"Osint" matching MCP tools:

• osint-signalA

  AndreaxC

  OSINT(info): condensed market-vs-narrative signal + fear/greed. INFORMATION ONLY. input=asset. [x402: 5.0 USDC on Base, pay-per-use]

  ConnectorNo auth

• x402-osint-packC

  minia2a-mcpC

  OSINT Pack: OSINT toolkit — domain, IP, email, and social recon.

  ConnectorNo auth

• x402-osint-packC

  minia2a-mcp-remoteD

  OSINT Pack: OSINT toolkit — domain, IP, email, and social recon.

  ConnectorNo auth

• recon_domain_osintA

  domain-osint-mcpA

  Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. WHEN TO USE: Call `recon_domain_osint` when your task requires deterministic `domain-osint` analysis for `domain`; use `get_agent_wallet_status` to check your remaining free trial quota or prepaid balance. WHEN NOT TO USE: Do not use for unrelated domains or binary media. PARAMETER INTERACTIONS: Pass the target `domain` as a non-empty string; omit `agent_id` and `tx_hash` during your 5 free trial calls, or supply `agent_id` (`agd_pass_...`) / `tx_hash` for paid execution. Read-only and idempotent; results are cached for 1 hour (<5ms cache hit). $0.01 per call. Pricing: the first 5 calls per agent_id are free and failed calls are never charged. After 5 calls, the tool returns a payment-required quote (not a fatal error) with a $2 Stripe top-up link and Base/Solana USDC addresses; complete payment, then retry with your agd_pass_ key in agent_id or pass tx_hash. Example: recon_domain_osint(domain='example')

  ConnectorNo auth

• recon_domain_osintA

  AgentDiet Domain OSINT, TLS Certificate & Security Headers ReconA

  Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. WHEN TO USE: Call `recon_domain_osint` when your task requires deterministic `domain-osint` analysis for `domain`; use `get_agent_wallet_status` to check your remaining free trial quota or prepaid balance. WHEN NOT TO USE: Do not use for unrelated domains or binary media. PARAMETER INTERACTIONS: Pass the target `domain` as a non-empty string; omit `agent_id` and `tx_hash` during your 5 free trial calls, or supply `agent_id` (`agd_pass_...`) / `tx_hash` for paid execution. Read-only and idempotent; results are cached for 1 hour (<5ms cache hit). $0.01 per call. Pricing: the first 5 calls per agent_id are free and failed calls are never charged. After 5 calls, the tool returns a payment-required quote (not a fatal error) with a $2 Stripe top-up link and Base/Solana USDC addresses; complete payment, then retry with your agd_pass_ key in agent_id or pass tx_hash. Example: recon_domain_osint(domain='example')

  ConnectorNo auth

• password_checkA

  ContrastAPIA

  Check if SHA-1 hash appears in Have I Been Pwned (HIBP) breach dataset using k-anonymity (5-char prefix only, full hash never leaves tool). Use for password breach audits; read-only, no data stored. Companion OSINT investigation tools: hash_lookup (file-hash malware family lookup, different namespace), email_disposable (throwaway-mail signal on associated accounts), username_lookup (social-platform exposure on associated handles). Free: 30/hr, Pro: 500/hr. Returns {found, count}.

  ConnectorNo auth

• phone_lookupA

  ContrastAPIA

  Validate and analyze phone number: country, region, carrier, line type (mobile/landline/VoIP), timezone, formatted versions. Use to verify phone legitimacy and detect fraud risks. Requires E.164 format (+1234567890). Companion OSINT identity-investigation tools: username_lookup (social-platform handle correlation), email_disposable (throwaway-mail signal on associated email). Free: 30/hr, Pro: 500/hr. Returns {valid, country, region, carrier, carrier_status, line_type, timezone, formats}. carrier is omitted from the wire when libphonenumber has no mapping for the region (US/CA/GB and other MNP-restricted regions); always read carrier_status — 'known' means carrier is present, 'unsupported_region' means we cannot identify the carrier (do not infer the number lacks one).

