Skip to main content
Glama
OpenOSINT

openosint

Official
by OpenOSINT

mcp-name: io.github.OpenOSINT/openosint

Release PyPI PyPI downloads License MIT GitHub Stars MCP MCP Registry Sponsored by IP2Location Sponsored by RapidProxy Sponsored by TestMu AI

OpenOSINT globe view: an agent investigation triggered from a chat prompt lands as a point on an interactive 3D globe, clicking the point pivots into a follow-up investigation, and the new entity appears in the entity graph Investigation results land live on the globe — click a point to pivot. Watch the sharper MP4.

IP2Location.io — powers search_ip2location · Integration guide

Enhanced IP geolocation, ISP, VPN/Proxy/Tor, and datacenter detection

RapidProxy · Integration guide

Reliable Residential Proxies for Data Collection & Automation — 90M+ IPs across 200+ countries. 10% off: RAPID10.

TestMu AI

TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. It covers everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants.

Open: Breach / Compromised-Credential Data · Email / Identity Lookup — see SPONSORSHIP.md.

pip install openosint

Paid: Complete Kit — $55 (prompts + playbook, bundled) · Setup Sprint — $350 (done-for-you install) · Commercial License — from €300/yr (vendor contract, SLA, indemnification)

Quick Start

# Interactive AI REPL (default)
openosint

# Web interface
openosint web

# Direct tool (no AI)
openosint email target@example.com

New to OSINT methodology? Grab the free 5-prompt starter set or the free Playbook edition before your first run.

📬 Agents & OSINT — the newsletter

One AI-OSINT workflow you can run + a ruthless roundup of what's new, every week. Subscribe →

Related MCP server: wrg-mcp-server

Run in the cloud (no install)

No Python, no holehe / sherlock / sublist3r / phoneinfoga binaries in PATH, no API keys — run OpenOSINT Email Recon from your browser, or as an MCP tool in Claude, Cursor, and Windsurf via the Apify MCP Server. Try for free.

Try OpenOSINT Email Recon on Apify →

Usage

Start the REPL and investigate any target — the agent decides which tools to run and chains them on findings:

openosint > investigate target@example.com

  -> generate_dorks('target@example.com')
  -> search_email('target@example.com')
  Found: Spotify, WordPress, Gravatar, Office365

  -> search_breach('target@example.com')
  Found in 2 breaches: LinkedIn (2016), Adobe (2013)

  -> search_username('johndoe99')   <- pivoted from email findings
  Found: GitHub, Reddit, Twitter

  Report saved -> reports/2026-05-11_14-32-11_report.md

Features

Capability

Details

AI tool chaining

The agent selects and chains tools based on findings; describe the target in plain language

20 modular tools

Email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, live dork search, URL scraping, SERP footprint

Three AI backends

Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)

Native MCP server

All 20 tools exposed to Claude Code, Claude Desktop, and any MCP-compatible client — no extra config

Parallel execution

--parallel runs complementary tools concurrently via asyncio.gather()

Reports

PDF + Markdown auto-saved after every investigation (reportlab optional)

Session history

All REPL sessions saved to ~/.openosint/history/; browse with openosint history

Web UI

Browser-based AI chat with streaming output, tool cards, light/dark theme


Legal Disclaimer: OpenOSINT is intended for legal and authorized use only. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. The authors accept no liability for misuse. See DISCLAIMER.md.

Custom Integrations

Need OpenOSINT wired into your SOC, fraud, threat-intel, or AI-agent stack? I build bespoke OSINT integrations for teams — you bring the data sources and compliance requirements, I deliver a working integration.

Get in touch


Tools

Tool

Powered by

What it investigates

search_email

holehe

Social accounts linked to an email address

search_username

sherlock

Username presence across 300+ platforms

search_breach

HaveIBeenPwned v3 API

Data breach exposure

search_whois

python-whois

Domain registrant and DNS info

search_ip

ipinfo.io

Geolocation, ASN, hostname

search_domain

sublist3r

Subdomain enumeration

generate_dorks

built-in

12 targeted Google dork URLs (no network calls)

search_paste

psbdmp.ws

Pastebin dump mentions

search_phone

phoneinfoga

Carrier, country, line type

search_shodan

Shodan API

Open ports, banners, CVEs

search_virustotal

VirusTotal API v3

Verdict from 70+ antivirus engines

search_ip2location

IP2Location.io API

Enhanced IP intel: VPN/Proxy/Tor/datacenter flags (sponsored)

search_censys

Censys Search API

Internet-facing infrastructure, certificates

search_abuseipdb

AbuseIPDB v2 API

IP abuse reputation: confidence score, reports, country, ISP

search_github

GitHub REST API

Profile, repos, commit-discovered emails, username/keyword search

search_dns

dnspython (built-in)

A/AAAA/MX/NS/TXT/CNAME/SOA records; SPF, DMARC, DKIM analysis

search_gdelt_geo

GDELT GEO 2.0 API

Worldwide geolocated news coverage, GeoJSON output

search_dorks_live

Bright Data SERP API

Live Google search results for dork queries (title, URL, snippet)

scrape_url

Bright Data Web Unlocker

Fetch any URL bypassing Cloudflare/CAPTCHA — returns clean Markdown

search_footprint

Bright Data SERP API

Entity-type-aware public search-engine footprint: detects email/username/domain/phone/name and returns structured results + Entity Correlation Graph nodes/edges

Full per-tool documentation, CLI flags, and output formats: openosint.tech.

search_email

Enumerates online services linked to an email address using holehe.

openosint email target@example.com
[+] Spotify        https://open.spotify.com/user/target
[+] WordPress      https://wordpress.com/target
[+] Gravatar       https://gravatar.com/target
[+] Office365      email used

search_username

Searches for a username across 300+ platforms using sherlock.

openosint username johndoe99
[+] GitHub         https://github.com/johndoe99
[+] Twitter        https://twitter.com/johndoe99
[+] Reddit         https://reddit.com/user/johndoe99

search_breach

Checks data breach exposure via HaveIBeenPwned v3 API. Requires HIBP_API_KEY.

[+] LinkedIn (2016-05-05) — leaked: Email addresses, Passwords
[+] Adobe (2013-10-04) — leaked: Email addresses, Password hints

search_whois

Retrieves WHOIS data using python-whois.

[+] Registrar: ICANN
[+] Created: 1995-08-14
[+] Expires: 2024-08-13
[+] Name Servers: A.IANA-SERVERS.NET

search_ip

Retrieves geolocation and ASN data via ipinfo.io. Free tier: 50k/month.

[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View, CA, US

search_domain

Enumerates subdomains using sublist3r.

[+] mail.example.com
[+] dev.example.com
[+] api.example.com

generate_dorks

Generates 12 targeted Google dork URLs for any target. No network calls.

