OpenOSINT

OpenOSINT is an MIT-licensed OSINT (Open Source Intelligence) agent for security researchers and analysts. It puts 21 investigation tools behind a natural-language interface and can be used as an interactive REPL, a direct CLI, a browser web UI, or an MCP server for compatible AI clients. The latest release listed is v2.35.0.

What It Is

OpenOSINT is a modular framework that wraps external OSINT binaries and third-party APIs in async tools, then lets an AI agent decide which to run and chain based on findings. You type a target such as an email, username, domain, IP, phone number, or name, and the agent compiles a structured report. Tool results come from real executions and each finding is shown with the tool call that produced it. The project says AI summaries are leads to verify, not proof.

How an Investigation Works

In the REPL, a request like investigating an email address triggers tools such as dork generation, breach lookup, and account enumeration, with follow-up pivots (for example to GitHub) based on what is found. Reports are saved as Markdown, with optional PDF output, and sessions are stored in a local history. Direct CLI commands run individual tools without AI for scripting. A parallel mode runs complementary tools concurrently.

Tool Coverage

The tools cover email and username enumeration, HaveIBeenPwned breach checks, WHOIS and RDAP, DNS record and SPF/DMARC/DKIM analysis, subdomain enumeration, IP intelligence (ipinfo, IP2Location, AbuseIPDB), Shodan, Censys, VirusTotal, paste search, phone intelligence, GitHub profile discovery, GDELT geolocated news, and Bright Data-backed live dorking, URL scraping, and search footprinting. An optional entity graph module and a beta external exposure report that grades a domain A-F are also documented.

Passive by Default and Backends

OpenOSINT starts in passive mode: tools that touch the target's infrastructure or generate noisy traffic are not offered to the model or MCP clients until enabled with --allow-active. The AI layer supports Anthropic Claude by default, local Ollama, or any OpenAI-compatible endpoint. The MCP server lists 20 passive tools by default and 25 with active tools enabled.

Setup Path

Install with pip install openosint or run uvx openosint web to open the browser UI on localhost. Python 3.10+ is required, some tools need external binaries (holehe, sherlock, sublist3r, phoneinfoga) or provider API keys, and a Docker setup is documented. A separate OpenOSINT Cloud offers some tools as hosted Apify Actors. The project states it is for authorized, legal use only.