osint-toolbox-mcp

<!-- mcp-name: io.github.renkagod/osint-toolbox-mcp -->

An MCP server that lets AI agents run classic OSINT tools on your own machine: Sherlock, Maigret, Blackbird, Holehe, GHunt, theHarvester, SpiderFoot, subfinder, dnstwist, dnsrecon, PhoneInfoga and ExifTool, plus built-in WHOIS, DNS, certificate transparency and Wayback Machine lookups. No API keys and no cloud service in between: the tools run locally and query public sources directly.

Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.

Features

| Tool | Give it | You get | Needs | |---|---|---|---| | sherlock_username_search | username | accounts on 400+ sites | Sherlock | | maigret_username_search | username | accounts on up to 3000+ sites, with the profile data found on them | Maigret | | blackbird_username_search | username | accounts on the 700+ sites of the WhatsMyName list | Blackbird checkout (not in the Docker image) | | holehe_email_search | email address | which of about 120 sites have an account for it | Holehe | | ghunt_google_search | Google account email or Gaia ID | name, profile picture, Maps reviews, calendar and other public data | GHunt, logged in | | theharvester_domain_search | domain or company name | email addresses, subdomains, hosts, IP addresses | theHarvester | | spiderfoot_scan | domain, IP, email, phone, username, person name... | findings grouped by type | SpiderFoot checkout | | phoneinfoga_scan | phone number | country, number formats, carrier (with an API key), search queries | PhoneInfoga | | exiftool_metadata | path to a local file | GPS coordinates, camera, author, software, timestamps | ExifTool | | subfinder_subdomain_search | domain | subdomains from passive sources, with the sources that reported them | subfinder | | dnstwist_lookalike_domains | domain | registered lookalike domains (typos, homoglyphs, other TLDs) with their A, MX and NS records | dnstwist | | dnsrecon_domain_scan | domain | DNS records, zone transfer attempts, DNSSEC zone walking | dnsrecon | | whois_lookup | domain, IP address, network or AS number | registrar, dates, name servers, holder and contacts where public (RDAP, or WHOIS) | built in | | dns_lookup | domain name or IP address | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records, or the reverse name | built in | | crtsh_certificate_search | domain | host names and email addresses from TLS certificates issued for it (crt.sh) | built in | | wayback_snapshots | URL or domain | archived snapshots in the Wayback Machine, newest first | built in | | osint_toolbox_status | nothing | which tools are installed, and how to install the missing ones | built in |

Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.

Quick start

Pick one:

• Docker: every tool but Blackbird in one image, nothing else to install.
• uvx: one command installs the tools on your machine, without admin rights.

Docker

The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:

docker pull ghcr.io/renkagod/osint-toolbox-mcp

Add the server to your client:

{
  "mcpServers": {
    "osint-toolbox": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/renkagod/osint-toolbox-mcp"]
    }
  }
}

Files for ExifTool, the GHunt login, API keys and proxies are covered in Docker details.

uvx

Install uv, then install the tools. This installs everything that is missing and checks that each tool starts; see Install the tools for what it does:

uvx osint-toolbox-mcp --install

Add the server to your client:

{
  "mcpServers": {
    "osint-toolbox": {
      "command": "uvx",
      "args": ["osint-toolbox-mcp"]
    }
  }
}

To run the latest code from main instead of a release, use uvx --from git+https://github.com/renkagod/osint-toolbox-mcp osint-toolbox-mcp.

Connect your client

One-click install:

| Client | Docker (all but Blackbird) | uvx (your tools) | |---|---|---| | Cursor | | | | VS Code | | | | VS Code Insiders | | | | LM Studio | | |

Claude Desktop: download osint-toolbox-mcp-<version>.mcpb from the latest release and open it. Claude Desktop installs it as an extension and asks for the optional SpiderFoot, Blackbird and ExifTool locations; the other tools are found on PATH. You can also paste the JSON above into Settings → Developer → Edit Config.

