"An introduction to OSINT (Open Source Intelligence)" matching MCP servers:

Provides 26 free OSINT tools as MCP tools for AI agents, enabling automated OSINT investigations directly from conversations.

Provides passive OSINT reconnaissance for domains and IPs using public sources, with tools for WHOIS/RDAP, DNS, subdomain enumeration, Wayback Machine, HTTP headers, Shodan InternetDB, email security, TLS certificates, and ASN lookups, all without requiring API keys.

Provides AI agents with 37 OSINT tools and 12 data sources to perform unified reconnaissance, domain analysis, and attack surface mapping. It enables agents to query, correlate, and reason across platforms like Shodan, VirusTotal, and Censys in parallel.

A comprehensive reconnaissance toolset that provides AI agents with 37 tools across 12 data sources like Shodan and VirusTotal for automated intelligence gathering. It enables agents to perform domain reconnaissance, attack surface mapping, and cross-platform data correlation within a single conversational interface.

MCP server that enumerates DNS records, detects SPF/DMARC/DKIM misconfigurations, and identifies dangling subdomains.

Provides unified access to vulnerability data from NVD, MITRE, and GitHub Security Advisories for cybersecurity intelligence.

Enables static AST-based dataflow analysis to trace untrusted sources to sensitive sinks, supporting automated code review and security auditing through MCP.

Provides multi-source vulnerability intelligence for AI-powered security operations, combining NVD CVSS, CISA KEV, and EPSS scores without requiring an API key.

Enables static AST-based taint flow tracing from untrusted sources to sensitive sinks, supporting AI code review and security analysis via MCP.

AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.

MCP server that exposes 108+ omega-cli OSINT tools for reconnaissance, web analysis, threat intelligence, and reporting, enabling AI assistants to perform comprehensive open-source intelligence tasks.

Live threat intelligence for agents: incident clusters, threat actor and malware profiles, CVEs with KEV/EPSS/exploit status, and ransomware leak-site victims, as ten read-only tools over the ThreatCluster API with a free key. Every result carries citation URLs and the credits it cost.

Enables AI assistants and security analysts to inspect PCAP/PCAPNG captures through MCP tools or REST endpoints, reassembling TCP/UDP streams, extracting payload artifacts, detecting CTF flags, credential leaks and network anomalies, and generating formal PDF or Markdown forensic reports. Every finding is bound to exact frame numbers, timestamps and endpoints with SHA-256 deduplicated evidence provenance.

Provides CVE search enriched with EPSS exploit likelihood and CISA KEV status, plus live IP/domain reputation and a real-time threat feed for AI agents.

Enables permission-preserving access to DefectDojo OSS via MCP, using the caller's own API token, with read tools, deterministic analytics and reporting, plus optional gated write and history tools.

Enables passive OSINT reconnaissance by providing search dorking and open-source intelligence collection tools through MCP, without requiring active interaction with target systems.

Enables AI agents to call 93 pay-per-call machine-to-machine services spanning web scraping, crypto sentiment, market data, on-chain analytics, social and threat intelligence, vulnerability scanning, and micro-SaaS utilities. Payments are settled in USDC on Arbitrum via the x402 protocol using a wallet header, so no API keys, signups, or billing setup are required.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Provides a unified interface for security analysts to gather threat intelligence from multiple sources including VirusTotal, Shodan, NVD, AnyRun, AlienVault OTX, and GitHub.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.