Skip to content

Back to the catalog

OpenOSINT
github.comrepo

OpenOSINT

OpenOSINT is a Python OSINT agent that wraps 20 investigation tools (holehe for email enumeration, sherlock for username lookup, sublist3r for subdomain enumeration, phoneinfoga for phone intel, plus HaveIBeenPwned, Shodan, VirusTotal, Censys, AbuseIPDB, IP2Location, DNS/SPF/DMARC checks, GitHub, and Bright Data-powered dorking/scraping) behind a natural-language AI interface that issues deterministic tool calls so findings can't be hallucinated. It ships as a REPL, CLI, MCP server (usable from Claude Code/Desktop, Cursor, Windsurf), or browser web UI, with an optional additive FollowTheMoney entity graph for correlating findings and pivoting between investigation results, plus documented reverse-proxy/credential-handling behavior for remote deployments.

TL;DR An AI-driven OSINT agent unifying holehe, sherlock, sublist3r, phoneinfoga, Shodan, VirusTotal, HaveIBeenPwned and more behind one MCP-server/CLI/web interface for security investigators.
Open original ↗
Document

What it is

OpenOSINT is a Python-installable (pip install openosint) OSINT investigation agent that fronts ~20 recon tools with an LLM that decides which to run and pivots between them. Beyond the catalog summary, the page documents its execution model, its per-tool credential requirements, and a heavy commercial/sponsorship layer worth knowing before you adopt it.

How it works

The design claim is architectural: the AI issues "hard-stop tool calls" but the actual binaries (holehe, sherlock, etc.) execute in your code, so — per the authors — "hallucinated findings are structurally impossible." The agent chains on results, e.g. an email lookup that surfaces a username triggers a search_username pivot, then writes a timestamped Markdown report to reports/. Access modes: interactive REPL (default), openosint web, direct single-tool CLI (openosint email …), and MCP server for Claude/Cursor/Windsurf.

Preconditions / Affected

Local use needs Python plus the tool binaries in PATH. Several tools require your own API keys, not bundled:

  • HIBP_API_KEY — breach search
  • SHODAN_API_KEY
  • VIRUSTOTAL_API_KEY
  • IP2LOCATION_API_KEY (VPN/Proxy/Tor/datacenter detection only on the paid Security Plan)
  • CENSYS_API_ID + CENSYS_SECRET

A hosted "Email Recon" path via the Apify MCP Server runs with no local Python, binaries, or keys.

What to do

pip install openosint
openosint                          # interactive AI REPL
openosint web                      # browser UI
openosint email target@example.com # direct tool, no AI
openosint shodan 8.8.8.8
openosint virustotal example.com

Full per-tool docs, flags, and output formats are at openosint.tech. Legal/authorized use only per DISCLAIMER.md.

Caveats

This is a marketing-forward page. The globe demo runs on deterministic synthetic data — every entity is fictional, seeded at the statement layer rather than produced by the live mappers, so the demo does not demonstrate real collection quality. IP2Location and RapidProxy are sponsored integrations, and the page pushes paid prompt kits ($29–$55), a newsletter, and bespoke consulting — factor that bias into any evaluation of the "structurally impossible hallucination" claim, which the page asserts but does not prove.

Technologies named here

Techniques named here

  • search_whois - domain WHOIS lookup
  • search_ip - IP geolocation and ASN lookup
  • search_domain - subdomain enumeration
  • search_paste - Pastebin dump search
  • search_phone - phone number intelligence gathering
  • shodan host lookup and banner/keyword search
  • virustotal reputation lookup for IP/domain/URL/file hash
  • censys host and certificate search
  • abuseipdb abuse confidence scoring
  • search_github - GitHub profile/repo/commit-email enumeration
  • search_dns - DNS record query and SPF/DMARC/DKIM analysis

Related in OSINT