R
renkagod/osint-toolbox-mcp
MCP server that lets AI agents run 12 classic OSINT tools locally, no API keys needed
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
- Copy the command above
- Paste it as one entry under
mcpServersinclaude_desktop_config.json— local servers take command + args (example: clients) - Restart your client
Client config (built from the install command this repo gives)
{
"mcpServers": {
"renkagod-osint-toolbox-mcp": {
"command": "uvx",
"args": ["osint-toolbox-mcp"]
}
}
}Parsed from the README we fetched on 2026-10-26; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"renkagod-osint-toolbox-mcp": {
"command": "uvx",
"args": ["osint-toolbox-mcp"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio renkagod-osint-toolbox-mcp -- uvx osint-toolbox-mcp
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 3 ★ · renkagod/osint-toolbox-mcp · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 3 ★ · 23 sources · mcp
- Install
uvx osint-toolbox-mcp
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
uvx osint-toolbox-mcp. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
renkagod/osint-toolbox-mcp；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# osint-toolbox-mcp
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
An MCP server that lets AI agents run classic OSINT tools on your own machine: Sherlock, Maigret, Blackbird, Holehe, GHunt, theHarvester, SpiderFoot, subfinder, dnstwist, dnsrecon, PhoneInfoga and ExifTool, plus built-in WHOIS, DNS, certificate transparency and Wayback Machine lookups. No API keys and no cloud service in between: the tools run locally and query public sources directly.
Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.
## Features
| Tool | Give it | You get | Needs |
| sherlockusernamesearch | username | accounts on 400+ sites | Sherlock |
| maigretusernamesearch | username | accounts on up to 3000+ sites, with the profile data found on them | Maigret |
| blackbirdusernamesearch | username | accounts on the 700+ sites of the WhatsMyName list | Blackbird checkout (not in the Docker image) |
| holeheemailsearch | email address | which of about 120 sites have an account for it | Holehe |
| ghuntgooglesearch | Google account email or Gaia ID | name, profile picture, Maps reviews, calendar and other public data | GHunt, logged in |
| theharvesterdomainsearch | domain or company name | email addresses, subdomains, hosts, IP addresses | theHarvester |
| spiderfootscan | domain, IP, email, phone, username, person name... | findings grouped by type | SpiderFoot checkout |
| phoneinfogascan | phone number | country, number formats, carrier (with an API key), search queries | PhoneInfoga |
| exiftoolmetadata | path to a local file | GPS coordinates, camera, author, software, timestamps | ExifTool |
| subfindersubdomainsearch | domain | subdomains from passive sources, with the sources that reported them | subfinder |
| dnstwistlookalikedomains | domain | registered lookalike domains (typos, homoglyphs, other TLDs) with their A, MX and NS records | dnstwist |
| dnsrecondomainscan | domain | DNS records, zone transfer attempts, DNSSEC zone walking | dnsrecon |
| whoislookup | domain, IP address, network or AS number | registrar, dates, name servers, holder and contacts where public (RDAP, or WHOIS) | built in |
| dnslookup | domain name or IP address | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records, or the reverse name | built in |
| crtshcertificatesearch | domain | host names and email addresses from TLS certificates issued for it (crt.sh) | built in |
| waybacksnapshots | URL or domain | archived snapshots in the Wayback Machine, newest first | built in |
| osinttoolboxstatus | nothing | which tools are installed, and how to install the missing ones | built in |
Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.
## Quick start
Pick one:
Docker: every tool but Blackbird in one image, nothing else to install.
uvx: one command installs the tools on your machine, without admin rights.
### Docker
The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:
docker pull ghcr.io/renkagod/osint-toolbox-mcp
Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.
## Features
| Tool | Give it | You get | Needs |
| sherlockusernamesearch | username | accounts on 400+ sites | Sherlock |
| maigretusernamesearch | username | accounts on up to 3000+ sites, with the profile data found on them | Maigret |
| blackbirdusernamesearch | username | accounts on the 700+ sites of the WhatsMyName list | Blackbird checkout (not in the Docker image) |
| holeheemailsearch | email address | which of about 120 sites have an account for it | Holehe |
| ghuntgooglesearch | Google account email or Gaia ID | name, profile picture, Maps reviews, calendar and other public data | GHunt, logged in |
| theharvesterdomainsearch | domain or company name | email addresses, subdomains, hosts, IP addresses | theHarvester |
| spiderfootscan | domain, IP, email, phone, username, person name... | findings grouped by type | SpiderFoot checkout |
| phoneinfogascan | phone number | country, number formats, carrier (with an API key), search queries | PhoneInfoga |
| exiftoolmetadata | path to a local file | GPS coordinates, camera, author, software, timestamps | ExifTool |
| subfindersubdomainsearch | domain | subdomains from passive sources, with the sources that reported them | subfinder |
| dnstwistlookalikedomains | domain | registered lookalike domains (typos, homoglyphs, other TLDs) with their A, MX and NS records | dnstwist |
| dnsrecondomainscan | domain | DNS records, zone transfer attempts, DNSSEC zone walking | dnsrecon |
| whoislookup | domain, IP address, network or AS number | registrar, dates, name servers, holder and contacts where public (RDAP, or WHOIS) | built in |
| dnslookup | domain name or IP address | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records, or the reverse name | built in |
| crtshcertificatesearch | domain | host names and email addresses from TLS certificates issued for it (crt.sh) | built in |
| waybacksnapshots | URL or domain | archived snapshots in the Wayback Machine, newest first | built in |
| osinttoolboxstatus | nothing | which tools are installed, and how to install the missing ones | built in |
Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.
## Quick start
Pick one:
Docker: every tool but Blackbird in one image, nothing else to install.
uvx: one command installs the tools on your machine, without admin rights.
### Docker
The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:
docker pull ghcr.io/renkagod/osint-toolbox-mcp
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/renkagod-osint-toolbox-mcp/)
- Source
- awesome · https://github.com/renkagod/osint-toolbox-mcp
- Browse by field
- MCP servers
- Traction
- 3 ★
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.