Scored across 15 tools
Most tools have clearly distinct purposes, but the aggregate recon_domain and investigate_site overlap in scope with several single-purpose tools. Descriptions explicitly guide the agent on when to use each, but the boundary between passive domain overview and active site investigation could still cause misselection.
Names mix noun_noun (domain_whois, dns_lookup), verb_noun (compare_domains, investigate_site), recon_ prefixes (recon_domain, recon_batch), and single words (subdomains, wayback). The set remains readable, but no single predictable convention governs all tools.
15 tools is well within a reasonable range for a domain OSINT server and each tool targets a distinct data source or operation (WHOIS, DNS, TLS, CT logs, Wayback, Shodan, ASN, etc.). No tool feels redundant or like padding.
The surface covers core domain OSINT needs: registration, DNS, email security, TLS, HTTP headers, certificate transparency, Wayback, IP ownership/routing, and Shodan ports. Minor gaps include no historical DNS lookup, no registrant-to-domain pivoting, and no active port scanning, but agents can largely work around these.