renkagod/osint-toolbox-mcp

An MCP server that lets AI agents run classic OSINT tools on your own machine: Sherlock, Maigret, Blackbird, Holehe, GHunt, theHarvester, SpiderFoot, subfinder, dnstwist, dnsrecon, PhoneInfoga and ExifTool, plus built-in WHOIS, DNS, certificate transparency and Wayback Machine lookups. No API keys and no cloud service in between: the tools run locally and query public sources directly.
Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.
## Features
| Tool | Give it | You get | Needs |
| sherlockusernamesearch | username | accounts on 400+ sites | Sherlock |
| maigretusernamesearch | username | accounts on up to 3000+ sites, with the profile data found on them | Maigret |
| blackbirdusernamesearch | username | accounts on the 700+ sites of the WhatsMyName list | Blackbird checkout (not in the Docker image) |
| holeheemailsearch | email address | which of about 120 sites have an account for it | Holehe |
| ghuntgooglesearch | Google account email or Gaia ID | name, profile picture, Maps reviews, calendar and other public data | GHunt, logged in |
| theharvesterdomainsearch | domain or company name | email addresses, subdomains, hosts, IP addresses | theHarvester |
| spiderfootscan | domain, IP, email, phone, username, person name... | findings grouped by type | SpiderFoot checkout |
| phoneinfogascan | phone number | country, number formats, carrier (with an API key), search queries | PhoneInfoga |
| exiftoolmetadata | path to a local file | GPS coordinates, camera, author, software, timestamps | ExifTool |
| subfindersubdomainsearch | domain | subdomains from passive sources, with the sources that reported them | subfinder |
| dnstwistlookalikedomains | domain | registered lookalike domains (typos, homoglyphs, other TLDs) with their A, MX and NS records | dnstwist |
| dnsrecondomainscan | domain | DNS records, zone transfer attempts, DNSSEC zone walking | dnsrecon |
| whoislookup | domain, IP address, network or AS number | registrar, dates, name servers, holder and contacts where public (RDAP, or WHOIS) | built in |
| dnslookup | domain name or IP address | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records, or the reverse name | built in |
| crtshcertificatesearch | domain | host names and email addresses from TLS certificates issued for it (crt.sh) | built in |
| waybacksnapshots | URL or domain | archived snapshots in the Wayback Machine, newest first | built in |
| osinttoolboxstatus | nothing | which tools are installed, and how to install the missing ones | built in |
Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.
## Quick start
Pick one:
Docker: every tool but Blackbird in one image, nothing else to install.
uvx: one command installs the tools on your machine, without admin rights.
### Docker
The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:
docker pull ghcr.io/renkagod/osint-toolbox-mcp