MCP Maltego

mcp-maltego

Maltego OSINT for AI agents.

Run transforms and Machines, build and analyse link graphs, and hand the result back to Maltego as a native .mtgx , from Claude, Gemini, Codex, Copilot, Cursor or any MCP client.

---

mcp-maltego is a high-performance Model Context Protocol server that turns any AI agent into an expert Maltego operator. It runs real OSINT transforms, chains them into autonomous reconnaissance Machines, maintains an in-memory or graph database investigation state with full provenance, recommends next-best pivots, and synchronizes seamlessly with Maltego Desktop via native .mtgx files.

[!TIP]

Zero-Cost & No Commercial Maltego License Required: You do not need a paid Maltego Pro/XL plan or commercial API keys to start. mcp-maltego runs completely free out of the box, generating native .mtgx graphs compatible with the free Maltego Community Edition (CE) or Basic tier.

---

🏛️ Layered Architecture: From Zero-Cost Core to Full Platform

mcp-maltego is built in three decoupled layers so you can start instantly without cloud infrastructure or configuration overhead:

---

Key features

• 20 tools, portable to every model. Flat JSON schemas validated against Gemini's strict function-calling subset; variants grouped with an action parameter so agents are not flooded with tools.
• 45 real transforms out of the box. 33 without API keys (DNS over HTTPS, RDAP/WHOIS, CISA KEV active exploitation, Abuse.ch URLhaus malware, certificate transparency via crt.sh and CertSpotter, HackerTarget, urlscan.io, Shodan InternetDB, Team Cymru & RIPE Stat ASN/netblocks, Gravatar, GitHub profile details, AlienVault OTX threat pulses, multi-network profile lookup, Mempool.space Bitcoin UTXO transactions & inputs/outputs, Common-Input Ownership Heuristic (CIOH) clustering, OFAC SDN crypto sanctions check, VASP/Exchange touchpoints, parsing) and 12 provider transforms that switch on when you set a key: VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, Have I Been Pwned, GreyNoise and Tatum.
• Community Extensibility Engine (`@custom_transform`). Drop custom Python transform files in ~/.maltego-mcp/plugins/ or ./plugins/ to immediately expose custom OSINT logic to LLMs without touching core code.
• Your Maltego transforms too. Speaks the Maltego TRX/iTDS XML protocol, so an agent can run the same transforms you use in Maltego.
• Machines. DomainRecon, InfrastructureRecon, EmailRecon, CompanyFootprint, PersonalFootprint, PersonaFootprint, CryptoFlowRecon, URLRecon, ThreatSweep, ASNToNetblocks and your own in TOML, with recursive rounds and cost budgets.
• Cryptoforensics & Blockchain AML Traceability. Native ontology for cryptocurrency entities (maltego.CryptoCluster, maltego.VASPExchange, maltego.MixerContract, maltego.DeFiBridge), multi-hop transaction flow tracing, peeling chain and tumbler heuristics, OFAC SDN sanctions screening, and VASP deposit touchpoint detection.
• Multi-Case Isolation & Modular Project Scoping. Synchronized global project selector in the Topbar and live graph, paired with decoupled per-module focus selectors (defaulting to [Follow Active Case]), strictly preventing cross-contamination between independent forensic cases.
• Case Lifecycle & Atomic Purging. Safe, permanent removal of ad-hoc or temporary investigations with interactive confirmation, atomic deletion of entities and links from the graph store, local cache and evidence purging, and automated fallback to the next available case.
• HUMINT, Breach Router & Multi-Agent Swarms. Native humint.* entity ontology (humint.Alias, humint.Organization, humint.LocationHistory, humint.PsychologicalTrait), cross-platform pseudonym correlation, subject behavioral profiling ([Hipótesis]), chronological anomaly detection, weighted relationships, a local SQLite
• k-Anonymity/XposedOrNot breach router (BreachSemanticPivot), and multi-agent case fork/delegate/merge with optimistic locking.
• An investigation copilot. osint_investigate does detection, case creation, the right Machine, scoring and recommendations in one call. Every step is remembered (what, on what, why, result), every entity has explainable provenance and a priority score, and next-best-action learns from how each transform performed.
• Native Maltego round-trip. .mtgx export with hierarchical, radial or force-directed layout and the investigation memory embedded; .mtgx import; local transforms inside Maltego Desktop to open a case, expand neighbours and send entities back to the agents; import of your exact Maltego entity ontology.
• Reports and CLI. Executive reports in Markdown or self-contained HTML, and maltegoctl for terminals and CI.
• Safe by default. OSINT content is treated as untrusted data, XML is parsed with defusedxml, archives are read with bounds, agents cannot supply arbitrary URLs, and API keys are never logged.

