OpenOSINT

OpenOSINT is an open-source-intelligence framework that puts 20 investigation tools behind a natural-language interface, for authorised security research. It runs four ways: an interactive terminal REPL where an agent chooses and chains tools, a direct command-line mode that runs a single tool without any model, an MCP server that exposes every tool to MCP clients, and a browser web interface with streaming output and tool cards.

The agent layer uses native tool-use calls: the model stops to request a tool, the local code executes the real binary or API, and the actual output is returned, so findings cannot be invented by the model. An investigation pivots on what it finds — an email scan that surfaces a username triggers a username search — and the run is written out as Markdown and PDF reports, with session history kept under ~/.openosint/history/.

Tools wrap established OSINT projects and APIs: holehe for email-linked accounts, sherlock for usernames across 300+ platforms, sublist3r for subdomains, phoneinfoga for phone intelligence, python-whois, dnspython, and APIs from HaveIBeenPwned, ipinfo.io, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, GDELT, and Bright Data. --parallel runs complementary tools concurrently.

An entity-graph web view collects statements from each dataset with their extractor, run identifier, and confidence, proposes same_as candidate edges with a score, and lets a reviewer compare two entities field by field and accept or reject the match. The project also runs as a hosted Apify Actor for use without a local Python install.

Features

• Four interfaces: interactive AI REPL, scriptable direct CLI, native MCP server, and a browser web interface
• 20 modular tools: email, username, breach, WHOIS, IP, subdomain, dorks, paste, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, DNS, geolocated news, live dork search, URL scraping, and search-engine footprint
• Tool chaining: the agent selects tools from a plain-language target description and pivots on findings mid-investigation
• Grounded results: the model issues hard-stop tool calls and the local code executes the real tool, so results come from the tool rather than the model
• Three model backends: Anthropic Claude by default, a local Ollama model, or any OpenAI-compatible endpoint
• Reports and history: Markdown and PDF written after every investigation, with all REPL sessions browsable via openosint history
• Parallel execution: --parallel runs complementary tools concurrently
• Entity graph: per-statement provenance, scored same_as candidate edges, and a human review card that clusters accepted pairs
• Cloud run: an Apify Actor exposes email recon without a local install or API keys