OpenOSINT/OpenOSINT

OpenOSINT
The OSINT toolkit for AI agents: Agent Skill, MCP server and CLI. Passive by default, no API keys needed to start, and every finding cites the tool call that produced it.
A real Claude Code session, nothing mocked: install the plugin and run a passive recon on example.com. Sharper MP4.
## Quickstart
Needs uv. No API keys for the default flow.
Claude Code plugin (skills plus a passive MCP server):
text
/plugin marketplace add OpenOSINT/OpenOSINT
/plugin install openosint@openosint
/openosint:osint example.com
Any agent (Codex, Gemini CLI, Cursor and other Agent Skills clients):
bash
npx skills add OpenOSINT/OpenOSINT
MCP server or pip (other clients):
bash
claude mcp add openosint -- uvx --from openosint openosint-mcp
pip install openosint && openosint exposure example.com
## OpenOSINT Cloud
The same engine as a hosted chat: ask about a domain, an IP address or a company. Every answer shows which public sources were checked, when, and a source on every claim. No install, no API keys.
Try it: 10 free messages
## What you can do
Real output, captured 2026-11-04 on v2.37.0 and trimmed. None of these commands needs an API key or an AI provider.
text
$ openosint exposure example.com
Grade: B Score: 88/100
Checks: email OK [passive] · registration OK [passive] · tls OK [touches target] · http_headers OK [touches target]
[LOW] DMARC has no aggregate report address (dmarc_no_rua)
[LOW] Strict-Transport-Security header missing (hsts_missing)
[INFO] Domain registered 31.2 years ago (domain_age)
$ openosint dns example.com
[DNS] NS: elliott.ns.cloudflare.com., hera.ns.cloudflare.com.
[DNS] SPF: v=spf1 -all
[DNS] DMARC: "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
[DNS] DKIM not checked: selector probing is enumeration (needs --allow-active).
$ openosint rdap example.com
[+] Registrar: RESERVED-Internet Assigned Numbers Authority
[+] Registered: 1995-08-14T04:00:00Z
[+] Expires: 2027-08-13T04:00:00Z
[+] Name servers: elliott.ns.cloudflare.com, hera.ns.cloudflare.com
$ openosint ip 8.8.8.8
[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View
$ openosint gdelt example.com
No geolocated coverage found for 'example.com'. Coverage: the last 15 min (...)
$ openosint gdelt ukraine
[+] White House, District Of Columbia, United States (38.8951, -77.0364) — 1 article(s)
The same commands are what the skill runs for an agent. All of them are in the CLI reference.
## Why OpenOSINT
Real tool executions. Tools are Python code; only their actual output reaches the model.
Provenance. Every finding is shown with the tool call that produced it. AI summaries are leads to verify, not proof.
Passive by default, with noise labels. Tools that touch the target or are noisy are not even offered to the agent until you opt in.
Works with no keys. exposure, dns, rdap, whois, ip, gdelt and dorks need no account.
| | Prompt-only OSINT skills | SpiderFoot | OpenOSINT |
| What runs the lookups | Nothing: the skill is instructions, and the agent improvises | Its own 200+ modules | Python tools shipped with it |
| Breadth | Whatever the agent can reach | Much broader: 200+ modules and a correlation engine, per its README | A focused tool set |