OpenOSINT/OpenOSINT

What it solves

OpenOSINT provides a unified, natural-language interface for security researchers and analysts to perform Open Source Intelligence (OSINT) investigations. It eliminates the need to manually run dozens of disparate command-line tools and APIs by using an AI agent to orchestrate and chain investigation tools based on findings.

How it works

The project acts as an AI-driven wrapper around 19 modular investigation tools (such as holehe, sherlock, and various security APIs). The AI agent receives a target in plain language, determines which tools to execute, and pivots based on the results (e.g., finding a username from an email and then searching for that username across platforms). To prevent hallucinations, the AI only issues tool calls, while the actual binaries and APIs execute the data retrieval.

Who it’s for

It is designed for security researchers, threat intelligence analysts, and SOC teams who need to automate the collection of public data on emails, usernames, IPs, domains, and phone numbers.

Highlights

• AI Tool Chaining: Automatically selects and chains tools based on real-time findings.
• 19 Integrated Tools: Covers email, username, breach, WHOIS, IP, subdomain, Shodan, VirusTotal, and more.
• Flexible Interfaces: Available as an interactive REPL, CLI, browser-based Web UI, or an MCP server for integration with clients like Claude Desktop and Cursor.
• Multiple AI Backends: Supports Anthropic Claude, local Ollama, and any OpenAI-compatible endpoint.
• Entity Graph: Optional integration with FollowTheMoney for statement-level provenance and entity deduplication.
• Automated Reporting: Generates PDF and Markdown reports after investigations.