# clearfront

Hands your agent 30 OSINT tools for emails, domains, IPs and breach data. Runs locally, so queries go only to the APIs you pick.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 10
- Author: scottmartinanderson
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/scottmartinanderson/clearfront
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/mcp/clearfront

## What it does

clearfront is an MCP server for open-source intelligence work. Hand it an email, a username, a domain, an IP or a person's name, and the agent runs a sweep across public sources, then returns a report plus a graph of the links it found.

The 30 tools cover account enumeration by email and username, subdomain discovery through certificate transparency, old URL recovery from the Wayback Machine, breach lookups, WHOIS, EXIF metadata with GPS, Shodan, VirusTotal, Censys, AbuseIPDB, GitHub secret exposure, and dork generation with live search. Tool output comes from real subprocess calls, not from the model. Several tools depend on external binaries in `PATH`: `holehe`, `sherlock`, `sublist3r`, `phoneinfoga`, `theHarvester`. Miss one and that single tool returns an error while the rest keep working.

Keys live in a `.env` file at the project root, loaded by `python-dotenv` on startup. The agent itself needs `ANTHROPIC_API_KEY`, a local Ollama model, or any OpenAI-compatible endpoint. Keys for `HIBP_API_KEY`, `SHODAN_API_KEY`, `VIRUSTOTAL_API_KEY` and the rest are optional, though tools tied to them stay idle without one. Use is limited to legal, authorized investigations, and that responsibility sits with you.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `HIBP_API_KEY`, `IPINFO_TOKEN`, `SHODAN_API_KEY`, `VIRUSTOTAL_API_KEY`, `ANTHROPIC_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add clearfront -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfront
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>

### Codex

**Platform CLI**
```bash
codex mcp add clearfront --env HIBP_API_KEY=<HIBP_API_KEY> --env IPINFO_TOKEN=<IPINFO_TOKEN> --env SHODAN_API_KEY=<SHODAN_API_KEY> --env VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> --env ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -- uvx clearfront
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "clearfront": {
            "command": "uvx",
            "args": [
                "clearfront"
            ],
            "env": {
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "IPINFO_TOKEN": "<IPINFO_TOKEN>",
                "SHODAN_API_KEY": "<SHODAN_API_KEY>",
                "VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>",
                "ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "clearfront": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "clearfront"
            ],
            "env": {
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "IPINFO_TOKEN": "<IPINFO_TOKEN>",
                "SHODAN_API_KEY": "<SHODAN_API_KEY>",
                "VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>",
                "ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e SHODAN_API_KEY=<SHODAN_API_KEY> -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> clearfront uvx clearfront
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from clearfront <command>

## When to use it
- check which accounts sit behind a work email
- map a domain's subdomains via certificate transparency
- see whether an IP shows up in attack or abuse feeds
- pull GPS coordinates out of photo metadata
- build a link graph from the data you found

## Example prompts
- Run an OSINT sweep on `target@example.com` and show me the report
- Find subdomains of `example.com` and check them against Shodan
- Look up the username `someuser` across public sites and build the evidence graph

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md