Awesome OSINT MCP Servers

A curated list of MCP servers for OSINT (Open Source Intelligence).

An MCP server connects tools and services to LLM systems like Claude, Cursor, Windsurf, etc.
MCP servers simplify execution of OSINT tools by combining them with the ease of LLM querying
and the ability to create flexible reports.

Legend: 📦 Open Source  ·  🆓 Free / Has Free Tier  ·  💰 Paid / Requires Paid API

Contents

• SOCMINT
• Network Scanning
• Web Scraping
• Company Intelligence
• Public Records & Compliance
• Threat Intelligence
• Geospatial & Geopolitical Intelligence
• Research Intelligence
• Meta / Discovery
• Blockchain Intelligence
• Market & Trading

SOCMINT

• 💰 Expose Team — AI-powered OSINT at lightspeed. Credit-based plans from $8/month.
• 📦🆓 Maigret — Collect user account information from various public sources by username.
• 📦💰 Xquik — X (Twitter) data extraction and automation with 40+ REST API endpoints, real-time account monitoring, and trending topics. MCP server with API key auth.
• 📦🆓 OSINT Tools MCP — Wraps seven classic OSINT CLIs behind one server: Sherlock and Blackbird (usernames), Maigret, Holehe (email), GHunt (Google accounts), theHarvester (domains) and SpiderFoot. Python, installs the underlying tools itself.
• 📦🆓 LinkedIn MCP — Search LinkedIn people, companies and jobs, and pull structured profile, company and post data. Uses your own session cookie; no API key.
• 🆓💰 BulkTranscripts — YouTube channel uploads, in-channel topic search, and full transcripts as clean text. get_latest_videos is unmetered — poll it to watch a subject's channel and spend credits only on what is new. Hosted, 7 tools, no signup; 30 free credits shared per public IP, then one-time packs. MCP: https://bulktranscripts.co/mcp

Network Scanning

• 📦🆓💰 Shodan — Query the Shodan API and CVEDB for IP reconnaissance, DNS operations, vulnerability tracking, and device discovery. Free tier available with limited queries, requires Shodan API key.
• 📦🆓💰 ZoomEye — Obtain network asset information by querying ZoomEye using dorks and other search parameters. 7-day free trial available, requires ZoomEye API key.
• 📦🆓 DNSTwist — DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
• 📦🆓 OSINT Toolkit — Unified interface for network reconnaissance with parallel execution of WHOIS, Nmap, DNS lookups, and typosquatting detection.
• 📦🆓💰 ContrastAPI — Security intelligence server with 49 tools: domain recon (DNS, WHOIS, SSL, subdomains, WAF, Wayback) plus orchestrated audit_domain, IP reputation plus orchestrated threat_report (Shodan + AbuseIPDB + ASN), CVE/EPSS/KEV lookup plus calculate_risk_score (CVSS+EPSS+KEV+PoC fusion) and bulk_cve_lookup (50/call), cve_leading (MITRE/GHSA pre-NVD), IOC enrichment plus bulk_ioc_lookup (50/call), threat intel, MITRE ATLAS (167 AI/ML attack techniques + bulk drill) and D3FEND defenses (149 techniques + coverage report), web intelligence (robots.txt, redirect chain, email validation, brand assets, SEO audit), check_dependencies (requirements.txt / package.json audit), and code security scanning. Anonymous tier + Pro tier with API key.
• 🆓💰 DomScan — Domain intelligence with DNS, WHOIS/RDAP, SSL/TLS, subdomain enumeration, certificate search, typosquatting and brand monitoring, plus domain valuation and availability. One API and MCP server; free tools with paid API tiers.
• 🆓💰 CrawlGraph — Passive web footprinting via the Common Crawl webgraph - mapping which sites reference a target, without ever touching the target (passive, no active scanning). Two tools for OSINT research: inbound linking to target and link-gap between two or more targets. npx -y crawlgraph-mcp. Free sign up for 15 targets/mo ; paid lifetime API for higher limits and link-gap research.
• 🆓💰 DomainKits — Search newly registered, expired, and dropped domains across gTLDs for phishing, typosquatting, and brand-impersonation monitoring, with WHOIS, DNS, reverse-nameserver, IP geolocation, and Google Safe Browsing lookups. Requires paid API key.
• 📦🆓 IPInfo — IP geolocation, ASN and network details, Tor exit-node checks, and interactive maps for sets of IPs via ipinfo.io. Free API token required.
• 📦💰 StackScan — Technographic lookups over 360M+ sites: what a domain is built on, who is behind it (industry, city, country, LinkedIn), and how many sites run a given technology and where. Batch domain lookup for list enrichment. Local stdio server, MIT, npx -y @stackscan/mcp-server. Charged per resolving domain; misses are not charged and check_credits is free.

