OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

<div align="center"> <img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/docs/logo.svg" alt="OpenOSINT" width="200" /> <h1>OpenOSINT</h1> <p>OSINT agent for security researchers and analysts: 19 investigation tools behind a natural-language interface.</p> <p>Use it as a REPL, CLI, MCP server, or browser Web UI.</p> <p><em>The AI issues hard-stop tool calls; your code executes the real binary — hallucinated findings are structurally impossible.</em></p> </div> <div align="center">

</div> <!-- SPONSORS:START -->

Featured Integrations

<a href="https://www.ip2location.io/?utm_source=openosint&utm_medium=readme&utm_campaign=ip2location" rel="noopener sponsored"><img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/ip2location-logo.png" alt="IP2Location.io logo" height="40"></a>

IP2Location.io — powers search_ip2location · Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

<a href="https://www.rapidproxy.io/?ref=openosint&utm_source=openosint&utm_medium=readme&utm_campaign=rapidproxy" rel="noopener sponsored"><img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/rapidproxy.png" alt="RapidProxy logo" height="40"></a>

RapidProxy · Integration guide

Reliable Residential Proxies for Data Collection & Automation — 90M+ IPs across 200+ countries. 10% off: RAPID10.

Open: Breach / Compromised-Credential Data · Email / Identity Lookup — see SPONSORSHIP.md.

<!-- SPONSORS:END --> <div align="center"> <a href="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/demo/demo.mp4"> <img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/demo/demo.gif" alt="OpenOSINT running a DNS lookup and returning records in under two seconds" width="800" /> </a> </div>

pip install openosint

Paid: Complete Kit — $55 (prompts + playbook, bundled) · Setup Sprint — $350 (done-for-you install) · Commercial License — from €300/yr (vendor contract, SLA, indemnification)

Quick Start

# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

New to OSINT methodology? Grab the free 5-prompt starter set or the free Playbook edition before your first run.

📬 Agents & OSINT — the newsletter

One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe →

Run in the cloud (no install)

No Python, no holehe / sherlock / sublist3r / phoneinfoga binaries in PATH, no API keys — run OpenOSINT Email Recon from your browser, or as an MCP tool in Claude, Cursor, and Windsurf via the Apify MCP Server. Try for free.

Try OpenOSINT Email Recon on Apify →

Usage

Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_email('target@example.com')
  Found: Spotify, WordPress, Gravatar, Office365

  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_username('johndoe99')   <- pivoted from email findings
  Found: GitHub, Reddit, Twitter

  Report saved -> reports/2026-05-11_14-32-11_report.md

Features

| Capability | Details | |---|---| | AI tool chaining | The agent selects and chains tools based on findings; describe the target in plain language | | 19 modular tools | Email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, live dork search, URL scraping, SERP footprint | | Three AI backends | Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...) | | Native MCP server | All 19 tools exposed to Claude Code, Claude Desktop, and any MCP-compatible client — no extra config | | Parallel execution | --parallel runs complementary tools concurrently via asyncio.gather() | | Reports | PDF + Markdown auto-saved after every investigation (reportlab optional) | | Session history | All REPL sessions saved to ~/.openosint/history/; browse with openosint history | | Web UI | Browser-based AI chat with streaming output, tool cards, light/dark theme |

---

Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Custom Integrations

Need OpenOSINT wired into your SOC, fraud, threat-intel, or AI-agent stack? I build bespoke OSINT integrations for teams — you bring the data sources and compliance requirements, I deliver a working integration.