[+] "johndoe" site:linkedin.com
    https://www.google.com/search?q=%22johndoe%22+site%3Alinkedin.com
[+] "johndoe" leaked OR breach OR dump
    https://www.google.com/search?q=%22johndoe%22+leaked+OR+breach+OR+dump

search_paste

Searches Pastebin dumps via psbdmp.ws.

[+] https://pastebin.com/aB1cD2eF (2023-04-12)
[+] https://pastebin.com/xY3zA4bC (2022-11-08)

search_phone

Gathers phone intelligence using phoneinfoga. Use E.164 format.

[+] Country: United States
[+] Carrier: AT&T
[+] Line type: Mobile

search_shodan

IPv4 input → host lookup (open ports, org, CVEs). Any other query → banner/keyword search. Requires SHODAN_API_KEY.

openosint shodan 8.8.8.8
openosint shodan "apache port:80 country:DE"
[+] Org: Google LLC  |  Open ports: 53, 443

search_virustotal

Checks an IP, domain, URL, or file hash against VirusTotal's 70+ engines. Auto-detects input type. Requires VIRUSTOTAL_API_KEY.

openosint virustotal 8.8.8.8
openosint virustotal example.com
openosint virustotal 44d88612fea8a8f36de82e1278abb02f
[VirusTotal] Malicious: 0 / Harmless: 72

search_ip2location

Queries IP2Location.io for enhanced IP intelligence: geolocation, ISP, ASN, and — on the Security Plan — VPN/Proxy/Tor/datacenter detection. Sponsored integration. Requires IP2LOCATION_API_KEY.

openosint ip2location 8.8.8.8
[IP2Location] City: Mountain View, CA, US  |  ISP: Google LLC
[IP2Location] VPN: No  |  Proxy: No  |  TOR: No  |  Datacenter: Yes

search_censys

IPv4 → host view (open ports, services, ASN). Domain → certificate search (SANs, issuer). Requires CENSYS_API_ID and CENSYS_SECRET.

openosint censys 8.8.8.8
openosint censys example.com
[Censys] Open Ports: 53, 443, 853  |  ASN: AS15169 Google LLC

search_abuseipdb

Checks an IP against AbuseIPDB v2. Returns abuse confidence score, total reports, country, ISP, and last reported timestamp. Requires ABUSEIPDB_API_KEY.

openosint abuseipdb 198.51.100.1
[AbuseIPDB] Abuse Confidence Score: 87%  |  Total Reports: 143
⚠️  HIGH ABUSE CONFIDENCE — flagged by AbuseIPDB

Warning appears when abuseConfidenceScore exceeds 50%.

search_github

Queries GitHub REST API. Username → profile, repos, commit-discovered emails. Keyword → user/repo search. Optional GITHUB_TOKEN raises rate limit from 60 to 5000 req/h.

openosint github johndoe99
[GitHub] Repos: 42  |  Followers: 128
[GitHub] Commit email: johndoe@example.com

search_dns

Queries A/AAAA/MX/NS/TXT/CNAME/SOA records and analyzes SPF, DMARC, and DKIM configuration using dnspython (no external API).

openosint dns example.com
[DNS] A: 93.184.216.34
[DNS] MX: mail.example.com (priority 10)
[DNS] SPF: v=spf1 include:_spf.google.com ~all

search_dorks_live

Executes live Google dork queries through the Bright Data SERP API¹, returning structured results (title, URL, snippet). Defaults to 5 dorks per run; each is a separate billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint search-dorks-live "john doe" --max-dorks 3
[+] Dork: "john doe" site:linkedin.com
    Title:   John Doe | LinkedIn
    URL:     https://www.linkedin.com/in/john-doe-12345

scrape_url

Fetches any public URL through Bright Data Web Unlocker¹, bypassing Cloudflare/CAPTCHA. Returns clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE.

openosint scrape https://example.com
[Web Unlocker] Remote status: 200
# Example Domain
This domain is for use in illustrative examples in documents.

search_footprint

Collects a target's public search-engine footprint via Bright Data SERP API¹. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results plus Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE.

openosint footprint johndoe99

Graph module (optional)

An additive FollowTheMoney entity graph — statement-level provenance, an append-only store, non-destructive same_as deduplication, and a human review queue — sits alongside the tools above without changing anything about them. Opt in with pip install "openosint[graph]" (Python 3.10+) or "openosint[graph-dedup]" (adds same_as scoring, needs Python 3.11+), then use it via three MCP tools: graph_export, graph_neighbors, graph_review_candidates. See docs/graph.md for the full guide and a worked example.

The same workflow is shown end to end — including the .ftm export that passes ftm validate — in the terminal demo in docs/graph.md; the web UI walkthrough is the demo at the top of this README.


Interfaces

Web UI

pip install "openosint[web]"
openosint web
# Opens http://localhost:8080 automatically

Browser-based AI chat with streaming tool output, inline result cards, light/dark theme toggle. Supports local inference via Ollama or any OpenAI-compatible endpoint — no Anthropic API key required.

# Fully local (no API key) — requires Ollama runtime: https://ollama.com
ollama pull llama3.2
openosint web
# Settings -> Ollama (local) -> model: llama3.2

# OpenAI-compatible endpoint (LiteLLM, vLLM, LM Studio, ...)
export OPENAI_BASE_URL="http://localhost:4000/v1"
openosint web
# Settings -> OpenAI API

Breaking change (v2.28+): key usage now follows bind address, not an env var. Bound to 127.0.0.1/localhost (the default) — no change: keys in your .env work as before. Bound to any other interface (--host 0.0.0.0, which already requires --allow-remote) — the web UI never uses a key from your environment to serve a request; every caller must supply their own, and breach lookups (search_breach) are disabled outright. This applies regardless of any env var, including OPENOSINT_DEMO_MODE, which can only add restriction, never remove it. If you were exposing the web UI on a LAN with your own keys and no per-caller auth in front of it, that access pattern no longer works.

Running behind a reverse proxy? A loopback bind (127.0.0.1) only means the OS accepted the connection from this machine — it says nothing about who can reach it if something in front (nginx, Caddy, a Docker/K8s sidecar, a tunnel) forwards requests to it from elsewhere. By default, a request that carries proxy-forwarding headers (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host, Forwarded, CF-Connecting-IP) is treated exactly like a non-loopback bind: your local keys are never used, breach lookups are blocked, and the caller is told why. If you deliberately serve this through a reverse proxy and want it to behave like a normal local instance for requests relayed by that proxy, set OPENOSINT_TRUSTED_PROXY=true. This is a separate variable from the existing TRUSTED_PROXY (which only affects which IP a rate-limit bucket is attributed to — a low-stakes, already-loosely-scoped setting some self-hosters already have on). Reusing that flag here would have silently upgraded an existing rate-limit-only configuration into one that also permits credentialed access, without asking. OPENOSINT_TRUSTED_PROXY gets its own explicit opt-in for that reason. Setting it does not blindly trust the forwarded headers' content — internally inconsistent values (e.g. two disagreeing X-Forwarded-Proto values on one request) are still treated as public regardless. Setting OPENOSINT_TRUSTED_PROXY=true means you are choosing to serve credentialed lookups to whoever your reverse proxy relays to this instance — you are the controller for their queries, the same way OpenOSINT Cloud is for its customers. Put real authentication in front of it if "whoever the proxy relays" is broader than you intend.

