OSINT Toolbox

osint-toolbox-mcp

An MCP server that lets AI agents run classic OSINT tools on your own machine: Sherlock, Maigret, Blackbird, Holehe, GHunt, theHarvester, SpiderFoot, subfinder, dnstwist, dnsrecon, PhoneInfoga and ExifTool, plus built-in WHOIS, DNS, certificate transparency and Wayback Machine lookups. No API keys and no cloud service in between: the tools run locally and query public sources directly.

Ask your assistant "which sites have an account for jane@example.com?" or "what can you find about example.com?", and it picks the tools, runs them and reads the results for you.

Features

Only installed tools are offered to the agent. Runs take from seconds to half an hour (a full SpiderFoot scan); requests run in parallel and can be cancelled.

Quick start

Pick one:

• Docker: every tool but Blackbird in one image, nothing else to install.
• uvx: one command installs the tools on your machine, without admin rights.

Docker

The image is large, so pull it once before adding the server; otherwise the first start can take longer than your client waits:

docker pull ghcr.io/renkagod/osint-toolbox-mcp

Add the server to your client:

{

"mcpServers": { "osint-toolbox": { "command": "docker", "args": ["run", "-i", "--rm", "ghcr.io/renkagod/osint-toolbox-mcp"] } } }

Files for ExifTool, the GHunt login, API keys and proxies are covered in Docker details.

uvx

Install uv, then install the tools. This installs everything that is missing and checks that each tool starts; see Install the tools for what it does:

uvx osint-toolbox-mcp --install

Add the server to your client:

{

"mcpServers": { "osint-toolbox": { "command": "uvx", "args": ["osint-toolbox-mcp"] } } }

To run the latest code from main instead of a release, use uvx --from git+https://github.com/renkagod/osint-toolbox-mcp osint-toolbox-mcp.

Connect your client

One-click install:

Claude Desktop: download osint-toolbox-mcp- .mcpb from the latest release and open it. Claude Desktop installs it as an extension and asks for the optional SpiderFoot, Blackbird and ExifTool locations; the other tools are found on PATH. You can also paste the JSON above into Settings → Developer → Edit Config.

Claude Code:

claude mcp add osint-toolbox -- uvx osint-toolbox-mcp

claude mcp add osint-toolbox -- docker run -i --rm ghcr.io/renkagod/osint-toolbox-mcp

Clients that read the `mcpServers` JSON above (paste it into the file):

Clients with their own format (shown with uvx; for Docker, use docker with the arguments run -i --rm ghcr.io/renkagod/osint-toolbox-mcp):

VS Code

code --add-mcp '{"name":"osint-toolbox","command":"uvx","args":["osint-toolbox-mcp"]}'

Or in .vscode/mcp.json:

{

"servers": { "osint-toolbox": { "type": "stdio", "command": "uvx", "args": ["osint-toolbox-mcp"] } } }

Codex CLI

codex mcp add osint-toolbox -- uvx osint-toolbox-mcp

Or in ~/.codex/config.toml, with a longer timeout for slow scans:

[mcp_servers.osint-toolbox]

command = "uvx" args = ["osint-toolbox-mcp"] tool_timeout_sec = 1800

Zed

In settings.json:

{

"context_servers": { "osint-toolbox": { "command": "uvx", "args": ["osint-toolbox-mcp"], "env": {} } } }

Goose

In ~/.config/goose/config.yaml:

extensions:

osint-toolbox: name: osint-toolbox type: stdio cmd: uvx args: [osint-toolbox-mcp] enabled: true timeout: 1800

opencode

In opencode.json:

{

"$schema": "https://opencode.ai/config.json", "mcp": { "osint-toolbox": { "type": "local", "command": ["uvx", "osint-toolbox-mcp"], "enabled": true } } }

Continue

In .continue/mcpServers/osint-toolbox.yaml:

name: OSINT Toolbox

version: 1.0.0 schema: v1 mcpServers:

• name: osint-toolbox type: stdio command: uvx args:
• osint-toolbox-mcp

Install the tools

Skip this if you use Docker, unless you want Blackbird.

uvx osint-toolbox-mcp --install

installs every tool that is missing, without admin rights, then checks that each one starts. uvx osint-toolbox-mcp --install sherlock maigret installs only the tools named. It needs uv and:

• puts each Python tool (Sherlock, Holehe, Maigret, GHunt, theHarvester, dnstwist, dnsrecon) in its own environment with uv tool install, on Python 3.12: their dependencies conflict with each other, and some have no builds for newer Pythons. theHarvester and dnsrecon come from their latest GitHub releases;
• downloads SpiderFoot and Blackbird from GitHub, each with its own virtual environment;
• downloads PhoneInfoga, subfinder and ExifTool and checks them against the checksums their authors publish. On macOS and Linux, ExifTool needs Perl, which those systems usually have.

Checkouts and downloads go to %LOCALAPPDATA%\osint-toolbox-mcp on Windows, ~/Library/Application Support/osint-toolbox-mcp on macOS and ~/.local/share/osint-toolbox-mcp on Linux; set OSINT_TOOLBOX_HOME to use another folder. The server looks there by itself. GHunt still needs a one-time ghunt login afterwards.

uvx osint-toolbox-mcp --check shows, at any time, every tool as ok, missing (with how to install it) or broken (found but fails to start). The agent can ask the same through the osint_toolbox_status tool.

Installing by hand

| dnsrecon | `