# OpenOSINT

Connects 21 OSINT tools for domain, IP, breach, and DNS lookups directly to your model. Useful for external reconnaissance and security audits.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1802
- Author: OpenOSINT
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/OpenOSINT/OpenOSINT
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/openosint

## What it does

OpenOSINT provides an MCP server backed by 21 modular OSINT tools for external security analysis. The server runs passive lookups by default, exposing 16 investigation tools alongside batch and entity-graph helpers. It queries DNS, WHOIS, RDAP, and breach datasets while chaining tools based on discovered leads.

The server runs via `uvx` without needing a local virtual environment. High-volume scrapers such as username searches via `sherlock` remain disabled unless started with `--allow-active`. Without API keys for services like HaveIBeenPwned, IP2Location, or AbuseIPDB, checks depending on those services will fail to return data.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `ANTHROPIC_API_KEY`, `HIBP_API_KEY`, `IPINFO_TOKEN`, `IP2LOCATION_API_KEY`, `ABUSEIPDB_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add openosint -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosint
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>

### Codex

**Platform CLI**
```bash
codex mcp add openosint --env ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> --env HIBP_API_KEY=<HIBP_API_KEY> --env IPINFO_TOKEN=<IPINFO_TOKEN> --env IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> --env ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -- uvx openosint
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "openosint": {
            "command": "uvx",
            "args": [
                "openosint"
            ],
            "env": {
                "ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>",
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "IPINFO_TOKEN": "<IPINFO_TOKEN>",
                "IP2LOCATION_API_KEY": "<IP2LOCATION_API_KEY>",
                "ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "openosint": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "openosint"
            ],
            "env": {
                "ANTHROPIC_API_KEY": "<ANTHROPIC_API_KEY>",
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "IPINFO_TOKEN": "<IPINFO_TOKEN>",
                "IP2LOCATION_API_KEY": "<IP2LOCATION_API_KEY>",
                "ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e ANTHROPIC_API_KEY=<ANTHROPIC_API_KEY> -e HIBP_API_KEY=<HIBP_API_KEY> -e IPINFO_TOKEN=<IPINFO_TOKEN> -e IP2LOCATION_API_KEY=<IP2LOCATION_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> openosint uvx openosint
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from openosint <command>

## When to use it
- inspect WHOIS, RDAP, and DNS records for target domains
- query HaveIBeenPwned for compromised email accounts
- resolve IP geolocation and abuse reports using IP2Location and AbuseIPDB
- chain passive reconnaissance steps into a unified markdown report

## Example prompts
- Investigate example.com by checking its DNS records and WHOIS registrations
- Check if user@example.com appears in known data breaches
- Gather passive IP and network threat data for target host 192.0.2.1

## Similar
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [bernstein](https://affpapa.org/en/nevibecode/mcp/bernstein.md) — MCP server · ★ 1331
- [Kody](https://affpapa.org/en/nevibecode/mcp/kody.md) — MCP server · ★ 851
- [skylos](https://affpapa.org/en/nevibecode/mcp/skylos.md) — MCP server · ★ 849
- [Attestix](https://affpapa.org/en/nevibecode/mcp/attestix.md) — MCP server · ★ 837

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md