Interactive REPL

Run openosint with no arguments to start the AI-powered REPL:

REPL commands:

Command

Description

<target>

Investigate any target — email, username, domain, IP, name

clear

Reset conversation memory

save

Save last report to reports/

tools

List available tools and their status

config

Show current configuration

history

Browse saved sessions

help

Show all commands

exit / Ctrl-D

Exit

All sessions are auto-saved to ~/.openosint/history/. Browse with openosint history.

For the REPL/CLI with an OpenAI-compatible backend:

pip install "openosint[openai]"
openosint --provider openai \
  --openai-base-url http://localhost:4000/v1 \
  --openai-model gpt-4o-mini

Live Documentation

Full per-tool reference, CLI flags, and configuration options at openosint.tech.

MCP Server

Expose all 20 OpenOSINT tools to any MCP-compatible AI client. Once connected, Claude can natively invoke all 20 tools during conversations.

Claude Code:

claude mcp add openosint python /absolute/path/to/OpenOSINT/openosint/mcp_server.py
claude mcp list

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "openosint": {
      "command": "python",
      "args": ["/absolute/path/to/OpenOSINT/openosint/mcp_server.py"]
    }
  }
}

Prefer zero setup? The OpenOSINT Email Recon Actor is also available as a hosted MCP tool via the Apify MCP Server — no server to run, no config file to edit. Try for free.

Agentic use via Claude Code:

$ claude
> Investigate target@example.com. Trace any username found
  across other platforms and compile a full report.

Installation

# From PyPI (recommended)
pip install openosint

# From source
git clone https://github.com/OpenOSINT/OpenOSINT.git
cd OpenOSINT
pip install -e .

External binaries (must be in PATH):

Binary

Purpose

Install

holehe

Email account enumeration

pip install holehe

sherlock

Username enumeration (300+ platforms)

pip install sherlock-project

sublist3r

Subdomain enumeration

pip install sublist3r

phoneinfoga

Phone number intelligence

Download binary

If a binary is absent, the corresponding tool returns a descriptive error. All other tools remain operational.

Don't want to install these locally? The OpenOSINT Email Recon Actor runs email recon in Apify's cloud — zero dependencies, zero local setup.

Optional Python packages:

Package

Purpose

Install

ollama

Local LLM backend (no API key)

pip install ollama (also requires Ollama runtime)

openai

OpenAI-compatible backend

pip install "openosint[openai]"

shodan

Shodan API client

pip install shodan

reportlab

PDF report export

pip install reportlab

censys

Censys API client

pip install censys

Configuration

Store keys in a .env file at the project root (copy .env.example). python-dotenv loads it automatically at startup.

Variable

Tool

Required

Purpose

ANTHROPIC_API_KEY

AI agent

Yes (or Ollama / OpenAI)

Anthropic API key

OPENAI_BASE_URL

AI agent

Optional

Base URL of an OpenAI-compatible endpoint (e.g. http://localhost:4000/v1)

OPENAI_API_KEY

AI agent

Optional

API key for the endpoint (local servers may ignore it)

OPENAI_MODEL

AI agent

Optional

Model name to request (default: gpt-4o-mini)

HIBP_API_KEY

search_breach

Optional

HaveIBeenPwned v3 — get one

IPINFO_TOKEN

search_ip

Optional

ipinfo.io higher rate limits

SHODAN_API_KEY

search_shodan

Optional

Shodan API — get one

VIRUSTOTAL_API_KEY

search_virustotal

Optional

VirusTotal API v3 — get one

IP2LOCATION_API_KEY

search_ip2location

Optional

IP2Location.io — get one (sponsored)

CENSYS_API_ID + CENSYS_SECRET

search_censys

Optional

Censys — get one

ABUSEIPDB_API_KEY

search_abuseipdb

Optional

AbuseIPDB v2 — get one

GITHUB_TOKEN

search_github

Optional

GitHub API — raises rate limit 60 → 5000 req/h — get one

BRIGHTDATA_API_KEY

search_dorks_live, scrape_url, search_footprint

Optional

Bright Data — get one¹ (free tier: 5,000 req/month)

BRIGHTDATA_SERP_ZONE

search_dorks_live, search_footprint

Optional

Your Bright Data SERP zone name (e.g. serp_api1)

BRIGHTDATA_UNLOCKER_ZONE

scrape_url

Optional

Your Bright Data Web Unlocker zone name (e.g. web_unlocker1)

CLI Reference

Flag / Subcommand

Description

openosint

Interactive AI REPL (default)

openosint web [--port N] [--no-browser]

Launch browser UI

openosint email ADDRESS [-t N]

Direct email scan

openosint username HANDLE [-t N]

Direct username scan

openosint shodan QUERY [-t N]

Shodan lookup

openosint virustotal TARGET [-t N]

VirusTotal lookup

openosint censys TARGET [-t N]

Censys lookup

openosint ip2location IP [-t N]

IP2Location lookup

openosint abuseipdb IP [-t N]

AbuseIPDB reputation check

openosint github QUERY [-t N]

GitHub profile/repo/email discovery

openosint dns DOMAIN [-t N]

DNS records + email security analysis

openosint multi TARGETS

Parallel multi-target investigation (max 10)

openosint history [--all] [open N] [clear]

View/manage REPL session history

-v, --verbose

Enable debug logging to stderr

-t, --timeout N

Override subprocess timeout (seconds)

--api-key KEY

Anthropic API key (overrides env var)

--parallel

Run complementary tools concurrently

--json

Output results as structured JSON

--provider {anthropic,ollama,openai}

AI provider (default: anthropic)

--ollama-model MODEL

Ollama model name (default: llama3.2)

--ollama-host URL

Ollama server URL (default: http://localhost:11434)

--openai-base-url URL

OpenAI-compatible endpoint base URL (env: OPENAI_BASE_URL)

--openai-model MODEL

Model to request from the endpoint (default: gpt-4o-mini; env: OPENAI_MODEL)

--openai-api-key KEY

API key for the endpoint (env: OPENAI_API_KEY)

--no-pdf

Disable automatic PDF generation

Docker

# Build and run
docker compose up --build

# One-off command
docker compose run --rm openosint email target@example.com --json

Set ANTHROPIC_API_KEY (and optionally HIBP_API_KEY, IPINFO_TOKEN) in a .env file or export them before running docker compose. Reports are persisted to ./reports/ via a volume mount.