Claude Code:

claude mcp add osint-toolbox -- uvx osint-toolbox-mcp
claude mcp add osint-toolbox -- docker run -i --rm ghcr.io/renkagod/osint-toolbox-mcp

Clients that read the mcpServers JSON above (paste it into the file):

| Client | Where the config lives | |---|---| | Cursor | ~/.cursor/mcp.json, or .cursor/mcp.json in a project | | Windsurf | ~/.codeium/windsurf/mcp_config.json | | Cline | MCP Servers → Configure → cline_mcp_settings.json | | Roo Code | .roo/mcp.json in a project, or the global MCP settings | | Gemini CLI | ~/.gemini/settings.json | | Antigravity | agent panel "…" → MCP Servers → Manage MCP Servers → View raw config | | LM Studio | Program tab → Install → Edit mcp.json | | Kiro | ~/.kiro/settings/mcp.json, or .kiro/settings/mcp.json in a project |

Clients with their own format (shown with uvx; for Docker, use docker with the arguments run -i --rm ghcr.io/renkagod/osint-toolbox-mcp):

<details> <summary>VS Code</summary>

code --add-mcp '{"name":"osint-toolbox","command":"uvx","args":["osint-toolbox-mcp"]}'

Or in .vscode/mcp.json:

{
  "servers": {
    "osint-toolbox": {
      "type": "stdio",
      "command": "uvx",
      "args": ["osint-toolbox-mcp"]
    }
  }
}

</details> <details> <summary>Codex CLI</summary>

codex mcp add osint-toolbox -- uvx osint-toolbox-mcp

Or in ~/.codex/config.toml, with a longer timeout for slow scans:

[mcp_servers.osint-toolbox]
command = "uvx"
args = ["osint-toolbox-mcp"]
tool_timeout_sec = 1800

</details> <details> <summary>Zed</summary>

In settings.json:

{
  "context_servers": {
    "osint-toolbox": {
      "command": "uvx",
      "args": ["osint-toolbox-mcp"],
      "env": {}
    }
  }
}

</details> <details> <summary>Goose</summary>

In ~/.config/goose/config.yaml:

extensions:
  osint-toolbox:
    name: osint-toolbox
    type: stdio
    cmd: uvx
    args: [osint-toolbox-mcp]
    enabled: true
    timeout: 1800

</details> <details> <summary>opencode</summary>

In opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "osint-toolbox": {
      "type": "local",
      "command": ["uvx", "osint-toolbox-mcp"],
      "enabled": true
    }
  }
}

</details> <details> <summary>Continue</summary>

In .continue/mcpServers/osint-toolbox.yaml:

name: OSINT Toolbox
version: 1.0.0
schema: v1
mcpServers:
  - name: osint-toolbox
    type: stdio
    command: uvx
    args:
      - osint-toolbox-mcp

</details>

Install the tools

Skip this if you use Docker, unless you want Blackbird.

uvx osint-toolbox-mcp --install

installs every tool that is missing, without admin rights, then checks that each one starts. uvx osint-toolbox-mcp --install sherlock maigret installs only the tools named. It needs uv and:

• puts each Python tool (Sherlock, Holehe, Maigret, GHunt, theHarvester, dnstwist, dnsrecon) in its own environment with uv tool install, on Python 3.12: their dependencies conflict with each other, and some have no builds for newer Pythons. theHarvester and dnsrecon come from their latest GitHub releases;
• downloads SpiderFoot and Blackbird from GitHub, each with its own virtual environment;
• downloads PhoneInfoga, subfinder and ExifTool and checks them against the checksums their authors publish. On macOS and Linux, ExifTool needs Perl, which those systems usually have.

Checkouts and downloads go to %LOCALAPPDATA%\osint-toolbox-mcp on Windows, ~/Library/Application Support/osint-toolbox-mcp on macOS and ~/.local/share/osint-toolbox-mcp on Linux; set OSINT_TOOLBOX_HOME to use another folder. The server looks there by itself. GHunt still needs a one-time ghunt login afterwards.

uvx osint-toolbox-mcp --check shows, at any time, every tool as ok, missing (with how to install it) or broken (found but fails to start). The agent can ask the same through the osint_toolbox_status tool.

Installing by hand

| Tool | Install | Tested with | |---|---|---| | Sherlock | uv tool install sherlock-project | 0.16 | | Holehe | uv tool install holehe | 1.61 | | Maigret | uv tool install maigret | 0.6 | | GHunt | uv tool install ghunt, then ghunt login | 2.3.4 | | theHarvester | uv tool install git+https://github.com/laramies/theHarvester@4.11.1, or its newest release tag | 4.11.1 | | dnstwist | uv tool install dnstwist --with dnspython --with tld --with idna | 20250130 | | dnsrecon | `