badchars/osint-mcp-server

npx osint-mcp-server

Usage

• •Ask the agent to run a full recon on a domain (osint_domain_recon combines DNS + WHOIS + crt.sh + HackerTarget + email security in parallel)
• •Map attack surface of an IP: shodan_host, geoip_lookup, bgp_ip, whois_ip, dns_reverse
• •Enumerate subdomains from multiple sources: crtsh_search, st_subdomains, vt_subdomains, hackertarget_hostsearch
• •Audit email security posture: dns_email_security, dns_spf_chain, m365_tenant

Key features

• ✓37 tools across DNS, WHOIS/RDAP, Certificate Transparency, Shodan, VirusTotal, SecurityTrails, Censys, GeoIP, BGP/ASN, Wayback Machine, HackerTarget, Microsoft 365 and meta recon
• ✓Parallel queries via Promise.allSettled with per-provider rate limiters and TTL caching
• ✓SPF chain analysis with recursive include resolution, loop detection and RFC 7208 lookups
• ✓GitHub Action for CI/CD OSINT checks and CLI mode (--list, --tool)
• ✓Graceful degradation when API keys are missing

Best for

Penetration testing, bug bounty and threat assessment where an agent needs cross-source OSINT correlation in one conversation

Caveats

• ⚠Free-tier rate limits apply: HackerTarget (50/day), ip-api.com (45/min), VirusTotal community (4/min)
• ⚠crt.sh can be slow for large domains; Wayback Machine CDX can timeout for very popular domains
• ⚠RDAP may not cover all TLDs; macOS/Linux tested, Windows not tested
• ⚠For authorized security testing only