DigitalOcean App Platform: see .do/app.yaml for App Platform configuration.

Integrations

Service

URL

Tool

Tier

Auth

IP2Location.io

https://www.ip2location.io

search_ip2location

Featured (sponsored)

API key — free tier

RapidProxy

https://www.rapidproxy.io/?ref=openosint

Featured (sponsored)

AbuseIPDB

https://www.abuseipdb.com

search_abuseipdb

Community

API key — free tier

Censys

https://censys.io

search_censys

Community

API key — free tier

GitHub

https://github.com

search_github

Community

Token optional

HaveIBeenPwned

https://haveibeenpwned.com

search_breach

Community

API key — paid

holehe

https://github.com/megadose/holehe

search_email

Community

None — local binary

ipinfo.io

https://ipinfo.io

search_ip

Community

Token optional

phoneinfoga

https://github.com/sundowndev/phoneinfoga

search_phone

Community

None — local binary

psbdmp.ws

https://psbdmp.ws

search_paste

Community

None

sherlock

https://github.com/sherlock-project/sherlock

search_username

Community

None — local binary

Shodan

https://shodan.io

search_shodan

Community

API key — free tier

sublist3r

https://github.com/aboul3la/Sublist3r

search_domain

Community

None — local binary

VirusTotal

https://www.virustotal.com

search_virustotal

Community

API key — free tier

WHOIS (IANA)

https://www.iana.org/whois

search_whois

Community

None

DNS (system resolver)

search_dns

Community

None

Google Search

https://www.google.com

generate_dorks

Community

None

Get the Method

OpenOSINT is the tool. The AI OSINT Complete Kit ($55) is the method: the Prompt Pack and the Operator's Playbook, bundled.

Get the Complete Kit ($55)

AI OSINT Prompt Pack

OpenOSINT gives you the tooling. The AI OSINT Prompt Pack gives you the method: 30+ tested prompts across 8 target types, with one repeatable collect → pivot → verify → document flow for running OpenOSINT investigations.

  • Email, username, domain, IP, phone, company due-diligence, image & reporting prompts

  • One repeatable investigation flow + an ethics & legal primer

  • Instant download · pairs directly with OpenOSINT

Get the Prompt Pack ($29)

AI OSINT Operator's Playbook

Step-by-step workflows for running investigations with ChatGPT, Claude, and OpenOSINT.

Get the Playbook ($39)

Buying directly funds OpenOSINT's development.

AI OSINT Prompts — Free Starter Set

New to AI-assisted OSINT? The free starter set gives you 5 structured prompts — one per stage of a real investigation — that make ChatGPT and Claude collect real public data instead of hallucinating it.

  • Scope → Collect → Pivot → Verify → Document

  • Works with any AI assistant (Claude, ChatGPT, Gemini)

  • Instant PDF, no card required

Get the free starter set

AI OSINT Operator's Playbook — Free Edition

The free edition walks the 5-phase method once, end to end, on a single worked case: scope → collect → pivot → verify → document. Includes one sample prompt and the confidence rubric used to grade findings.

  • Free edition: the method + one worked investigation

  • Full edition ($39): 12 complete workflows, per-tool playbooks, reporting templates, and the legal/ethics primer

Get the free edition · Full Playbook ($39) →

Sponsor this project

OpenOSINT is used by OSINT practitioners, security researchers, and developers actively evaluating intelligence APIs. Every time a user configures an integration, the docs route them to that provider's sign-up page — high-intent exposure at the moment of adoption.

Featured Integration ($2,000/year or $220/month): recommended/default provider for one tool category, exclusive. Logo + badge across README, docs, CLI banner, and Web UI. One vendor per category.

Current sponsors and open categories are listed in the sponsor block at the top of this README. Full media kit, pricing, and the referral funnel: SPONSORSHIP.md.

Open Collective · commercial@openosint.tech · SPONSORSHIP.md

Affiliate program

Earn 30–45% commission promoting the AI OSINT Prompt Pack, Operator's Playbook, and Complete Kit. Good fit for OSINT/infosec newsletter authors, security YouTube channels, and tool-directory maintainers.

Affiliate program details & terms

SERVICES

The framework is free and MIT-licensed. This is an optional paid setup service offered by the maintainer.

OSINT-MCP Setup Sprint — done-for-you installation and configuration of an autonomous OSINT-MCP pipeline on your environment. Fully async, no calls required.

Includes:

  • Pre-configured OpenOSINT setup tailored to your stack (Claude Code, Claude Desktop, or any MCP client)

  • API keys wired in (Shodan, VirusTotal, IP2Location, HaveIBeenPwned, and others as needed)

  • One investigation workflow built around your use case

  • Written step-by-step setup guide + screen-recorded walkthrough

Delivery: 3–5 days, fully async.

For: SOC analysts · threat-intel teams · fraud/AML · pentesters · OSINT investigators

Need it set up for you?

Get OpenOSINT wired into your stack in 3–5 days — done-for-you, fully async, no calls.

Book the Setup Sprint → $350 (founding price, first 5 teams)

→ Or email commercial@openosint.tech · LinkedIn

For authorized use only. See DISCLAIMER.md.

Commercial License & Support

OpenOSINT is free and MIT-licensed for everyone — personal projects, commercial products, SaaS, and closed-source are all covered with no purchase required. Organizations that additionally need a vendor contract, written warranty, indemnification, SLA, or priority support for procurement and compliance can purchase a commercial plan. Three tiers available from €300/year — see COMMERCIAL.md for full details and pricing. Contact: commercial@openosint.tech.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md for the development workflow, integration registration checklist, and coding conventions. Please read DISCLAIMER.md before contributing.

Regenerating the demo GIF/MP4

export OPENOSINT_DEMO_KEY=sk-ant-...   # your Anthropic key — never committed
openosint --web &                      # start the web server on :8080
make demo                              # record -> encode -> write docs/assets/demo-web-graph.*
git add docs/assets/demo-web-graph.*

See scripts/record-demo/README.md for full prerequisites and pipeline details.

Maintainer

Tommaso Bertocchi

Contributors

Contributor

Contribution

@consocio

venv/uv-tool binary resolution fix — co-installed tools are now found without a separate activation step (#6)

License

OpenOSINT is open source under the MIT License — free for any use, including personal, commercial, academic, and closed-source.


¹ Bright Data links in this README are affiliate/referral links — OpenOSINT earns a commission if you sign up through them, at no extra cost to you.

