OpenOSINT — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow provider and collection-tool changes because public-source coverage evolves

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Security researchers and analysts conducting authorized OSINT investigations.

What we know

An open-source OSINT agent exposing investigation tools through CLI, web UI and MCP.

Maintenance / activity evidence

Observed Oct 1, 2026 (UTC)Merge pull request 68 from OpenOSINT/launch/one-command-install

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Broad OSINT/security lookups. Writes: Report/history writes.
Provider/API-key dependent
Sensitive access: Identity data, Breach data, Infrastructure indicators

OSINT queries can involve sensitive personal/security data and external intelligence providers; use only for authorized purposes.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,700 repository stars · 2.7k package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Which OSINT sources and MCP tools are currently maintained?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

OSINT queries can involve sensitive personal/security data and external intelligence providers; use only for authorized purposes.
Broad OSINT/security lookups.
Provider/API-key dependent
Targets and results may be stored in local history/reports and sent to third-party intelligence services.
Reviewed write actions: Report/history writes
Sensitive access: Identity data, Breach data, Infrastructure indicators
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Authorized and legal use only.
Many tools depend on third-party APIs or binaries.
Public demo should not receive private content.

Original activity observations

2026-10-01T16:43:50Z: Merge pull request 68 from OpenOSINT/launch/one-command-install

Technical identity

github.com/openosint/openosint

Exact implementation source: https://github.com/openosint/openosint ↗
Reviewed resource type: MCP Server
Repository identity: OpenOSINT/OpenOSINT
Package identity: pypi:openosint

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
openosint/openosint
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
pypi.org/project/openosint/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

generic

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
OpenOSINT provides a local OSINT application and a separate MCP server with passive tools by default.
mcp stdio launcher or diagnostic · Publisher instructions
uvx --from openosint openosint-mcp
Configure / authenticate
Publisher instructions
OpenOSINT supports keyless passive mode via uvx --from openosint openosint-mcp; active tools require explicit --allow-active and external API keys. Never conduct active reconnaissance as setup validation.
Check connection
Suggested check
Read-only passive public metadata only, keeping third-party query privacy notices.
Remove / uninstall / revoke
MCP100 setup guide
Only for exact host registration openosint. Local history/graph and third-party API credentials persist unless separately deleted.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove openosint

Official Documentation & Sources

What it does

An open-source OSINT agent exposing investigation tools through CLI, web UI and MCP.

Capability: Search & Web
Resource type: MCP Server
Industry: Cybersecurity
Best fit: Security researchers and analysts conducting authorized OSINT investigations.

Representative uses

Investigate emails, usernames, phones, domains and IPs
Run WHOIS/DNS/RDAP/subdomain lookups
Use Shodan, VirusTotal, Censys and AbuseIPDB
Save reports

Limitations

Authorized and legal use only.
Many tools depend on third-party APIs or binaries.
Public demo should not receive private content.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Provider/API-key dependent
Permissions: Broad OSINT/security lookups.
Data handling: Targets and results may be stored in local history/reports and sent to third-party intelligence services.
Cost: freemium
Risk and cautions: OSINT queries can involve sensitive personal/security data and external intelligence providers; use only for authorized purposes.

Access scope and cautions

Write actions: Report/history writes
Sensitive access: Identity data Breach data Infrastructure indicators
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Investigate emails, usernames, phones, domains and IPs; Run WHOIS/DNS/RDAP/subdomain lookups; Use Shodan, VirusTotal, Censys and AbuseIPDB; Save reports.

What setup and authentication are documented?

Recorded installation/entrypoint step: pip install openosint. Recorded transport: stdio. Prerequisites: Python. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Provider-specific API keys as required.

Can it modify data or perform write operations?

Documented write actions include: Report/history writes. Recorded permission boundary: Broad OSINT/security lookups.

What data-handling boundary should I consider?

Targets and results may be stored in local history/reports and sent to third-party intelligence services. Recorded sensitive-access context: Identity data; Breach data; Infrastructure indicators.

What limitations and risks should I check before use?

OSINT queries can involve sensitive personal/security data and external intelligence providers; use only for authorized purposes. Authorized and legal use only. Many tools depend on third-party APIs or binaries. Public demo should not receive private content. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

OpenOSINT is listed as Community implementation in MCP100’s current evidence.