OpenOSINT documentation
OpenOSINT is an open-source engine for passive checks of public information. It wraps 21 investigation tools (DNS, WHOIS and RDAP, IP intelligence, breach lookups, GitHub, news and more) behind one interface. An AI agent can pick and chain the tools for you, or you can run each one directly.
This documentation covers version 2.36.0. The code is MIT licensed and needs Python 3.10 or newer.
Who it is for
Security researchers, analysts and developers who want repeatable lookups on domains, IP addresses, emails and usernames, with every finding shown next to the tool call that produced it. Use it only on targets you are allowed to investigate; see Safety.
Three ways to use it
- CLI and REPL: direct subcommands such as
openosint dns example.com, plus an interactive session where the agent chooses the tools. - MCP server: the same tools inside Claude Desktop, Claude Code, Cursor or any MCP client.
- Web UI: a local browser app with chat, a news globe and a graph view.
How it behaves
- Passive by default. Tools that touch the target or send many requests from your IP are off until you opt in. See Safety.
- Real results only. Tools run as Python code; only their actual output reaches the model. AI summaries are leads to verify, not proof.
- Most tools need no key. Some need an API key; the configuration page lists which.
Where to go next
- Install it.
- Run your first investigation in the quickstart.
- Browse the tools reference.
For a hosted version with no setup, see Monitor and Diligence.