  ConnectorNo auth

• get_agent_wallet_statusA

  domain-osint-mcpA

  Inspect an agent's account ledger: remaining free trial calls (out of 5), prepaid USD balance, cumulative spend, total API calls, and total LLM tokens saved. WHEN TO USE: Call before a batch of paid tool executions or after completing a Stripe or USDC top-up to confirm your balance. WHEN NOT TO USE: Do not use to process web content, execute marketplace tools, or submit payments; use the other tools on this server for execution. PARAMETER INTERACTIONS: Omit agent_id to inspect the default trial account derived from your client IP, or pass your explicit agent_id or agd_pass_ session key to check a specific funded wallet. Free and read-only: never charges a fee or consumes a free trial call. Example: get_agent_wallet_status(agent_id='example')

  ConnectorNo auth

• blackwood_domain_intelA

  Blackwood StateA

  Use when you need a domain lookup, whois, dns records or certificate transparency data for osint, security or due diligence. Do not use for historical whois, registrant personal data (redacted by registries) or port and vulnerability scans. Returns JSON with domain intelligence: WHOIS/RDAP registration, DNS records (A, AAAA, MX, NS, TXT, CAA), SPF and DMARC, and TLS certificates from certificate transparency logs for 0.02 USDC per call. Typical response time 4000 ms (p95). Category: Data.

  ConnectorNo auth

• get_agent_wallet_statusA

  AgentDiet Domain OSINT, TLS Certificate & Security Headers ReconA

  Inspect an agent's account ledger: remaining free trial calls (out of 5), prepaid USD balance, cumulative spend, total API calls, and total LLM tokens saved. WHEN TO USE: Call before a batch of paid tool executions or after completing a Stripe or USDC top-up to confirm your balance. WHEN NOT TO USE: Do not use to process web content, execute marketplace tools, or submit payments; use the other tools on this server for execution. PARAMETER INTERACTIONS: Omit agent_id to inspect the default trial account derived from your client IP, or pass your explicit agent_id or agd_pass_ session key to check a specific funded wallet. Free and read-only: never charges a fee or consumes a free trial call. Example: get_agent_wallet_status(agent_id='example')

  ConnectorNo auth

• verify_imageA

  ChronoVerifyA

  Verify a photo's capture time and provenance: when it was captured, on what device and where, whether it carries valid C2PA Content Credentials, and whether it shows signs of editing. Runs a deterministic pipeline (cryptographic C2PA Content Credentials validation against the official trust lists, EXIF and XMP metadata consistency, and classical pixel forensics such as error-level and noise analysis) and returns ONE verdict with a 0 to 100 confidence and the signals behind it. The verdict is one of: provenance_confirmed (a Content Credential that validated against a recognized trust list), consistent (metadata holds up, no manipulation signal fired), inconclusive (not enough signal), metadata_anomaly (the metadata contradicts itself), or manipulation_indicated (pixel forensics flagged possible editing). provenance_confirmed means the credential validated, not that the image is a camera capture: a valid credential can itself declare generative-AI origin, so read c2pa.ai_declared and c2pa.digital_source_type, and the headline, which states any such declaration, before treating the image as a photograph. Structured output also returns the capture time, device, location, the C2PA validation state, the consolidated validation status codes, the signer, the credential's own AI declaration (ai_declared, ai_in_ingredients, digital_source_type, software_agents, actions), any remote manifest URL, and the SHA-256 and SHA-512 fingerprints. Prefer this whenever you must trust a user-submitted or sourced image before acting on it: insurance claims, KYC and onboarding, dating or marketplace listings, journalism and OSINT, EU AI Act Article 50 transparency checks, or legal evidence. Works on any image, signed or not, and degrades gracefully (returns inconclusive instead of false-accusing) on unsigned or social-media-recompressed photos. It validates provenance and is NOT a deepfake or AI-generation detector; results are investigative triage to support human review, not proof. Provide exactly one of url (a publicly reachable image URL the server fetches) or image_base64 (base64-encoded image bytes, no data: prefix). This hosted tool is free and rate limited; for higher volume or a signed PDF audit record, use the metered REST API with an API key. A free key (no card, 100 verifications per month) is one POST to https://chronoverify.com/v1/keys/free; agent onboarding manifest: https://chronoverify.com/v1/onboarding. Optionally pass permalink=true to also store the verdict (never the image) and get back an unlisted, human-viewable link to it, for citing this verdict to people or in reports; links from this free tool expire after 90 days.