Web Scraping

• 🆓💰 AnySite — Structured data access to 115+ endpoints across 40+ platforms (LinkedIn, Instagram, X, Reddit, YouTube, GitHub, Amazon, etc.) via five meta-tools. 7-day free trial with 1,000 credits.
• 📦🆓💰 Bright Data — Real-time web search, scraping, and structured data extraction from 60+ sources (Amazon, LinkedIn, TikTok, Google Maps, etc.) with CAPTCHA and anti-bot bypass. Free tier: 5,000 requests/month.
• 🆓💰 Parallel Search MCP — Web search and page-content extraction (web_search, web_fetch) for LLM agents. Default endpoint works without an API key; an account with credits is needed for production rate limits. MCP: https://search.parallel.ai/mcp
• 🆓💰 You.com — Web search and page-content extraction for LLM agents, plus managed multi-step research. The free profile works with no signup or API key; an API key adds page-content reads and research tools. MCP: https://api.you.com/mcp?profile=free
• 📦🆓 Wayback Machine MCP — Query and save Internet Archive snapshots: check archive status, fetch archived URLs, search the CDX index, and compare two snapshots of a page. No API key for reads. npx -y mcp-wayback-machine
• 📦🆓💰 Singapore Proxy MCP — Fetch pages and run Google searches (gl=sg) from a real Singapore mobile IP on Singtel or M1, and rotate the IP on demand, to see what Singapore users are served. Requires an API key; 24-hour free trial, then paid. MCP: https://mcp.singaporemobileproxy.com/mcp

Company Intelligence

• 📦🆓💰 CompanyScope — Company intelligence aggregating data from 8 public sources (Wikipedia, SEC EDGAR, OpenCorporates, RDAP, GitHub, and more) for corporate reconnaissance. Free tier 25 calls/day, pay-per-use tier on Apify.
• 📦🆓 StockScope — SEC EDGAR financial intelligence for stock research. Revenue, net income, margins, filings, and company comparisons for any US public company. Free, no API key needed.
• 🆓💰 FilingFirehose — Hosted SEC EDGAR MCP for any US ticker: 8-K body-text parsing (catches buried items beyond what the filer reported), 10-K / 10-Q / S-3 / Schedule 13D reads, forensic risk scoring (LOW/MODERATE/ELEVATED/HIGH), and cyber-incident tracking. Free public endpoints + paid tiers from $9/mo. MCP: https://filingfirehose.com/mcp
• 📦🆓💰 OpenSOSData — US business entity search across all 53 Secretary of State jurisdictions (50 states, DC, Puerto Rico, US Virgin Islands): name search, status checks and batch lookups over a 33M-entity index. First 10 lookups free on signup, then from $0.0314 each. npx -y @opensosdata/mcp-server
• 🆓💰 OpenRegistry — Real-time access to 27 national corporate registries worldwide (UK Companies House, France Sirene, Germany Handelsregister, South Korea OPENDART, Australia ABR, Canada Corporations, etc.) via a unified JSON schema. Returns company profiles, officers, shareholders, beneficial ownership, filings, and raw documents. Free tier: 20 rpm without signup, 30 rpm with email. Paid up to $29/mo. OAuth 2.1, no API keys.
• 📦💰 Checko MCP — Unofficial wrapper for the Russian Checko.ru API: verify counterparties (companies, sole proprietors, individuals) via EGRUL/EGRIP, arbitration cases, government contracts (44-FZ/223-FZ), Rosstat financials, inspections, Fedresurs and EFRSB bankruptcy records. 12 tools and 6 ready-made workflow prompts. Requires paid CHECKO_API_KEY.
• 🆓 Fylings — African company intelligence across 18+ official national registries (Nigeria's CAC, Tanzania's BRELA, Mauritius's CBRD, Senegal's RCCM, and more