OpenOSINT MCP Server: Setup for Claude, Cursor and Other Apps

• Looks up who registered a domain

  Retrieves WHOIS registration data for a domain from its registry.

  Try: “Who registered example.com?”

  Network · search_whois

• Looks up domain registration in the modern RDAP format

  Returns registrar, registration and expiry dates, name servers and status. Registrant contact details are redacted by policy, and no key is needed.

  Try: “When does example.com expire?”

  Network · search_rdap

• Lists a domain's DNS records and email security gaps

  Reads A, AAAA, MX, NS, TXT, CNAME and SOA records and points out missing or weak SPF, DMARC and DKIM settings. Lookups go through your DNS resolver.

  Try: “Check the email security setup for example.com.”

  Network · search_dns

• Shows where an IP address is and who runs it

  Returns geolocation and network owner details for an IP address using ipinfo.io.

  Try: “Where is 8.8.8.8 located?”

  Network · search_ip

• Gives enhanced IP intelligence

  Returns location and network details, and VPN, proxy, Tor or data center flags on the provider's security plan.

  Try: “Is 203.0.113.5 a VPN or proxy address?”

  Network · search_ip2location

• Checks an IP address's abuse reputation

  Returns a 0 to 100 abuse score, report counts, country and provider, and warns above 50. Needs an AbuseIPDB key.

  Try: “Has 203.0.113.5 been reported for abuse?”

  Network · search_abuseipdb

• Looks up open ports and known flaws for an IP or keyword

  For an IP address, returns open ports, owner and known CVEs from Shodan's existing index. For other text, runs a banner search. Needs a Shodan key.

  Try: “What ports does Shodan show open on 203.0.113.5?”

  Network · search_shodan

• Looks up internet-facing hosts and certificates

  For an IP address returns open ports, services and country. For a domain returns certificate history. Needs Censys credentials.

  Try: “Show certificate history for example.com.”

  Network · search_censys

• Checks an IP, domain, URL or file hash against 70+ scanners

  Auto-detects the input type and returns VirusTotal's verdicts. Reads existing data; submitting a URL for scanning is a separate opt-in mode. Needs a VirusTotal key.

  Try: “Is this file hash flagged as malware?”

  Network · search_virustotal

• Checks whether an email appears in known data breaches

  Looks the address up on HaveIBeenPwned. Needs a HaveIBeenPwned key.

  Try: “Has jane@example.com appeared in a breach?”

  Network · search_breach

• Looks for an email or username in Pastebin dumps

  Searches paste dumps through psbdmp.ws for mentions of the email or username.

  Try: “Does this email show up in any paste dumps?”

  Network · search_paste

• Looks up a GitHub user, email or keyword

  For an exact username returns the profile, recent repos and emails found in commit history. Otherwise returns the top 5 matching accounts.

  Try: “Find the GitHub profile for username octocat.”

  Network · search_github

• Builds Google search links for a target

  Creates 12 ready-made Google search queries for a name, email, username or domain. It makes no network calls.

  Try: “Make search links for the username jdoe.”

  Read · generate_dorks

• Runs Google searches for a target through Bright Data

  Runs up to 5 search queries by default and returns titles, links and snippets. Each query is a billable Bright Data call and needs its key.

  Try: “Run live searches for jdoe@example.com.”

  Network · search_dorks_live

• Collects a target's public search footprint

  Detects whether the target is an email, username, domain, phone or name and gathers results through Bright Data, with a graph of how entities relate.

  Try: “What does the public web say about jdoe?”

  Network · search_footprint

• Finds recent world news placed on a map

  Downloads the public GDELT news feed and filters it on your machine, returning headline, link and place as GeoJSON.

  Try: “Recent news mentioning Kyiv, on a map.”

  Network · search_gdelt_geo

• Shows entities linked to one entity in the local graph

  Reads the local entity graph and returns the entities connected to the one you name.

  Try: “What is linked to example.com in the graph?”

  Files · graph_neighbors

• Lists possible duplicate entities for review

  Reads the local graph and lists candidate same-entity matches awaiting a human decision.

  Try: “Which graph entities might be duplicates?”

  Files · graph_review_candidates

• Exports the local graph as FollowTheMoney data

  Reads the local graph database and exports it in .ftm format. Needs the optional graph extra.

  Try: “Export the graph as FollowTheMoney.”

  Files · graph_export

• Investigates up to 10 targets in parallel and saves reports

  Runs the AI agent on each target with its own report file and a summary report. Uses an Anthropic key, and calls are capped per request.

  Try: “Investigate these 5 domains and save reports.”

  Write · investigate_multi

Watch out for

• Targets you name go to many third-party services

  Passive does not mean private. Shodan, HaveIBeenPwned, VirusTotal, Bright Data and others see what you search, and usually your key or IP. Only investigate targets you are allowed to. github.com

• One tool saves report files on disk

  The multi-target investigation writes a report per target plus a summary. Treat those files as sensitive. github.com

• Noisy and target-touching tools are off by default

  Account enumeration, subdomain scans, phone lookups and the page fetcher are not offered unless you add the allow-active option. Turning it on makes requests the target can see. github.com

• Some tools bill your accounts

  Live search runs up to 5 billable Bright Data calls per use, and several tools use your own API keys and quotas. github.com

• For authorized security research

  The project states it is for authorized use and puts legal responsibility on you. Follow local law and the terms of each data source. github.com

Security advisories