OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

<div align="center"> <img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/docs/logo.svg" alt="OpenOSINT" width="200" /> <h1>OpenOSINT</h1> <p>An OSINT (Open Source Intelligence) agent for security researchers and analysts: 20 investigation tools behind a natural-language interface, plus an MCP (Model Context Protocol) server so any MCP-compatible AI client can drive them directly.</p> <p>Use it as a REPL, CLI, MCP server, or browser Web UI.</p> <p><em>The AI issues hard-stop tool calls; your code executes the real binary — hallucinated findings are structurally impossible.</em></p> </div> <div align="center">

</div>

Self-host (free, MIT)

pip install openosint

# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

<div align="center"> <a href="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/demo/demo.mp4"> <img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/demo/demo.gif" alt="OpenOSINT running a DNS lookup and returning records in under two seconds" width="800" /> </a> </div>

Try the live demo → — bring your own Anthropic / OpenRouter / Ollama key, no signup.

Cloud or self-host? Cloud: zero setup, pay per call, hosted by us. Self-host: free forever, your own API keys, full control.

📬 Agents & OSINT — the newsletter

One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe →

Investigation results land live on the globe — click a point to pivot. Watch the sharper MP4.

<div align="center"> <img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/demo/graph-web-demo.gif" alt="Graph web UI demo (synthetic data): the entity graph explorer shows two Organization nodes observed independently by the openosint:github and openosint:whois datasets, linked by a dashed same_as candidate edge scored 0.83; clicking a node opens a side panel listing each statement with its dataset, extractor, run id, and confidence; clicking the dashed edge opens the human review card comparing both entities field by field — matching values green, differing values amber — with the name-match feature explanation that produced the score; the reviewer clicks Accept and the graph updates in place: the pair clusters and the edge becomes a solid same_as check" width="900" /> <p><em>Deterministic, synthetic-data demo — every entity shown is fictional; regenerate with <a href="demo/web_demo.py">demo/web_demo.py</a>.<br> The entities are seeded at the statement layer, not produced by today's mappers — see <a href="demo/README.md">demo/README.md</a>.</em></p> </div> <!-- SPONSORS:START -->

Featured Integrations

<a href="https://www.ip2location.io/?utm_source=openosint&utm_medium=readme&utm_campaign=ip2location" rel="noopener sponsored"><img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/ip2location-logo.png" alt="IP2Location.io logo" height="40"></a>

IP2Location.io — powers search_ip2location · Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

<a href="https://www.rapidproxy.io/?ref=openosint&utm_source=openosint&utm_medium=readme&utm_campaign=rapidproxy" rel="noopener sponsored"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/rapidproxy-dark.png"><img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/rapidproxy-light.png" alt="RapidProxy logo" width="400"></picture></a>

RapidProxy · Integration guide

Reliable Residential Proxies for Data Collection & Automation — 90M+ IPs across 200+ countries. 10% off: RAPID10.

<a href="https://www.testmuai.com/?utm_source=openosint&utm_medium=opensourcecollab" rel="noopener sponsored"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/testmu-ai-white.svg"><img src="https://raw.githubusercontent.com/OpenOSINT/OpenOSINT/main/assets/sponsors/testmu-ai.svg" alt="TestMu AI logo" width="353"></picture></a>

TestMu AI

TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.

Open: Breach / Compromised-Credential Data · Email / Identity Lookup — see SPONSORSHIP.md.

<!-- SPONSORS:END -->

Usage

Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_email('target@example.com')
  Found: Spotify, WordPress, Gravatar, Office365

  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_username('johndoe99')   <- pivoted from email findings
  Found: GitHub, Reddit, Twitter

  Report saved -> reports/2026-05-11_14-32-11_report.md

Want the full investigation workflow behind this? → AI OSINT Complete Kit ($55)

Features

| Capability | Details | |---|---| | AI tool chaining | The agent selects and chains tools based on findings; describe the target in plain language | | 20 modular tools | Email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, live dork search, URL scraping, SERP footprint | | Three AI backends | Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...) | | Native MCP server | All 20 tools exposed to Claude Code, Claude Desktop, and any MCP-compatible client — no extra config | | Parallel execution | --parallel runs complementary tools concurrently via asyncio.gather() | | Reports | PDF + Markdown auto-saved after every investigation (reportlab optional) | | Session history | All REPL sessions saved to ~/.openosint/history/; browse with openosint history | | Web UI | Browser-based AI chat with streaming output, tool cards, light/dark theme |

---

Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Tools

| Tool | Powered by | What it investigates | |------|-----------|---------------------| | search_email | holehe | Social accounts linked to an email address | | search_username | sherlock | Username presence across 400+ platforms | | search_breach | HaveIBeenPwned v3 API | Data breach exposure | | search_whois | python-whois | Domain registrant and DNS info | | search_ip | ipinfo.io | Geolocation, ASN, hostname | | search_domain | sublist3r | Subdomain enumeration | | generate_dorks | built-in | 12 targeted Google dork URLs (no network calls) | | search_paste | psbdmp.ws | Pastebin dump mentions | | search_phone | phoneinfoga | Carrier, country, line type | | search_shodan | Shodan API | Open ports, banners, CVEs | | search_virustotal | VirusTotal API v3 | Verdict from 70+ antivirus engines | | search_ip2location | IP2Location.io API | Enhanced IP intel: VPN/Proxy/Tor/datacenter flags (sponsored) | | search_censys | Censys Search API | Internet-facing infrastructure, certificates | | search_abuseipdb | AbuseIPDB v2 API | IP abuse reputation: confidence score, reports, country, ISP | | search_github | GitHub REST API | Profile, repos, commit-discovered emails, username/keyword search | | search_dns | dnspython (built-in) | A/AAAA/MX/NS/TXT/CNAME/SOA records; SPF, DMARC, DKIM analysis | | search_gdelt_geo | GDELT GEO 2.0 API | Worldwide geolocated news coverage, GeoJSON output | | search_dorks_live | Bright Data SERP API | Live Google search results for dork queries (title, URL, snippet) | | scrape_url | Bright Data Web Unlocker | Fetch any URL bypassing Cloudflare/CAPTCHA — returns clean Markdown | | search_footprint | Bright Data SERP API | Entity-type-aware public search-engine footprint: detects email/username/domain/phone/name and returns structured results + Entity Correlation Graph nodes/edges |

Full per-tool documentation, CLI flags, and output formats: openosint.tech.

search_email

Enumerates online services linked to an email address using holehe.

openosint email target@example.com

[+] Spotify        https://open.spotify.com/user/target
[+] WordPress      https://wordpress.com/target
[+] Gravatar       https://gravatar.com/target
[+] Office365      email used

search_username

Searches for a username across 400+ platforms using sherlock.

openosint username johndoe99

[+] GitHub         https://github.com/johndoe99
[+] Twitter        https://twitter.com/johndoe99
[+] Reddit         https://reddit.com/user/johndoe99

search_breach

Checks data breach exposure via HaveIBeenPwned v3 API. Requires HIBP_API_KEY.

[+] LinkedIn (2016-05-05) — leaked: Email addresses, Passwords
[+] Adobe (2013-10-04) — leaked: Email addresses, Password hints

search_whois

Retrieves WHOIS data using python-whois.

[+] Registrar: ICANN
[+] Created: 1995-08-14
[+] Expires: 2024-08-13