osint-toolbox-mcp

# osint-toolbox-mcp

An MCP server that lets AI agents run classic OSINT tools on your own machine: Sherlock, Maigret, Blackbird, Holehe, GHunt, theHarvester, SpiderFoot, subfinder, dnstwist, dnsrecon, PhoneInfoga and ExifTool, plus built-in WHOIS, DNS, certificate transparency and Wayback Machine lookups. No API keys and no cloud service in between: the tools run locally and query public sources directly.

[![CI](https://github.com/renkagod/osint-toolbox-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/renkagod/osint-toolbox-mcp/actions/workflows/ci.yml)
[![PyPI](https://img.shields.io/pypi/v/osint-toolbox-mcp?logo=pypi&logoColor=white)](https://pypi.org/project/osint-toolbox-mcp/)
[![Python](https://img.shields.io/pypi/pyversions/osint-toolbox-mcp?logo=python&logoColor=white)](https://pypi.org/project/osint-toolbox-mcp/)
[![Docker image](https://img.shields.io/badge/image-ghcr.io%2Frenkagod%2Fosint--toolbox--mcp-blue?logo=docker&logoColor=white)](https://github.com/renkagod/osint-toolbox-mcp/pkgs/container/osint-toolbox-mcp)
[![License: MIT](https://img.shields.io/github/license/renkagod/osint-toolbox-mcp)](https://github.com/renkagod/osint-toolbox-mcp/blob/main/LICENSE)

<!-- mcp-name: io.github.renkagod/osint-toolbox-mcp -->

Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.

## Tools

| Tool | Give it | You get | Needs |
|---|---|---|---|
| `sherlock_username_search` | username | accounts on 400+ sites | Sherlock |
| `maigret_username_search` | username | accounts on up to 3000+ sites, with the profile data found on them | Maigret |
| `blackbird_username_search` | username | accounts on the 700+ sites of the WhatsMyName list | Blackbird checkout (not in the Docker image) |
| `holehe_email_search` | email address | which of about 120 sites have an account for it | Holehe |
| `ghunt_google_search` | Google account email or Gaia ID | name, profile picture, Maps reviews, calendar and other public data | GHunt, logged in |
| `theharvester_domain_search` | domain or company name | email addresses, subdomains, hosts, IP addresses | theHarvester |
| `spiderfoot_scan` | domain, IP, email, phone, username, person name... | findings grouped by type | SpiderFoot checkout |
| `phoneinfoga_scan` | phone number | country, number formats, carrier (with an API key), search queries | PhoneInfoga |
| `exiftool_metadata` | path to a local file | GPS coordinates, camera, author, software, timestamps | ExifTool |
| `subfinder_subdomain_search` | domain | subdomains from passive sources, with the sources that reported them | subfinder |
| `dnstwist_lookalike_domains` | domain | registered lookalike domains (typos, homoglyphs, other TLDs) with their A, MX and NS records | dnstwist |
| `dnsrecon_domain_scan` | domain | DNS records, zone transfer attempts, DNSSEC zone walking | dnsrecon |
| `whois_lookup` | domain, IP address, network or AS number | registrar, dates, name servers, holder and contacts where public (RDAP, or WHOIS) | built in |
| `dns_lookup` | domain name or IP address | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records, or the reverse name | built in |
| `crtsh_certificate_search` | domain | host names and email addresses from TLS certificates issued for it (crt.sh) | built in |
| `wayback_snapshots` | URL or domain | archived snapshots in the Wayback Machine, newest first | built in |
| `osint_toolbox_status` | nothing | which tools are installed, and how to install the missing ones | built in |

Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.

## Quick start

Pick one:

- **Docker**: every tool but Blackbird in one image, nothing else to install.
- **uvx**: one command installs the tools on your machine, without admin rights.

### Docker

The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:

```
docker pull ghcr.io/renkagod/osint-toolbox-mcp
```

Add the server to your client:

```json
{
  "mcpServers": {
    "osint-toolbox": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/renkagod/osint-toolbox-mcp"]
    }
  }
}
```

Files for ExifTool, the GHunt login, API keys and proxies are covered in [Docker details](#docker-details).

### uvx

Install [uv](https://docs.astral.sh/uv/), then install the tools. This installs everything that is missing and checks that each tool starts; see [Install the tools](#install-the-tools) for what it does:

```
uvx osint-toolbox-mcp --install
```

Add the server to your client:

```json
{
  "mcpServers": {
    "osint-toolbox": {
      "command": "uvx",
      "args": ["osint-toolbox-mcp"]
    }
  }
}
```

To run the latest code from `main` instead of a release, use `uvx --from git+https://github.com/renkagod/osint-toolbox-mcp osint-toolbox-mcp`.

