# OpenOSINT

> AI OSINT agent, MCP server, and framework chaining intelligence tools

OpenOSINT connects 20 investigation tools (like Holehe, Sherlock, Sublist3r, and AbuseIPDB) to natural-language AI agents. It can chain lookups across emails, usernames, IPs, and domains, compiling findings into structured markdown reports without manual tab switching. Available as a terminal REPL, local web UI, standalone CLI, and MCP server for tools like Claude Code and Claude Desktop.

Website: https://openosint.tech/

## What it is for

- Investigate targets across social platforms, data breaches, and WHOIS records from a single natural-language prompt
- Expose OSINT investigation capabilities to Claude Desktop or Claude Code via MCP
- Scan usernames across hundreds of platforms using Sherlock directly from terminal or web UI
- Check IP addresses for abuse scores, geolocation, and VPN or proxy usage

## Features

- Interactive terminal REPL that executes tools autonomously via Anthropic tool use
- 20 built-in intelligence tools covering email, username, breach, WHOIS, IP, DNS, and phone lookups
- Model Context Protocol (MCP) server for integration with Claude Desktop and Claude Code
- Local browser-based chat web UI with light and dark themes
- Direct CLI commands for running individual tool lookups without AI
- Support for local inference via Ollama as well as Anthropic and OpenRouter API keys
- Automatic generation and saving of structured markdown investigation reports

## Pricing

Open source. Free and open source (MIT); optional commercial support agreements from €300/year and pay-per-lookup cloud actors on Apify

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Open source: yes
- Platforms: Command line, Web, Linux, macOS, Windows, Self-hosted
- For: Security researchers, penetration testers, threat analysts, and investigative journalists
- Alternative to: Maltego, SpiderFoot, Recon-ng
- Tags: osint, mcp, claude, cybersecurity, recon, cli

## Why it was saved

- [@bertoware, 6 June 2026](https://www.instagram.com/reel/DZP-mkJBXkL/): Eliminates tedious manual tab switching and lookup chaining by letting an AI agent automatically search usernames across platforms, check registered emails, look up domains, and generate a structured report.

## Related

- [Argus](https://xiry.app/resources/argus): Python interactive CLI toolkit for automated OSINT, network reconnaissance, and security checks (GitHub repo, Open source)
- [Robin](https://xiry.app/resources/robin): AI-powered dark web OSINT tool for automated querying and summaries (GitHub repo, Open source)
- [VoidAccess](https://xiry.app/resources/voidaccess): Self-hosted dark web OSINT tool for automated threat intelligence. (Desktop app, Open source)
- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [BabelStrike](https://xiry.app/resources/babelstrike): Transliterate non-Latin names and generate username wordlists for security assessments (GitHub repo, Open source)
- [Claude Code](https://xiry.app/resources/claude-code): Agentic command-line tool that navigates, edits, and debugs codebases directly (Paid)

Updated 3 October 2026. Page: https://xiry.app/resources/openosint

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.