Community Contributions & Governance

We welcome contributions! All contributions are subject to our Contributing Guide. Pull requests are automatically analyzed by our AST Security & Blast Radius CI scanner, and all merges require manual sign-off by repository owner @Data-Unix.

Requirements

• Node.js 18 or newer (for npx).
• uv — manages the Python 3.12 runtime automatically (if uv is not installed yet, mcp-maltego installs it automatically into ~/.maltego-mcp/bin on first run).

Prepare the runtime, ~/.maltego-mcp/.env template, Maltego Desktop bridge .mtz, and global CLI launchers (mcp-maltego, maltego-mcp, maltegoctl, maltego-mcp-bridge in ~/.local/bin / %USERPROFILE%\.local\bin added to your PATH) in one command:

npx -y mcp-maltego setup

You can also choose a specific deployment mode or client target on any OS / distribution (Windows PowerShell/CMD, macOS, Ubuntu/Debian, Kali, Fedora/RHEL, Arch, Alpine):

npx -y mcp-maltego setup --mode global              # (Default) Global CLI in ~/.local/bin + PATH (run from any directory)

npx -y mcp-maltego setup --mode local # Isolated inside ~/.maltego-mcp without modifying PATH npx -y mcp-maltego setup --mode http # Prepare + print Streamable HTTP server startup npx -y mcp-maltego setup --client claude # Print ready-to-use config for a specific client (claude|gemini|codex|copilot|cursor|all)

Getting started

Standard configuration, valid for most MCP clients:

{

"mcpServers": { "maltego": { "command": "npx", "args": ["-y", "mcp-maltego"] } } }

Then ask your agent:

Investigate example.com, give me the summary of the case and export it for Maltego.

📦 Installation & First Deploy by Operating System

🍏 macOS (Apple Silicon M1/M2/M3/M4 & Intel Core)

Native support for arm64 (Apple Silicon) and x86_64 (Intel). Zero C/C++ compilation or Xcode Command Line Tools required.

1. Prerequisite: Node.js 18+ (brew install node or official package).
2. One-Command Autonomous Setup:

   npx -y mcp-maltego setup

*Auto-detects your CPU architecture, installs standalone uv, provisions isolated Python 3.12 runtime inside ~/.maltego-mcp, creates .env template, generates Maltego Desktop .mtz configuration, and links global CLI commands (maltegoctl, mcp-maltego) into ~/.zshrc and ~/.zprofile.*

1. Launch the Interactive Command Center / Dashboard:

   maltegoctl dashboard

*(Automatically launches http://127.0.0.1:8000/dashboard in Safari / Chrome with interactive graph visualization and CTI vault).*

1. Environment Health Check:

   maltegoctl doctor

1. Maltego Desktop CE Integration (`/Applications/Maltego.app`):

• Generate local transforms: maltegoctl mtz
• In Maltego Desktop: Go to Import \| Export → Import Config and select ~/.maltego-mcp/maltego-mcp-local.mtz.

---

🪟 Windows (Windows 10 / 11 · PowerShell & Terminal)

1. Prerequisite: Node.js 18+ (winget install OpenJS.NodeJS or official installer).
2. One-Command Setup:

   npx -y mcp-maltego setup

*Provisions standalone uv.exe in %USERPROFILE%\.maltego-mcp\bin, installs global .cmd / .ps1 shims in %USERPROFILE%\.local\bin, and updates Windows User PATH and PowerShell profiles.*

1. Launch Dashboard:

   maltegoctl dashboard

---

🐧 Linux (Ubuntu, Debian, Kali Linux, Arch, Fedora)

1. Prerequisite: Node.js 18+ and curl.
2. One-Command Setup:

   npx -y mcp-maltego setup

1. Launch Dashboard:

   maltegoctl dashboard

<summa