## Connect your client

One-click install:

| Client | Docker (all but Blackbird) | uvx (your tools) |
|---|---|---|
| Cursor | [![Add to Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=osint-toolbox&config=eyJjb21tYW5kIjoiZG9ja2VyIiwiYXJncyI6WyJydW4iLCItaSIsIi0tcm0iLCJnaGNyLmlvL3JlbmthZ29kL29zaW50LXRvb2xib3gtbWNwIl19) | [![Add to Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=osint-toolbox&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyJvc2ludC10b29sYm94LW1jcCJdfQ%3D%3D) |
| VS Code | [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=osint-toolbox&config=%7B%22command%22%3A%22docker%22%2C%22args%22%3A%5B%22run%22%2C%22-i%22%2C%22--rm%22%2C%22ghcr.io%2Frenkagod%2Fosint-toolbox-mcp%22%5D%7D) | [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=osint-toolbox&config=%7B%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22osint-toolbox-mcp%22%5D%7D) |
| VS Code Insiders | [![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=osint-toolbox&config=%7B%22command%22%3A%22docker%22%2C%22args%22%3A%5B%22run%22%2C%22-i%22%2C%22--rm%22%2C%22ghcr.io%2Frenkagod%2Fosint-toolbox-mcp%22%5D%7D&quality=insiders) | [![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=osint-toolbox&config=%7B%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22osint-toolbox-mcp%22%5D%7D&quality=insiders) |
| LM Studio | [![Add to LM Studio](https://files.lmstudio.ai/deeplink/mcp-install-dark.svg)](https://lmstudio.ai/install-mcp?name=osint-toolbox&config=eyJjb21tYW5kIjoiZG9ja2VyIiwiYXJncyI6WyJydW4iLCItaSIsIi0tcm0iLCJnaGNyLmlvL3JlbmthZ29kL29zaW50LXRvb2xib3gtbWNwIl19) | [![Add to LM Studio](https://files.lmstudio.ai/deeplink/mcp-install-dark.svg)](https://lmstudio.ai/install-mcp?name=osint-toolbox&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyJvc2ludC10b29sYm94LW1jcCJdfQ%3D%3D) |

**Claude Desktop**: download `osint-toolbox-mcp-<version>.mcpb` from the [latest release](https://github.com/renkagod/osint-toolbox-mcp/releases/latest) and open it. Claude Desktop installs it as an extension and asks for the optional SpiderFoot, Blackbird and ExifTool locations; the other tools are found on PATH. You can also paste the JSON above into Settings → Developer → Edit Config.

**Claude Code**:

```
claude mcp add osint-toolbox -- uvx osint-toolbox-mcp
claude mcp add osint-toolbox -- docker run -i --rm ghcr.io/renkagod/osint-toolbox-mcp
```

**Clients that read the `mcpServers` JSON above** (paste it into the file):

| Client | Where the config lives |
|---|---|
| Cursor | `~/.cursor/mcp.json`, or `.cursor/mcp.json` in a project |
| Windsurf | `~/.codeium/windsurf/mcp_config.json` |
| Cline | MCP Servers → Configure → `cline_mcp_settings.json` |
| Roo Code | `.roo/mcp.json` in a project, or the global MCP settings |
| Gemini CLI | `~/.gemini/settings.json` |
| Antigravity | agent panel "…" → MCP Servers → Manage MCP Servers → View raw config |
| LM Studio | Program tab → Install → Edit `mcp.json` |
| Kiro | `~/.kiro/settings/mcp.json`, or `.kiro/settings/mcp.json` in a project |

Clients with their own format (shown with uvx; for Docker, use `docker` with the arguments `run -i --rm ghcr.io/renkagod/osint-toolbox-mcp`):

<details>
<summary>VS Code</summary>

```
code --add-mcp '{"name":"osint-toolbox","command":"uvx","args":["osint-toolbox-mcp"]}'
```

Or in `.vscode/mcp.json`:

```json
{
  "servers": {
    "osint-toolbox": {
      "type": "stdio",
      "command": "uvx",
      "args": ["osint-toolbox-mcp"]
    }
  }
}
```

</details>

<details>
<summary>Codex CLI</summary>

```
codex mcp add osint-toolbox -- uvx osint-toolbox-mcp
```

Or in `~/.codex/config.toml`, with a longer timeout for slow scans:

```toml
[mcp_servers.osint-toolbox]
command = "uvx"
args = ["osint-toolbox-mcp"]
tool_timeout_sec = 1800
```

</details>

<details>
<summary>Zed</summary>

In `settings.json`:

```json
{
  "context_servers": {
    "osint-toolbox": {
      "command": "uvx",
      "args": ["osint-toolbox-mcp"],
      "env": {}
    }
  }
}
```

</details>

<details>
<summary>Goose</summary>

In `~/.config/goose/config.yaml`:

```yaml
extensions:
  osint-toolbox:
    name: osint-toolbox
    type: stdio
    cmd: uvx
    args: [osint-toolbox-mcp]
    enabled: true
    timeout: 1800
```

</details>

<details>
<summary>opencode</summary>

In `opencode.json`:

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "osint-toolbox": {
      "type": "local",
      "command": ["uvx", "osint-toolbox-mcp"],
      "en