OpenOSINT/OpenOSINT

OpenOSINT – AI‑driven OSINT assistant

What it is – OpenOSINT is a self‑hosted, MIT‑licensed Python package that wraps 21 public‑source intelligence (OSINT) utilities behind a natural‑language interface. An LLM (Claude, Ollama, or any OpenAI‑compatible model) acts as an “agent” that decides which tool to run, runs them, and chains the results into a concise investigation report. The same tool set can be accessed via:

• an interactive REPL (openosint),
• a CLI (openosint email …),
• a browser‑based chat UI (openosint web), or
• a Model Context Protocol (MCP) server that any MCP‑compatible client can call.

Key capabilities

Feature	Details
AI‑driven tool chaining	Describe a target in plain English; the LLM picks relevant OSINT tools, runs them, and stitches the findings together.
21 modular tools	Email, username, breach, WHOIS, IP, sub‑domain, DNS, dorks, live dork search, paste‑bin, phone, Shodan, VirusTotal, Censys, IP2Location, AbuseIPDB, GitHub, RDAP, GDELT geo‑news, URL scraping, footprint extraction.
Three AI back‑ends	Anthropic Claude (default), local Ollama, or any OpenAI‑compatible endpoint (LiteLLM, vLLM, LM Studio, etc.).
MCP server	Exposes the passive tools (20 by default) via the open‑source Model Context Protocol; can be started with openosint-mcp.
Passive‑by‑default mode	Only tools that query third‑party APIs or compute locally are offered. “Active” tools that contact the target’s infrastructure are hidden unless you enable them (--allow‑active).
Parallel execution	--parallel runs independent tools concurrently using asyncio.gather().
Automatic reporting	After each investigation a Markdown (and optional PDF) report is saved under reports/.
Session history	REPL sessions are stored in ~/.openosint/history/ and can be listed with openosint history.
Web UI	Browser‑based chat with streaming LLM output, tool cards, and light/dark themes.
Cloud option	The same tools are offered as pay‑per‑use Apify Actors; a live demo is available at https://demo.openosint.tech.

How to get started

# Install the package (Python 3.9+)
pip install openosint

# Start the default AI REPL (Claude will be used if you have an Anthropic key)
openosint

# Or launch the web UI
openosint web

# Run a single tool without AI
openosint email target@example.com

You’ll need API keys for the services you intend to use (e.g., HaveIBeenPwned, Shodan, VirusTotal, IP2Location, Bright Data, etc.). Keys are passed via environment variables as documented in the per‑tool docs.

Tool‑level overview (excerpt)

• search_email – uses holehe to list social accounts linked to an email (noisy, off by default).
• search_username – uses sherlock to probe 400+ sites for a username (noisy, off by default).
• search_breach – queries HaveIBeenPwned for breach exposure.
• search_whois – pulls WHOIS data via python‑whois.
• search_ip – IP geolocation via ipinfo.io.
• search_dns – DNS record lookup with dnspython; DKIM probing is only enabled in active mode.
• search_shodan, search_virustotal, search_censys, search_abuseipdb – read‑only lookups against their respective APIs.
• search_dorks_live / search_footprint – Google SERP queries via Bright Data (passive, but the target’s query is sent to Bright Data).
• scrape_url – fetches a URL through Bright Data’s Web Unlocker (touches the target, disabled by default).

Safety & limits

• Passive mode protects you from unintentionally hitting the target’s servers; active tools must be explicitly enabled.
• Each investigation is capped at 15 tool calls (30 for investigate_multi) to avoid runaway usage.
• All third‑party API calls are visible to the respective providers; the README stresses that “Passive is not private.”
• Legal disclaimer: use only on targets you are authorized to investigate.

Installation & licensing

• Installable via PyPI (pip install openosint).
• MIT license (see LICENSE).
• The project also publishes an MCP server binary (openosint-mcp) that can be run with uvx without a separate install.

---

Bottom line – OpenOSINT is a genuine, open‑source AI‑augmented OSINT platform that lets security analysts drive a suite of public‑source tools through natural language. It combines LLM‑based orchestration, a flexible MCP API, and both self‑hosted and cloud‑hosted execution paths, making it a useful building block for automated intelligence workflows.