For authorized security research only. See DISCLAIMER.md.

OpenOSINT v2.27.0 — August 2026

Star History

Star History Chart

Available Tools

23 tools
generate_dorksA

Generate targeted Google dork URLs for any target (name, email, username, domain).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral transparency. It only states the generation function and does not disclose any behavioral traits such as whether it is read-only, requires authentication, or has rate limits. The description lacks sufficient detail for an agent to understand side effects or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is front-loaded with the key action and resource. Every word contributes meaning, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description adequately explains what the tool does given its simplicity (2 params, no output schema). However, it does not describe the return format (e.g., list of URLs, JSON structure) or provide any context on how the URLs are generated. For a tool with no output schema, this omission leaves the agent partially uninformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 50% of parameters (json_output has a description). The description adds significant value by clarifying the 'target' parameter, providing concrete examples ('name, email, username, domain') that are not in the schema. This helps the agent understand acceptable inputs beyond the raw type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Generate') and the resource ('targeted Google dork URLs'), and specifies the types of targets it accepts ('name, email, username, domain'). This distinguishes it from sibling search tools that query databases rather than generate URLs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used for generating dork URLs, distinct from the sibling search tools that perform actual searches. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide any exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_exportA

Export the additive FollowTheMoney entity graph (openosint.graph) as newline-delimited JSON, one FtM entity per line (.ftm-compatible). Optionally exclude whole datasets, e.g. exclude_datasets=['openosint:hibp'] to omit every breach-derived fact. Requires the 'graph' extra: pip install 'openosint[graph]'.

ParametersJSON Schema
NameRequiredDescriptionDefault
json_outputNoReturn result as structured JSON.
exclude_datasetsNoDataset names to omit entirely, e.g. ['openosint:hibp'].

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It does this well by stating the graph is additive, the exact output format (NDJSON, one FtM entity per line), and that whole datasets can be omitted via exclude_datasets. It also warns about the installation requirement. It does not mention what happens when no data exists or whether output is streamed, but these are minor omissions for an export tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry all essential information: the action, the resource, the output format, the optional exclusion mechanism, and the installation prerequisite. It is front-loaded with the main purpose and contains no filler or redundant statements. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two optional parameters and no output schema, the description provides a clear picture of what the tool emits and how to control dataset exclusion. The only notable gap is the interplay between json_output and the default NDJSON export: the schema says json_output returns structured JSON, but the description does not reconcile this with the NDJSON line-by-line format. Still, the agent can call the tool correctly with just this description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers both parameters with descriptions, so the baseline is 3. The description adds value by giving a concrete exclude_datasets example and clarifying that excluding a dataset removes 'every breach-derived fact'. It does not add much to json_output, but that parameter is already well described in the schema. Overall, the description meaningfully enriches the parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Export'), a specific resource ('the additive FollowTheMoney entity graph'), and the output format (newline-delimited JSON, .ftm-compatible). It clearly distinguishes itself from the sibling graph tools like graph_neighbors and graph_review_candidates, which are about querying or reviewing rather than exporting the whole graph.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus the graph_neighbors or search_* siblings. It does explain a prerequisite ('Requires the graph extra') and an optional exclusion pattern, but does not state when exporting is appropriate or when another tool would be a better fit. The usage context is only implied by the tool name and the export-focused wording.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_neighborsA

Traverse the FollowTheMoney entity graph from one entity id out to a given depth, returning entities, edges, and per-edge provenance (collection method, confidence, run id). Set cross_layer=true to also surface bridge links into the raw infra correlation graph (IPs, domains, hashes). Requires the 'graph' extra: pip install 'openosint[graph]'.

ParametersJSON Schema
NameRequiredDescriptionDefault
depthNoHops to traverse (default 1, capped at 5).
entity_idYes
cross_layerNoInclude bridge links into the raw infra graph.
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it discloses return contents, the optional cross-layer behavior, and the installation prerequisite. It does not discuss failure behavior, performance at max depth, or output format defaults, but the read-oriented nature of traversal is apparent from the wording.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: one states the core action and output, one explains the optional cross-layer behavior, and one gives the installation prerequisite. Information is front-loaded and there is no redundant phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description is sufficiently complete: it states what is returned, the key optional behavior, and the required dependency. Missing details such as exact JSON shape or invalid entity handling are non-critical for invoking the tool correctly given the schema covers depth and output flags.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so the baseline is 3. The description adds meaning for entity_id ("from one entity id") and enriches cross_layer ("surface bridge links into the raw infra correlation graph - IPs, domains, hashes"), going beyond the terse schema text. It appropriately does not need to restate depth or json_output since the schema already documents them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: "Traverse the FollowTheMoney entity graph from one entity id out to a given depth," and states the output contents (entities, edges, per-edge provenance). It is clear and distinct from the sibling tools in focus, though it does not explicitly name a sibling alternative to distinguish against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you need to traverse from a known entity id and see connected entities with provenance. It also gives context for setting cross_layer=true and mentions the 'graph' extra requirement, but it does not explicitly compare to alternatives like graph_export or investigate_multi or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_review_candidatesA

Human review queue for suggested same_as entity matches produced by graph-dedup cross-referencing. action='list' shows pending candidates (score, identifying properties, human-readable match explanation), filterable by schema/score range/dataset. action='decide' records a human verdict on one pair: decision='accept' merges it (judgement='positive'), decision='reject' permanently excludes it from future suggestions (judgement='negative'). Nothing in this project ever auto-merges — only this action can write judgement='positive'.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
schemaNolist filter: restrict to one FtM schema.
datasetNolist filter: either entity must carry a statement from this dataset.
decisionNo
entity_idNodecide: first entity of the pair.
max_scoreNolist filter: maximum score.
min_scoreNolist filter: minimum score.
json_outputNoReturn result as structured JSON.
reviewer_idNodecide: reviewer identifier, recorded if given.
canonical_idNodecide: second entity of the pair.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and does so well: it reveals that reject permanently excludes future suggestions, that accept merges, that no auto-merge happens, and that this is the only write path for judgement='positive'. These are exactly the side effects an agent needs before calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every clause carries information: purpose, action modes, filters, verdict semantics, side effects, and authority. It front-loads the core purpose and uses punctuation to separate related facts without wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no output schema or annotations, the description provides enough to invoke list or decide correctly and understand consequences. The main gap is that return values are not described beyond the candidate fields listed, though json_output hints at structured output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 80%, so the schema already handles most parameter meaning. The description adds value beyond schema by grouping parameters into list filters (schema, score range, dataset) and decide fields (pair, decision, reviewer), and by mapping decision values to judgement outcomes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a precise resource (human review queue for graph-dedup same_as matches) and the two actions it supports. This clearly distinguishes it from graph_export/graph_neighbors and the search_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditions for each action: action='list' for pending candidates and filters, action='decide' for recording accept/reject verdicts. It does not name sibling alternatives that would cover the same job, hence 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