→ Get in touch

---

Tools

| Tool | Powered by | What it investigates | |------|-----------|---------------------| | search_email | holehe | Social accounts linked to an email address | | search_username | sherlock | Username presence across 300+ platforms | | search_breach | HaveIBeenPwned v3 API | Data breach exposure | | search_whois | python-whois | Domain registrant and DNS info | | search_ip | ipinfo.io | Geolocation, ASN, hostname | | search_domain | sublist3r | Subdomain enumeration | | generate_dorks | built-in | 12 targeted Google dork URLs (no network calls) | | search_paste | psbdmp.ws | Pastebin dump mentions | | search_phone | phoneinfoga | Carrier, country, line type | | search_shodan | Shodan API | Open ports, banners, CVEs | | search_virustotal | VirusTotal API v3 | Verdict from 70+ antivirus engines | | search_ip2location | IP2Location.io API | Enhanced IP intel: VPN/Proxy/Tor/datacenter flags (sponsored) | | search_censys | Censys Search API | Internet-facing infrastructure, certificates | | search_abuseipdb | AbuseIPDB v2 API | IP abuse reputation: confidence score, reports, country, ISP | | search_github | GitHub REST API | Profile, repos, commit-discovered emails, username/keyword search | | search_dns | dnspython (built-in) | A/AAAA/MX/NS/TXT/CNAME/SOA records; SPF, DMARC, DKIM analysis | | search_dorks_live | Bright Data SERP API | Live Google search results for dork queries (title, URL, snippet) | | scrape_url | Bright Data Web Unlocker | Fetch any URL bypassing Cloudflare/CAPTCHA — returns clean Markdown | | search_footprint | Bright Data SERP API | Entity-type-aware public search-engine footprint: detects email/username/domain/phone/name and returns structured results + Entity Correlation Graph nodes/edges |

Full per-tool documentation, CLI flags, and output formats: openosint.tech.

search_email

Enumerates online services linked to an email address using holehe.

openosint email target@example.com

[+] Spotify        https://open.spotify.com/user/target
[+] WordPress      https://wordpress.com/target
[+] Gravatar       https://gravatar.com/target
[+] Office365      email used

search_username

Searches for a username across 300+ platforms using sherlock.

openosint username johndoe99

[+] GitHub         https://github.com/johndoe99
[+] Twitter        https://twitter.com/johndoe99
[+] Reddit         https://reddit.com/user/johndoe99

search_breach

Checks data breach exposure via HaveIBeenPwned v3 API. Requires HIBP_API_KEY.

[+] LinkedIn (2016-05-05) — leaked: Email addresses, Passwords
[+] Adobe (2013-10-04) — leaked: Email addresses, Password hints

search_whois

Retrieves WHOIS data using python-whois.

[+] Registrar: ICANN
[+] Created: 1995-08-14
[+] Expires: 2024-08-13
[+] Name Servers: A.IANA-SERVERS.NET

search_ip

Retrieves geolocation and ASN data via ipinfo.io. Free tier: 50k/month.

[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View, CA, US

search_domain

Enumerates subdomains using sublist3r.

[+] mail.example.com
[+] dev.example.com
[+] api.example.com

generate_dorks

Generates 12 targeted Google dork URLs for any target. No network calls.

[+] "johndoe" site:linkedin.com
    https://www.google.com/search?q=%22johndoe%22+site%3Alinkedin.com
[+] "johndoe" leaked OR breach OR dump
    https://www.google.com/search?q=%22johndoe%22+leaked+OR+breach+OR+dump

search_paste

Searches Pastebin dumps via psbdmp.ws.

[+] https://pastebin.com/aB1cD2eF (2023-04-12)
[+] https://pastebin.com/xY3zA4bC (2022-11-08)

search_phone

Gathers phone intelligence using phoneinfoga. Use E.164 format.

[+] Country: United States
[+] Carrier: AT&T
[+] Line type: Mobile

search_shodan

IPv4 input → host lookup (open ports, org, CVEs). Any other query → banner/keyword search. Requires SHODAN_API_KEY.

openosint shodan 8.8.8.8
openosint shodan "apache port:80 country:DE"

[+] Org: Google LLC  |  Open ports: 53, 443

search_virustotal

Checks an IP, domain, URL, or file hash against VirusTotal's 70+ engines. Auto-detects input type. Requires `VIRUSTOTAL_API_