OpenOSINT is an open-source OSINT agent for investigators and security researchers: 21 public-source tools behind a natural-language interface, with an MCP server.
Run it yourself: uvx openosint web (one command, no keys)
No terminal? Use OpenOSINT Cloud in your browser, first check free
Needs uv. No API keys for these commands.
# Local web app with chat, graph and globe uvx openosint web # Or one direct check, no AI involved uvx openosint exposure example.com
Grade: B Score: 88/100
Checks: email OK, registration OK (passive)
tls OK, http_headers OK (these touch the target)
[LOW] DMARC has no aggregate report address (dmarc_no_rua)
[LOW] Strict-Transport-Security header missing (hsts_missing)
Real output, trimmed and re-wrapped. More commands: CLI reference · install guide.
Moved to Quickstart above and the CLI reference.
What it can look up. Per-tool docs: openosint.tech/tools. Only passive tools are on by default.
| Tool | What it finds | Key needed |
|---|---|---|
search_dns |
DNS records, SPF, DMARC | No |
search_rdap |
Registrar, dates, name servers (RDAP) | No |
search_whois |
WHOIS registration data | No |
search_ip |
Hostname, ASN, city for an IP | Optional |
search_ip2location |
Geolocation, ISP, proxy/VPN/Tor flags (sponsored) | Yes |
search_gdelt_geo |
Geolocated news mentions (GDELT) | No |
generate_dorks |
Search-dork URLs for a target | No |
search_paste |
Paste-site mentions | No |
search_github |
Repos, code and users | Optional |
search_breach |
Breaches for an email (HaveIBeenPwned) | Yes |
search_shodan |
Open ports and banners | Yes |
search_censys |
Hosts and certificates | Yes |
search_virustotal |
URL, domain and IP reputation | Yes |
search_abuseipdb |
IP abuse reports | Yes |
search_dorks_live |
Live dork results via Bright Data SERP API¹ | Yes |
search_footprint |
Web footprint via Bright Data SERP API¹ | Yes |
scrape_url |
Page content via Bright Data Web Unlocker¹ (touches target) | Yes |
search_username |
Username across platforms (sherlock; noisy) | No |
search_email |
Accounts tied to an email (holehe; noisy) | No |
search_domain |
Subdomains (sublist3r; noisy) | No |
search_phone |
Carrier and country (phoneinfoga; unverified) | No |
Sherlock, holehe, sublist3r and phoneinfoga run as local binaries you install yourself. Setting up the Bright Data tools: Using OpenOSINT with Bright Data.
Tools run as real Python code and every finding cites the call that produced it. Compared with SpiderFoot, OpenOSINT has far fewer modules and is built to be driven by an agent. See the comparison.
Agents and MCP clients are only offered tools that query third-party sources or compute locally. Anything that touches the target or sends many requests from your IP is off until you opt in (--allow-active) and is not listed in an MCP client's tools/list. Passive is not private: every service you query sees the query. Details: Safety.
/plugin marketplace add OpenOSINT/OpenOSINT
/plugin install openosint@openosint
/openosint:osint example.com
claude mcp add openosint -- uvx --from openosint openosint-mcp
# Codex, Gemini CLI, Cursor and other Agent Skills clients
npx skills add OpenOSINT/OpenOSINT
Other clients: MCP docs · Agent Skill.
- Web UI:
openosint web, streaming chat, a news globe and a graph view. Docs - REPL:
openosintwith no arguments. CLI reference - MCP server:
uvx --from openosint openosint-mcp. Client configs
An agent investigation lands as a point on a 3D globe; click it to pivot. Docs
A FollowTheMoney graph with statement-level provenance and a review queue for same_as candidates. Docs
openosint exposure example.com grades email authentication, TLS, registration and security headers A to F. Docs
pip install openosint or uvx openosint web. Python 3.10+. Install guide
Works in Claude Desktop, Claude Code, Cursor and any MCP client. Client configs
Keys go in the web UI Settings, ~/.openosint/config.env or the environment. All variables · CLI reference
docker compose up --build, then open http://localhost:8080. Docker notes
The same engine as a hosted chat for a domain, an IP address or a company, with a source on every claim. First check free, no account. Hosted REST and MCP API by request: [email protected].
IP2Location.io — powers search_ip2location · Integration guide
Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection
TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.
Open: Breach / Compromised-Credential Data · Email / Identity Lookup · Residential Proxies — see SPONSORSHIP.md.
Sponsor on Open Collective · tiers in SPONSORSHIP.md · commercial license and support: COMMERCIAL.md.
Issues and pull requests are welcome. See CONTRIBUTING.md. Maintainer: Tommaso Bertocchi · @openosint_oss. Contributors: @consocio (#6).
For authorized security research and educational use only. Only investigate targets you own or are permitted to assess. Passive does not mean anonymous. Full text: DISCLAIMER.md.
MIT. See LICENSE.
¹ Bright Data links in this README are affiliate/referral links: OpenOSINT earns a commission if you sign up through them, at no extra cost to you.