returns the sites where the username exists, with profile URLs. |
| holehe_email_searchA | Check which of about 120 websites have an account registered to an email address (Holehe). |
| spiderfoot_scanA | Run a SpiderFoot scan: it detects the target type and runs the matching modules. Results are grouped by event type. A 'passive' scan takes minutes, 'all' can take 30+ minutes. |
| ghunt_google_searchA | Look up a Google account by email address or Gaia ID (GHunt): name, profile picture, Gaia ID, Maps reviews, calendar and other public data. Requires a one-time |
| maigret_username_searchB | Search a username with Maigret: the 500 most popular sites by default, 3000+ with all_sites. Extracts profile data (names, links, IDs) and filters false positives. |
| theharvester_domain_searchA | Collect email addresses, subdomains, hosts, IP addresses and URLs for a domain or company name from public sources (theHarvester). |
| phoneinfoga_scanA | Scan a phone number with PhoneInfoga: country, number formats, carrier and line type (with an API key), and search engine queries for it. |
| exiftool_metadataA | Read the metadata of a local photo, video or document with ExifTool: GPS coordinates, camera, author, software and timestamps. |
| subfinder_subdomain_searchA | Find subdomains of a domain in passive sources such as certificate logs and DNS datasets (subfinder). Returns each subdomain with the sources that reported it. |
| dnstwist_lookalike_domainsA | Generate lookalike domains (typos, homoglyphs, other TLDs) for a domain and check which are registered, with their A, MX and NS records (dnstwist). Useful to spot phishing domains. |
| dnsrecon_domain_scanB | DNS reconnaissance of a domain with dnsrecon: SOA, NS, MX, A, AAAA and SRV records, zone transfer attempts, DNSSEC zone walking and certificate-log names, depending on scan_type. |
| whois_lookupA | Registration data for a domain, IP address, network or AS number: registrar, dates, name servers, holder and contacts where public. Uses RDAP, or WHOIS for registries without RDAP. |
| dns_lookupA | DNS records of a name (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA by default), or the reverse name of an IP address. Asks public DNS-over-HTTPS resolvers. |
| crtsh_certificate_searchA | Host names (often unlisted subdomains) and email addresses found in TLS certificates issued for a domain, from the crt.sh certificate transparency log search. |
| wayback_snapshotsA | Archived snapshots of a URL, a site or a domain in the Internet Archive's Wayback Machine, newest first, with links to view each one. |
| osint_toolbox_statusA | Which OSINT tools this server can run on this machine, and how to install the missing ones. Call it when a tool you need is not available. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 16 tools
The tools are mostly organized by distinct external utilities, but some outputs overlap: subfinder, crtsh, dnsrecon, and theHarvester can all surface subdomains or hostnames, and sherlock and maigret both search usernames across many sites. The descriptions clarify the source and depth of each tool, but an agent still faces plausible ambiguity when choosing among them.
Almost all tools follow a predictable snake_case pattern of underlying_tool plus a descriptive suffix, such as subfinder_subdomain_search, phoneinfoga_scan, and whois_lookup. A few names like wayback_snapshots and exiftool_metadata omit an action verb, but the overall convention is consistent and readable.
Sixteen tools is slightly above the ideal range but appropriate for an OSINT toolbox that wraps one external utility per tool. Each tool covers a distinct reconnaissance category, and none feel redundant enough to remove.
The toolbox covers major OSINT workflows well: domain enumeration, DNS, WHOIS, certificate transparency, lookalike domains, email lookup, username search, phone lookup, file metadata, and web archives. Some common areas like IP reputation or breach-data search are missing, but the included surface is broad and practical.