OpenOSINT — Claude Code MCP server: what it does, how to install
Connects 21 OSINT tools for domain, IP, breach, and DNS lookups directly to your model. Useful for external reconnaissance and security audits.
claude mcp add openosint -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosintWhat OpenOSINT does
OpenOSINT provides an MCP server backed by 21 modular OSINT tools for external security analysis. The server runs passive lookups by default, exposing 16 investigation tools alongside batch and entity-graph helpers. It queries DNS, WHOIS, RDAP, and breach datasets while chaining tools based on discovered leads.
The server runs via uvx without needing a local virtual environment. High-volume scrapers such as username searches via sherlock remain disabled unless started with --allow-active. Without API keys for services like HaveIBeenPwned, IP2Location, or AbuseIPDB, checks depending on those services will fail to return data.
What it helps with
- inspect WHOIS, RDAP, and DNS records for target domains
- query HaveIBeenPwned for compromised email accounts
- resolve IP geolocation and abuse reports using IP2Location and AbuseIPDB
- chain passive reconnaissance steps into a unified markdown report
Example prompts for the agent
- Investigate example.com by checking its DNS records and WHOIS registrations
- Check if [email protected] appears in known data breaches
- Gather passive IP and network threat data for target host 192.0.2.1
How to install OpenOSINT
Platform CLI
claude mcp add openosint -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosintReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>
Platform CLI
codex mcp add openosint --env ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> --env HIBP_API_KEY=<HIBP_API_KEY> --env IPINFO_TOKEN=<IPINFO_TOKEN> --env IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> --env ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosintReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>
Config file
{
"mcpServers": {
"openosint": {
"command": "uvx",
"args": [
"openosint"
],
"env": {
"ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>",
"HIBP_API_KEY": "<HIBP_API_KEY>",
"IPINFO_TOKEN": "<IPINFO_TOKEN>",
"IP2LOCATION_API_KEY": "<IP2LOCATION_API_KEY>",
"ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>
Config file
{
"servers": {
"openosint": {
"type": "stdio",
"command": "uvx",
"args": [
"openosint"
],
"env": {
"ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>",
"HIBP_API_KEY": "<HIBP_API_KEY>",
"IPINFO_TOKEN": "<IPINFO_TOKEN>",
"IP2LOCATION_API_KEY": "<IP2LOCATION_API_KEY>",
"ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>
Platform CLI
gemini mcp add -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> openosint uvx openosintReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about OpenOSINT
How do I install OpenOSINT in Claude Code?
Run `claude mcp add openosint -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosint`.
What does OpenOSINT do?
It exposes 21 OSINT investigation tools to AI assistants for checking domains, IPs, DNS entries, and leaked accounts.
Are active scans enabled by default?
No, the server enables 16 passive tools by default, while noisy lookups like social account discovery require the --allow-active flag.