investigate_multiA

Investigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Requires ANTHROPIC_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetsYesList of OSINT targets (emails, usernames, domains, IPs). Max 10.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description mentions parallel execution, report generation, and an environment variable requirement. However, it lacks details on error handling, rate limits, report format, or potential side effects. With no annotations, the description carries the full burden but is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise: three sentences covering purpose, outputs, constraints, and requirements. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (multiple targets, parallel, reports) and lack of output schema, the description covers key aspects: purpose, constraints, and env var. Minor gaps in report specifics and error handling prevent a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the description's parameter info ('List of OSINT targets (emails, usernames, domains, IPs). Max 10.') mostly echoes the schema. Therefore, the description adds minimal additional semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool investigates multiple targets in parallel using the full OSINT tool chain, producing individual and summary reports. This distinguishes it from sibling tools which are single-target searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when investigating multiple targets simultaneously, and notes a maximum of 10 targets. It does not explicitly state when to use alternatives, but the context is clear given sibling tools are single-target.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scrape_urlA

Fetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and bot-protection. Returns the page as clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses use of Web Unlocker API, bypasses Cloudflare/CAPTCHA, returns Markdown, and requires env vars. No annotations provided, so description carries burden; covers key aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with action, no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers core purpose and env vars, but lacks output structure details, error modes, or size limits. Sufficient for basic use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (json_output described). Description adds that output is clean Markdown, but doesn't detail URL format or response structure. Adequate but not compensatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches a public URL using Bright Data Web Unlocker API, bypassing protections, and returns Markdown. It distinguishes from sibling search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Specifies required environment variables but lacks explicit when-to-use or when-not-to-use guidance compared to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_abuseipdbA

Check an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0–100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Requires ABUSEIPDB_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description discloses key behaviors: it is a read operation, returns specific fields, shows a warning on high scores, and requires an API key. Lacks details on error handling or rate limits, but is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with action, no redundant information. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one required parameter and no output schema, the description covers return fields, prerequisites, and a special behavior. No gaps for this complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (json_output described). The description helps clarify the ip parameter by mentioning 'IP address', but does not add value beyond the schema for json_output. Partially compensates for missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool checks an IP against the AbuseIPDB API for abuse reputation, specifying the API version and listing return fields. This distinguishes it from generic IP lookup tools among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description mentions the required environment variable and a warning threshold, but does not explicitly contrast this tool with sibling tools like search_ip, leaving usage context implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_breachB

Check if an email appears in data breaches via HaveIBeenPwned. Requires HIBP_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYes
json_outputNoReturn result as structured JSON.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full disclosure burden. It fails to mention what happens on success/failure, rate limits, or return format, leaving significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with purpose, no superfluous words. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, so the description should explain return values, but it only says 'Check if an email appears.' External API context (rate limits, errors) is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, with the json_output parameter described in schema but not elaborated in the description. The email parameter lacks schema description, and the description adds no extra meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Check') and resource ('an email appears in data breaches via HaveIBeenPwned'). It effectively distinguishes from sibling search tools by specifying the HIBP service.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Only mentions the required HIBP_API_KEY env var, but does not provide guidance on when to use this tool versus alternatives, nor any context about when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_censysA

Search Censys for internet-facing infrastructure data. IP address → open ports, services, ASN, country. Domain → certificate history, SANs, issuer, first/last seen. Requires CENSYS_API_ID and CENSYS_SECRET env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states what data is returned for IP and domain, and that env vars are required, but lacks details on rate limits, pagination, error handling, or whether the operation is read-only. The description adds value but is not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main purpose and followed by specific output details and a prerequisite. Every sentence is informative without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only 2 parameters and no output schema, the description adequately covers the main purpose and return values for typical inputs. It mentions required env vars, which is crucial context. However, it could be slightly more complete by hinting at the default output format (JSON or text) when json_output is not used.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only json_output has a description). The description adds context for 'target' by explaining IP→... and Domain→... outputs, but does not specify input format (e.g., IPv4, hostname). It partially compensates for the missing schema descriptions but not completely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches Censys for internet-facing infrastructure data, specifying concrete outputs for IP (open ports, services, ASN, country) and domain (certificate history, SANs, etc.). It distinguishes from sibling tools like search_ip or search_shodan by being Censys-specific and listing unique return data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions required environment variables (CENSYS_API_ID, CENSYS_SECRET) but does not provide explicit guidance on when to use this tool versus alternatives like search_shodan. Usage context is implied but not clearly delineated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_dnsA

Comprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool performs live DNS queries without requiring external APIs or credentials, which implies read-only behavior. However, it does not mention potential limitations like rate limiting, caching, or query timeout. The explanation of email security misconfigurations adds useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the primary action and record types, followed by additional valuable information (email security and credentials). No superfluous words; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, no output schema, no annotations), the description covers the purpose, scope, and a key constraint (no credentials). It could mention the response format or potential delays, but overall it provides adequate context for an agent to understand the tool's capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: only 'json_output' has a description. The description adds overall context but does not directly explain the 'domain' parameter beyond what is implied. For 'json_output', the schema already provides meaning. The description's mention of DNS enumeration indirectly covers the domain parameter, but it does not add explicit parameter-level detail. Baseline is 3 due to moderate schema coverage combined with some contextual support.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it performs comprehensive DNS record enumeration and lists specific record types (A, AAAA, MX, NS, TXT, CNAME, SOA). It also highlights additional email security checks, making the purpose very specific and distinguishable from sibling tools that deal with other data sources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates that no external API or credentials are required, which is a clear usage guideline. However, it does not explicitly state when to use this tool versus alternatives like 'search_censys' or 'search_shodan', though the context implies it's for DNS enumeration. A slight lack of exclusion criteria prevents a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_domainB

Enumerate subdomains of a target domain using sublist3r.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description merely states the action without disclosing behavioral traits such as rate limits, result format, or side effects. The mention of sublist3r hints at external dependency but insufficient detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single concise sentence, front-loaded with action, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, no annotations, and description does not cover result format, error conditions, or scope of enumeration. Leaves significant gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 50% coverage (json_output described). Description adds 'using sublist3r' but does not clarify the domain parameter's format or constraints. No value beyond schema for the domain parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'enumerate', resource 'subdomains of a target domain', and tool 'sublist3r'. Distinct from sibling tools like search_dns or search_breach.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_dns or search_censys. Implicit usage but lacks explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_dorks_liveA

