mcp-name: io.github.OpenOSINT/openosint
Featured Integrations
IP2Location.io — powers search_ip2location · Integration guide
Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection
RapidProxy · Integration guide
Reliable Residential Proxies for Data Collection & Automation — 90M+ IPs across 200+ countries. 10% off: RAPID10.
TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.
Open: Breach / Compromised-Credential Data · Email / Identity Lookup — see SPONSORSHIP.md.
pip install openosint
Paid: Complete Kit — $55 (prompts + playbook, bundled) · Setup Sprint — $350 (done-for-you install) · Commercial License — from €300/yr (vendor contract, SLA, indemnification)
Quick Start
# Interactive AI REPL (default)
openosint
# Web interface
openosint web
# Direct tool (no AI)
openosint email target@example.com
New to OSINT methodology? Grab the free 5-prompt starter set or the free Playbook edition before your first run.
📬 Agents & OSINT — the newsletter
One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe →
Run in the cloud (no install)
No Python, no holehe / sherlock / sublist3r / phoneinfoga binaries in PATH, no API keys — run OpenOSINT Email Recon from your browser, or as an MCP tool in Claude, Cursor, and Windsurf via the Apify MCP Server. Try for free.
Try OpenOSINT Email Recon on Apify →
Usage
Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:
openosint > investigate target@example.com
-> generate_dorks('target@example.com')
-> search_email('target@example.com')
Found: Spotify, WordPress, Gravatar, Office365
-> search_breach('target@example.com')
Found in 2 breaches: LinkedIn (2016), Adobe (2013)
-> search_username('johndoe99') <- pivoted from email findings
Found: GitHub, Reddit, Twitter
Report saved -> reports/2026-05-11_14-32-11_report.md
Features
| Capability | Details |
|---|---|
| AI tool chaining | The agent selects and chains tools based on findings; describe the target in plain language |
| 19 modular tools | Email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, live dork search, URL scraping, SERP footprint |
| Three AI backends | Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...) |
| Native MCP server | All 19 tools exposed to Claude Code, Claude Desktop, and any MCP-compatible client — no extra config |
| Parallel execution | --parallel runs complementary tools concurrently via asyncio.gather() |
| Reports | PDF + Markdown auto-saved after every investigation (reportlab optional) |
| Session history | All REPL sessions saved to ~/.openosint/history/; browse with openosint history |
| Web UI | Browser-based AI chat with streaming output, tool cards, light/dark theme |
Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.
Custom Integrations
Need OpenOSINT wired into your SOC, fraud, threat-intel, or AI-agent stack? I build bespoke OSINT integrations for teams — you bring the data sources and compliance requirements, I deliver a working integration.
Tools
| Tool | Powered by | What it investigates |
|---|---|---|
search_email |
holehe | Social accounts linked to an email address |
search_username |
sherlock | Username presence across 300+ platforms |
search_breach |
HaveIBeenPwned v3 API | Data breach exposure |
search_whois |
python-whois | Domain registrant and DNS info |
search_ip |
ipinfo.io | Geolocation, ASN, hostname |
search_domain |
sublist3r | Subdomain enumeration |
generate_dorks |
built-in | 12 targeted Google dork URLs (no network calls) |
search_paste |
psbdmp.ws | Pastebin dump mentions |
search_phone |
phoneinfoga | Carrier, country, line type |
search_shodan |
Shodan API | Open ports, banners, CVEs |
search_virustotal |
VirusTotal API v3 | Verdict from 70+ antivirus engines |
search_ip2location |
IP2Location.io API | Enhanced IP intel: VPN/Proxy/Tor/datacenter flags (sponsored) |
search_censys |
Censys Search API | Internet-facing infrastructure, certificates |
search_abuseipdb |
AbuseIPDB v2 API | IP abuse reputation: confidence score, reports, country, ISP |
search_github |
GitHub REST API | Profile, repos, commit-discovered emails, username/keyword search |
search_dns |
dnspython (built-in) | A/AAAA/MX/NS/TXT/CNAME/SOA records; SPF, DMARC, DKIM analysis |
search_dorks_live |
Bright Data SERP API | Live Google search results for dork queries (title, URL, snippet) |
scrape_url |
Bright Data Web Unlocker | Fetch any URL bypassing Cloudflare/CA |