i8void/cybersleuth

What it is

CyberSleuth (https://github.com/Mar8x/cybersleuth) is a locally-run MCP server exposing 34 OSINT tools (and 9 MCP resources) to Claude Desktop/Code over stdio. Beyond the capability list the summary gives, the page provides the concrete install path, the ten environment-variable-gated API integrations, and the operational-security constraints an engineer needs before pointing it at real targets.

What to do

Install with uv (recommended) or pip:

git clone https://github.com/Mar8x/cybersleuth.git
cd cybersleuth
uv sync

Register with Claude Code:

claude mcp add cybersleuth -- uv run --directory /absolute/path/to/cybersleuth cybersleuth

Or add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) with a mcpServers.cybersleuth block invoking uv run --directory ... cybersleuth, passing keys via env.

All keys are optional; a tool missing its key returns a structured error with a signup link. The ten recognized keys: SHODAN, URLSCAN, VIRUSTOTAL, BUILTWITH, BRAVE, TAVILY, PERPLEXITY, CERTSPOTTER, CENSYS, GITHUB. To drive the agent, load cybersleuth.md as the system prompt / project instructions (it holds the persona, methodology, example queries) — it is also served as an MCP prompt. Standalone methodology guides live in docs/ (ethics.md, methodology.md, per-target workflow files, dns-twist.md, threat-surface.md), several also exposed as cybersleuth:// resources.

Preconditions / Affected

Python 3.10+, plus uv or pip. Passive DNS / reverse-IP / reverse-CNAME runs through ip.thc.org with no key but is rate-limited to ~0.5 req/s — the practical throughput ceiling for bulk subdomain work. Ransomware victim listings come from ransomware.live via manual web fetch, not an API.

Caveats

The page's own operational-security notes matter for authorized use:

• All external API queries may be logged by the respective services, which track your IP and usage patterns — consider approved proxies for sensitive research.
• No persistent storage of investigation results (nothing is cached locally).
• Keys are read from environment variables only, never hardcoded.
• Identity is ambiguous: the catalog title reads i8void/cybersleuth but every clone URL on the page points to github.com/Mar8x/cybersleuth. Verify the repo owner before trusting the source. License is MIT.