Execute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default — each is a billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the burden of disclosure. It explicitly states tool uses Bright Data SERP API, requires env vars (BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE), and each dork incurs a cost. It also specifies the return format (title, URL, snippet). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with core purpose, no filler. Every sentence adds value: action, data source, result, default limit, billing, env vars.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two parameters and no output schema, the description covers purpose, behavior, requirements, and billing. It lacks details on error handling or edge cases, but is sufficient for an agent to make a decision.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (json_output has description, target does not). The tool description adds context that 'target' is the subject of dork queries and that results are structured, but does not elaborate on target format or constraints. Adequate but not exceptional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool executes Google dork queries for a target via Bright Data SERP API, returning live structured results. This distinguishes it from sibling tools like 'generate_dorks' which likely only generates queries, and 'investigate_multi' which is a broader investigation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a default of up to 5 dorks and that each is a billable API call, providing practical usage guidance. However, it does not explicitly state when to use this tool versus alternatives, though the implication is clear for live execution.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_emailC

Enumerate accounts linked to an email using holehe.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavioral traits. It only says 'enumerate' without explaining whether the tool is read-only, requires permissions, has rate limits, or potentially sends network requests (holehe is a passive enumeration tool but could be interpreted as active).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no unnecessary words. It is appropriately concise for a simple tool, though additional context could be added without harming conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has two parameters and no output schema, the description is incomplete. It does not explain the return format (beyond the json_output flag) or typical response structure (list of accounts, links, or errors). For a simple enumeration tool, more context is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%: json_output has a description, but email does not. The description mentions email in context but does not add format or validation details. The missing email description is partially compensated by the tool's name and context, so score is at baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates accounts linked to an email using holehe, with a specific verb and resource. It distinguishes from sibling tools that search by different identifiers (domain, username, IP, etc.), but could be more precise about what 'accounts' means (e.g., social media profiles).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_breach or search_username. There are no explicit when-to-use or when-not-to-use conditions, nor are alternative tools mentioned for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_footprintA

Collect a target's public search-engine footprint via the Bright Data SERP API. Detects entity type (email, username, domain, phone, or full name) and runs entity-type-aware Google queries, returning structured results and Entity Correlation Graph nodes/edges for discovered domains and profiles. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.
max_queriesNoMax SERP queries (default 3, each is billable).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the process (detects entity type, runs queries, returns structured results and graph nodes/edges) and notes billable queries. Without annotations, some behavioral aspects (side effects, error states) are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, first front-loads action and mechanism, second details outputs and prerequisites. No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers key aspects: purpose, mechanism, prerequisites, and output types. Lacks details on error handling and rate limits, but sufficient for a search tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description adds context that queries are billable and target is an entity. With 67% schema coverage, it partially compensates but does not fully define all parameter behaviors beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it collects a target's public search-engine footprint via Bright Data SERP API, detects entity type, and runs entity-type-aware queries. Distinguishes from siblings that focus on specific data sources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for footprint collection but lacks explicit when-to-use or when-not-to-use guidance. Does not mention alternatives among siblings, though prerequisites (env vars) are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_githubA

Search GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It discloses rate limit differences and response variations based on query type. It doesn't explicitly state safety (read-only), but search is inherently non-destructive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the main purpose and provide essential details without fluff. Every sentence adds distinct value: purpose, behavior details, and rate limit info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers main aspects: query types, response content, rate limit. It lacks explicit mention of default output format (likely text vs JSON). Given no output schema, this is a minor gap but overall sufficient for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% with only json_output described. The description adds meaning for the query parameter by explaining its purpose and behavior logic. This compensates for the undocumented query parameter in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches GitHub for a username, email, or keyword. It distinguishes from sibling tools by naming the platform and specifying behavior differences for exact vs non-exact queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on behavior (exact match returns full profile, other queries top 5) and rate limit with GITHUB_TOKEN. It doesn't explicitly state when to use or alternatives among siblings, but the specificity to GitHub implies usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_ipB

Retrieve geolocation and ASN data for an IP address via ipinfo.io.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should fully disclose behavioral traits. It mentions the data source but does not discuss rate limits, authentication requirements, or whether the operation is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that immediately conveys the tool's purpose. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description could hint at the structure of the returned data. It mentions geolocation and ASN but doesn't outline fields, which would help an agent parse results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (only json_output has a description). The tool description adds no extra meaning for the 'ip' parameter, leaving its expected format (IPv4/IPv6) unspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action (retrieve) and the resource (geolocation and ASN data for an IP address), and distinguishes from sibling tools by specifying the data source (ipinfo.io).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like search_ip2location or search_shodan, nor any context on prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_ip2locationA

Enhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Requires IP2LOCATION_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
json_outputNoReturn result as structured JSON.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description explains what it returns and that it requires an API key. Lacks details on rate limits, error handling, or what happens if key is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-loaded with purpose, no filler. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description lists many returned data points (geolocation, ISP, etc.). Sufficient for a simple lookup tool, though missing details on error responses.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (only json_output has description). Ip parameter lacks description; description does not clarify expected format (IPv4/IPv6). The description adds value by listing output fields but does not compensate for missing ip documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it returns geolocation, ISP, ASN, and detects VPN, proxy, Tor, datacenter hosting, distinguishing it from basic IP tools like search_ip. It also notes it's a sponsored integration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Mentions required environment variable, implying prerequisite. Does not explicitly state when to use vs alternatives, but 'Enhanced' suggests it's for more detailed intelligence. Sibling names provide context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_pasteC

Search Pastebin dumps for an email or username via psbdmp.ws.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but only mentions the source (psbdmp.ws), not rate limits, auth, or result behavior; minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no fluff, but slightly under-specified; appropriate length but could be more structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Does not explain output, json_output effect, or differentiate usage from siblings; incomplete for a simple tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%, and description adds no extra meaning beyond the schema; does not explain query format or json_output behavior to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches Pastebin dumps for an email or username via psbdmp.ws, specifying the verb, resource, and source, distinguishing it from siblings like search_email and search_username.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_email or search_username; lacks context for usage decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_phoneA

Gather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format.

