osint-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OSINT_MCP_CACHE | No | Set to 'off' to disable caching. | on |
| OSINT_MCP_CACHE_TTL | No | Cache TTL in seconds. Default is 21600. | 21600 |
| OSINT_MCP_CACHE_PATH | No | Path to the SQLite cache database. Default is ~/.cache/osint-mcp/cache.sqlite3. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| recon_domainA | Passive overview of a domain in one call: whois, DNS, email security grade, TLS certificate, HTTP security headers, subdomains from CT logs, and ASN / reverse DNS / Shodan InternetDB for its first few IPs. Ends with a 'highlights' list of things worth a look. Takes 10-60s, mostly waiting on crt.sh, pass include_subdomains=false for a faster run. |
| domain_whoisA | Registration info for a domain via RDAP: registrar, creation/expiry dates, nameservers, status and abuse contact. |
| ip_whoisA | Who owns an IP: network name, CIDR, country, org, abuse contact and reverse DNS (PTR). |
| dns_lookupA | DNS records for a domain. Defaults to A, AAAA, CNAME, MX, NS, TXT, SOA, CAA. Pass nameserver (e.g. "1.1.1.1") to query a specific resolver. |
| subdomainsB | Subdomains seen in public TLS certificates (crt.sh). Can be slow for large domains. |
| waybackC | Archived snapshots of a URL from the Wayback Machine. Use a wildcard like "example.com/*" to list everything archived under a site. |
| http_headersA | Fetch a URL and return status, redirect chain, response headers and which common security headers are missing. |
| shodan_internetdbA | Open ports, hostnames, CPEs, tags and known CVEs for an IP from Shodan's free InternetDB (no API key, data can be a few days old). |
| email_securityA | Grade (A-F) how well a domain is protected against being spoofed in email: SPF, DMARC, MTA-STS, TLS-RPT and DKIM. DKIM selectors can't be listed, so a set of common ones is tried unless you pass your own. |
| tls_certificateA | Connect to host:port and read its TLS certificate: issuer, validity dates, days until expiry, SANs, negotiated TLS version. Invalid certs (expired, self-signed, wrong host) are reported with the reason. |
| asn_lookupA | Look up an IP or AS number (e.g. "AS13335") via RIPEstat: which AS announces it, who holds the AS and every prefix it announces. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool targets a distinct data source or type: recon_domain is an aggregated overview, while domain_whois, ip_whois, dns_lookup, subdomains, wayback, http_headers, shodan_internetdb, email_security, tls_certificate, and asn_lookup each focus on a unique aspect (e.g., registration, DNS, certificates, email). There is minimal overlap; for example, subdomains and asn_lookup are clearly separate.
All tool names follow a consistent noun-based pattern (e.g., domain_whois, ip_whois, dns_lookup, tls_certificate). There is no mixing of styles or ambiguous verbs; the naming clearly indicates the data type being queried.
With 11 tools, the collection is well-scoped for a recon/information-gathering server. Each tool serves a distinct purpose in the security recon workflow, and the number is within the ideal range, avoiding both redundancy and insufficiency.
The toolset covers the major security recon surfaces: domain info, IP info, DNS, subdomains, HTTP headers, TLS, email security, and ASN. Minor gaps include missing passive DNS history, port scanning beyond InternetDB, or vulnerability scanning APIs, but agents can achieve common recon goals with the provided tools.