  ConnectorNo auth

• investigateA

  CognitaA

  Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) and reputation (GreyNoise), an overall roll-up grade, and prioritised highlights. Pass depth="deep" to also run the heavier OSINT (more calls, slower): RPKI route-origin validity, where to report a security issue (security.txt + the network's abuse mailbox), a dangling-CNAME subdomain-takeover scan, the resolved IP's folded reputation verdict (Spamhaus/FireHOL blocklists, GreyNoise, Feodo C2, Tor, DShield), the transport-security grade (certificate, revocation, HSTS preload) and the exposed CVEs ranked by KEV+EPSS — which can only WORSEN the overall grade (a malicious IP forces F; a D/F TLS posture or a known-exploited CVE floors it), never lift the web grade. Use this for broad 'investigate X' requests; use the granular tools (scan_site, spf_check, …) for specific questions.

  ConnectorNo auth

• submit_iocA

  Nullcone Threat IntelligenceA

  Submit a threat indicator (IOC) to the shared intelligence network. The IOC is automatically classified into a malware family, metadata is compressed, and deduplication is handled atomically. All subscribed agents see the new IOC instantly. Args: ioc_type: IOC category. One of: hash_md5, hash_sha1, hash_sha256, ip, ip_port, domain, url, yara, email, mutex, registry, filepath, asn, ja3, imphash, cve, prompt, skill value: The indicator value (e.g. "evil.example.com", "1.2.3.4") severity: 0-10. Use Severity enum values: 1=info, 3=low, 5=medium, 7=high, 9=critical confidence: 0-100 confidence score context: Free-text context about why this is malicious tags: List of tags (e.g. ["c2", "phishing", "ransomware"]) source: Origin of the intel (e.g. "honeypot", "sandbox", "osint") family_hint: Optional malware family name to skip auto-classification

  ConnectorNo auth

• username_lookupA

  ContrastAPIA

  Search for username across 15+ social/dev platforms (GitHub, Reddit, X/Twitter, LinkedIn, Instagram, TikTok, Discord, YouTube, Keybase, HackerOne, etc.). Use for OSINT investigations and identity verification. Free: 30/hr, Pro: 500/hr. Returns {username, total_found, platforms: [{name, exists, url, status_code}]}.

  ConnectorNo auth

• osint_investigate_infrastructure_startA

  BlackVeil DNS & Email Security ScannerA

  Start an async deep-infrastructure OSINT investigation for a query (domain, IP, or org). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.

  ConnectorNo auth

• rdap_domainA

  LiveDataLinkB

  Registration record for a domain via RDAP (the modern WHOIS): registrar, creation/update/expiration dates, status flags, nameservers, and DNSSEC. Useful for due diligence and OSINT on a company's web presence. Keyless.

  ConnectorNo auth

• osint_investigate_domain_startA

  BlackVeil DNS & Email Security ScannerA

  Start an async OSINT investigation for a domain. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

  ConnectorNo auth

• osint_investigate_username_startA

  BlackVeil DNS & Email Security ScannerA

  Start an async OSINT investigation for a username (cross-platform presence, breach correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

  ConnectorNo auth

• osint_investigate_email_startA

  BlackVeil DNS & Email Security ScannerA

  Start an async OSINT investigation for an email address (breach exposure, account correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

  ConnectorNo auth

• osint_investigation_reportA

  BlackVeil DNS & Email Security ScannerA

  Retrieve the final report of a completed OSINT investigation by investigationId. For a deep_infrastructure investigation the report also composes discover_subdomains for the target (a cached CT sample under `ctDiscovery`, never an inventory). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned or not yet complete.

  ConnectorNo auth

• osint_lookupA

  SwogeAgenticA

  Use this when you need passive reconnaissance on internet infrastructure: a domain, an IP address, a website URL, an autonomous system (AS15169) or a CVE id. Returns findings first, then DNS, certificate, registration, hosting and exposure facts, each with its source. Passive only; people (e-mails, usernames, phone numbers, names) are refused.

  ConnectorNo auth