ParametersJSON Schema
NameRequiredDescriptionDefault
phoneYes
json_outputNoReturn result as structured JSON.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully carries the burden. It mentions 'gather carrier and geolocation data' but does not disclose side effects, authentication needs, rate limits, or failure modes. Minimal behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no redundancy. The purpose is front-loaded, and the format instruction is directly useful. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist. The description lacks details on return format (beyond 'geolocation data'), error handling, or limitations. Not sufficiently complete for a data-gathering tool with two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds the essential E.164 format requirement for the 'phone' parameter, which is not in the schema. The json_output parameter's schema description is clear but not enhanced. With 50% schema coverage, the description compensates well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gathers carrier and geolocation data for a phone number using phoneinfoga, and the E.164 format requirement. It is specific to phone numbers, distinguishing it from sibling search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description instructs using E.164 format, but provides no guidance on when to use this tool vs alternatives (e.g., for email or domain searches). No when-not or context exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_shodanA

Query Shodan for host intelligence or banner search. IP address → host lookup (open ports, org, CVEs). Any other string → keyword/service search. Requires SHODAN_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
json_outputNoReturn result as structured JSON.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses behavioral difference based on query type and authentication requirement. However, it omits details like rate limits, error handling, or pagination, making it adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with no filler. First sentence states overall purpose, second provides query-specific guidance and a prerequisite. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and sibling tools, description sufficiently covers what the tool does and how to use it. It explains query types and output option, though return format details (e.g., host info vs banners) are not explicitly described, leaving minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description adds meaning beyond schema: explains that 'query' behaves differently for IP vs other strings. Schema only describes 'json_output' briefly; description adds no additional detail there but compensates for the 50% coverage by contextualizing the main parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool queries Shodan for host intelligence or banner search, and distinguishes between IP address and other strings. This differentiates it from siblings like search_censys and search_ip.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context: use IP for host lookup, any other string for keyword/service search. It also mentions the required SHODAN_API_KEY env var. Does not explicitly exclude alternatives but is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_usernameB

Enumerate platforms where a username is registered using sherlock.

ParametersJSON Schema
NameRequiredDescriptionDefault
usernameYes
json_outputNoReturn result as structured JSON.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions 'using sherlock' but does not disclose behavioral traits such as network usage, rate limits, accuracy, speed, or any side effects. The verb 'enumerate' implies an interactive process, but details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately states the core purpose. It is front-loaded and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and only two parameters, the description is too sparse. It does not explain what the output looks like, how to interpret results, or any operational details (e.g., network requirements). Given sibling tools, more context would help differentiate use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only json_output has a description). The description does not add meaning for the username parameter, and does not clarify the format or constraints beyond what the schema provides. This is inadequate given the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates platforms where a username is registered using sherlock. It specifies a specific verb (enumerate) and resource (platforms for a username), and it distinguishes from sibling tools that focus on emails, domains, IPs, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, nor are there any exclusions or context about prerequisites. The description simply states what it does without helping the agent decide when it is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_virustotalA

Check IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Requires VIRUSTOTAL_API_KEY env var.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
json_outputNoReturn result as structured JSON.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses key behaviors: auto-detection of input type and dependency on VIRUSTOTAL_API_KEY. This adds significant value beyond what the schema provides.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, each serving a purpose: stating function and listing dependencies. No redundant information; it is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks details on return format (except for json_output option), error handling, or pagination. Given the tool has no output schema and the service provides rich data, more context on expected output would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only json_output is described). The description compensates by listing supported input types (IP, domain, URL, file hash) and explaining auto-detection, which clarifies the 'target' parameter's purpose and accepted values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool checks IP, domain, URL, or file hash against VirusTotal's 70+ engines. It distinguishes itself from siblings by supporting multiple input types with auto-detection, unlike sibling tools that handle single types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions auto-detection and the required API key, providing some usage context. However, it does not explicitly state when to use this tool versus sibling tools like search_ip or search_domain, nor does it give conditions to avoid using it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_whoisC

Retrieve WHOIS registration data for a domain.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
json_outputNoReturn result as structured JSON.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must disclose behavioral traits. It only describes the action without mentioning rate limits, data availability, read-only nature, or potential redactions (e.g., GDPR). This is insufficient for informed invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that communicates the core purpose without redundancy. It is appropriately sized, though it could benefit from additional context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is too minimal. It fails to explain what data is returned (e.g., registrar, dates, contacts) or any constraints like domain format. This leaves the agent with insufficient information to handle results properly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, but the tool description adds no extra meaning to either parameter. The 'domain' parameter lacks explanation, and 'json_output' is only partially covered by the schema. The description does not compensate for low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'retrieve' and the resource 'WHOIS registration data' for a domain, which clearly distinguishes it from sibling tools like search_dns or search_domain. It leaves no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like search_domain. There is no mention of prerequisites or context for appropriate use, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 3 tool updatesv2.27.0
    • Addedgraph_export
    • Addedgraph_neighbors
    • Addedgraph_review_candidates
  2. 3 tool updatesv2.23.0
    • Addedscrape_url
    • Addedsearch_dorks_live
    • Addedsearch_footprint
  3. 17 tool updatesv2.16.2
    • First observedgenerate_dorks
    • First observedinvestigate_multi
    • First observedsearch_abuseipdb
    • First observedsearch_breach
    • First observedsearch_censys
    • First observedsearch_dns
    • First observedsearch_domain
    • First observedsearch_email
    • First observedsearch_github
    • First observedsearch_ip
    • First observedsearch_ip2location
    • First observedsearch_paste
    • First observedsearch_phone
    • First observedsearch_shodan
    • First observedsearch_username
    • First observedsearch_virustotal
    • First observedsearch_whois

TDQS

A3.6/5.0
Disambiguation4/5

Tools are mostly distinct, targeting different data sources or operations (e.g., DNS vs. WHOIS for domains, IP geolocation with vs. without VPN detection). Some overlap exists among IP-checking tools, but descriptions clarify their unique focus.

Naming Consistency4/5

The predominant pattern is 'search_<data_source>', which is consistent. A few tools like 'generate_dorks', 'scrape_url', and 'investigate_multi' deviate but are still descriptive. Overall, naming is clear and predictable.

Tool Count4/5

With 20 tools, the count is on the higher side but justified given the comprehensive OSINT scope covering many data sources and operations. It feels well-scoped without being excessive.

Completeness4/5

The tool set covers a broad range of OSINT needs: email breaches, IP intelligence, domain recon, username search, DNS, WHOIS, phone, pastebin, GitHub, etc. Minor gaps exist (e.g., social media scraping beyond usernames), but the surface is largely complete for the stated purpose.

Maintenance

ActivityActive
ResponsivenessResponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    CyberSecurity MCP Server extends Claude with real-time cybersecurity reconnaissance capabilities that Claude doesn't have by default. Instead of manually running 5 different tools across different terminals, just tell Claude "analyze google.com" and get a complete security breakdown instantly. Tools included: * WHOIS Lookup — registrar, ownership, creation/expiry dates * DNS Enumeration — A,
    8
    25
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude, enabling sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools.
    237
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server that exposes 108+ omega-cli OSINT tools for reconnaissance, web analysis, threat intelligence, and reporting, enabling AI assistants to perform comprehensive open-source intelligence tasks.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/OpenOSINT/OpenOSINT'

If you have feedback or need assistance with the MCP directory API, please join our Discord server