clearfront — Claude Code MCP server: OSINT footprint checks
Hands your agent 30 OSINT tools for emails, domains, IPs and breach data. Runs locally, so queries go only to the APIs you pick.
claude mcp add clearfront -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfrontWhat clearfront does
clearfront is an MCP server for open-source intelligence work. Hand it an email, a username, a domain, an IP or a person's name, and the agent runs a sweep across public sources, then returns a report plus a graph of the links it found.
The 30 tools cover account enumeration by email and username, subdomain discovery through certificate transparency, old URL recovery from the Wayback Machine, breach lookups, WHOIS, EXIF metadata with GPS, Shodan, VirusTotal, Censys, AbuseIPDB, GitHub secret exposure, and dork generation with live search. Tool output comes from real subprocess calls, not from the model. Several tools depend on external binaries in PATH: holehe, sherlock, sublist3r, phoneinfoga, theHarvester. Miss one and that single tool returns an error while the rest keep working.
Keys live in a .env file at the project root, loaded by python-dotenv on startup. The agent itself needs ANTHROPIC_API_KEY, a local Ollama model, or any OpenAI-compatible endpoint. Keys for HIBP_API_KEY, SHODAN_API_KEY, VIRUSTOTAL_API_KEY and the rest are optional, though tools tied to them stay idle without one. Use is limited to legal, authorized investigations, and that responsibility sits with you.
What it helps with
- check which accounts sit behind a work email
- map a domain's subdomains via certificate transparency
- see whether an IP shows up in attack or abuse feeds
- pull GPS coordinates out of photo metadata
- build a link graph from the data you found
Example prompts for the agent
- Run an OSINT sweep on
[email protected]and show me the report - Find subdomains of
example.comand check them against Shodan - Look up the username
someuseracross public sites and build the evidence graph
How to install clearfront
Platform CLI
claude mcp add clearfront -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfrontReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>
Platform CLI
codex mcp add clearfront --env HIBP_API_KEY=<HIBP_API_KEY> --env IPINFO_TOKEN=<IPINFO_TOKEN> --env SHODAN_API_KEY=<SHODAN_API_KEY> --env VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> --env ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfrontReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>
Config file
{
"mcpServers": {
"clearfront": {
"command": "uvx",
"args": [
"clearfront"
],
"env": {
"HIBP_API_KEY": "<HIBP_API_KEY>",
"IPINFO_TOKEN": "<IPINFO_TOKEN>",
"SHODAN_API_KEY": "<SHODAN_API_KEY>",
"VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>",
"ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>
Config file
{
"servers": {
"clearfront": {
"type": "stdio",
"command": "uvx",
"args": [
"clearfront"
],
"env": {
"HIBP_API_KEY": "<HIBP_API_KEY>",
"IPINFO_TOKEN": "<IPINFO_TOKEN>",
"SHODAN_API_KEY": "<SHODAN_API_KEY>",
"VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>",
"ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>
Platform CLI
gemini mcp add -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> clearfront uvx clearfrontReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about clearfront
How do I install clearfront in Claude Code?
Run `claude mcp add clearfront -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfront`, swapping in your own keys.
What does clearfront do?
It is an MCP server for open-source intelligence. Give it an email, username, domain, IP or name and it runs 30 tools over that input, returning a report and an evidence graph.
What does clearfront need to run?
Python 3.10+ and a key for one AI backend: Anthropic, local Ollama, or an OpenAI-compatible endpoint. Some tools also need external binaries in PATH and service keys such as Shodan or VirusTotal.
