OpenOSINT: AI-Powered OSINT Investigation Agent
An AI-driven OSINT agent for security researchers and analysts, offering 19 investigation tools behind a natural-language interface, usable as a REPL, CLI, MCP server, or Web UI.
Evidence: Tools invoke external binaries and APIs on demand, but least privilege is not explicitly addressed; user confirmation is absent, AI chains tools automatically; data flow transparency is partial (e.g., API keys passed directly), but details are lacking; sensitive data handling has basic statements (e.g., keys not touching servers), but no log redaction; dependency security has version ranges but no audit; external effects have legal disclaimers; rollback is not mentioned; source attribution is present for tools. Deductions: lack of user confirmation, rollback, and insufficient detail on data flow and sensitive data handling.
Evidence: README and pyproject versions match (2.25.0); tool descriptions align with tests; dependencies have version ranges but not pinned; external binaries rely on PATH; failure messages are descriptive (e.g., missing API key returns error string). Deductions: dependency availability not fully guaranteed, external binary absence only returns error.
Evidence: Audience is security researchers and analysts, scenarios clear; capability boundaries are defined via tool list and external dependencies; trigger precision has CLI arguments and tool selection logic; environment fit supports multiple AI backends and deployment modes. Deductions: tool trigger conditions not detailed, environment fit depends on external services.
Evidence: Information architecture is clear (README, docs, tests); install notes are detailed; naming is stable (tool names consistent); examples and FAQ present (README examples); known limitations partially mentioned (e.g., external binary absence); MIT license explicit; version exists but no changelog; maintenance responsibility has security policy. Deductions: missing changelog, known limitations not comprehensive.
Evidence: Output formats are diverse (text, JSON, reports), usability high; marginal value high (19 tools); cost-benefit has free tier and paid options, but no detailed assessment. Deductions: cost-benefit analysis insufficient.
Evidence: README claims functionality, tests cover some tools; cross-source verification limited (relies on third-party APIs); fact-inference separation not explicit. Deductions: lack of independent verification, fact-inference separation not clear.
- AI chains tools automatically without user confirmation, potentially executing unintended actions.
- External binaries rely on PATH; absence only returns error, potentially affecting functionality.
- API keys are passed directly without explicit log redaction, posing leakage risk.
- Dependencies are not pinned, posing supply chain risk.
What does this agent do, and when should you use it?
OpenOSINT is an AI-powered open-source intelligence (OSINT) agent that integrates 19 modular investigation tools behind a natural-language interface. It provides an interactive REPL, CLI, MCP server, and browser-based Web UI, supporting multiple AI backends (Anthropic Claude, local Ollama, or OpenAI-compatible endpoints). Tools include email, username, breach, WHOIS, IP, subdomain, phone, Shodan, VirusTotal, Censys, AbuseIPDB, DNS, and more. The execution model ensures the AI issues tool calls, and your code executes the real binaries, making hallucinated findings structurally impossible. The tool is intended for legal and authorized security research only, licensed under MIT.
OpenOSINT takes a natural-language target (email, username, domain, IP, phone) via REPL, CLI, MCP, or Web UI, and the AI agent selects and chains tools. For example, for an email, it runs search_email (holehe), search_username (sherlock), search_breach (HaveIBeenPwned), etc., and generates reports in Markdown/PDF. Tools are executed locally via binary or API calls, and the AI only issues tool calls. It supports parallel execution, session history, and a Web UI with streaming output.
- A security analyst investigates a leaked email to find linked social accounts and breach exposure.
- A threat intelligence team performs IP reputation checks using AbuseIPDB and Shodan.
- A pentester enumerates subdomains and DNS records to discover attack surface.
- A fraud investigator identifies carrier and location for a phone number.
- A researcher runs the agent fully offline using Ollama with local models.
- A developer integrates the 19 tools into custom workflows via the MCP server.
What are this agent's strengths and limitations?
- AI-driven tool chaining that pivots on findings automatically (e.g., email to username).
- Model-agnostic: supports Anthropic, Ollama, and OpenAI-compatible endpoints, enabling fully local operation.
- 19 tools covering email, username, breach, IP, DNS, Shodan, VirusTotal, etc., with extensive API integrations.
- Exposes all tools natively as an MCP server, simplifying integration with Claude Code and other clients.
- Supports parallel execution, Web UI, and automatic report generation (Markdown/PDF).
- Several tools rely on external APIs (e.g., VirusTotal, AbuseIPDB) requiring API keys, which may incur costs.
- External binaries (holehe, sherlock, etc.) must be installed manually; missing binaries disable corresponding tools.
- AI agent requires a cloud service or local model; local models may be slower or less capable.
- Strictly for authorized use; legal and compliance risks are the user's responsibility.
- Commercial support is not included with the MIT license and requires purchasing a plan.
How do you install or deploy this agent?
Install via pip: pip install openosint. External binaries (holehe, sherlock, sublist3r, phoneinfoga) must be in PATH. Optional API keys like ANTHROPIC_API_KEY (or Ollama/OpenAI config), HIBP_API_KEY, SHODAN_API_KEY, VIRUSTOTAL_API_KEY etc. are loaded from a .env file. Docker users can docker compose up --build.
How do you use this agent?
Run openosint to start the interactive REPL and type a target like investigate [email protected]. Alternatively, use CLI subcommands like openosint email [email protected] or openosint web for the Web UI. For MCP, add the server via claude mcp add openosint python /absolute/path/to/OpenOSINT/openosint/mcp_server.py. Configure the .env file with required keys, then invoke tools.
How does this agent compare with similar options?
Comparable tools include standalone tools like sherlock and maltego, but OpenOSINT integrates an AI agent and multiple tools.