OpenOSINT CLI
An OSINT AI agent with an interactive mode, an MCP server and a CLI: about twenty tools to check domains, addresses, hashes and breaches
- 1,930 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Gathers data from many external sources
- Handles potentially personal data
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/openosintDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Gathers data from many external sources
- Handles potentially personal data
This is third-party code. Review the repository files before installing.
What it does
OpenOSINT does open-source reconnaissance for authorized security work. It runs as an interactive terminal agent, an MCP server and a plain CLI, and combines about twenty tools. These include domain and IP checks, hash and file lookups, breach and reputation databases and queries to search and profiles. Some sources need their own keys, and results build up into an entity graph.
Who it is for. For security professionals doing authorized open-source reconnaissance.
Good fit when
- You need to gather open-source data on a domain, address or hash
- You need breach and reputation checks
- You need to run an investigation with a relationship graph
Not a fit when
- The task is not authorized reconnaissance
- You cannot gather data about people under your rules and law
Example request
Use OpenOSINT to gather data on this domain: records, open ports and breach mentionsLimitations
The tool gathers data from external sources, many of which need their own API keys, and the agent needs a model key or a local model via ollama. Use it only against permitted targets and within data protection law.
How to disable. Remove the openosint package via your Python package manager and remove the MCP setup if you added it.
FAQ
How do I connect it to an agent?
OpenOSINT works both as an MCP server and a CLI; the interactive mode starts with openosint.
Are source keys required?
Some checks work without keys, but many sources such as breach or reputation checks need their own keys.
Discussion
No questions or reviews yet.
Related
CLI toolsOne lookup by username, email or phone across 9,700+ checks from 19 OSINT projects, with reports, an evidence graph and an MCP server
Devil's Eye: OSINT with a Russian layer
glaz-dyavola
An OSINT tool for passive reconnaissance: EGRUL, FSSP, VK, Telegram and Yandex alongside secret scanning and a 15-tool MCP server
Open-source adversary emulation for AI agents, LLM apps and MCP servers, checked against OWASP catalogs
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
An MCP server that runs the maigret OSINT tool in Docker: the agent checks where a username is taken and gets a report in the format you choose
A local MCP server and CLI find vulnerabilities in AI-generated code and drive a scan, fix and rescan loop, no account needed
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| OpenOSINT (this card) | no | 1,930 | ||
| mcp-maigret | no | not required | 273 | an MCP server that runs the maigret OSINT tool in Docker |
| domain-check MCP | no | not required | 309 | The MCP server checks domain availability, explores name variants and returns registration details to help choose an address. |
README in short
The README describes OpenOSINT as an OSINT AI agent with an interactive mode, an MCP server and a CLI. Installation is via pip, with commands for web, email and other targets and a live demo with your own model key. It lists sources and their keys: breach checks, Shodan, VirusTotal, IP reputation, GitHub search and search-engine queries. Results build an entity graph, and the tool is stated to be for authorized research only.