Hosted products
Menu
Docs Tools Blog GitHub
Documentation menu

Get started

Use

Reference

Version 2.36.0

Configuration

OpenOSINT starts with zero configuration. A key is only needed by the tool that uses it, plus one AI provider if you use the chat or REPL.

Where settings come from

Highest priority first. The first source to set a variable wins.

  1. Real environment variables.
  2. config.env in the data directory: ~/.openosint/config.env, or $OPENOSINT_HOME/config.env. The web UI saves keys here with user-only permissions where the OS supports it.
  3. A .env file, found by searching upward from the directory you run openosint from, or the file named by OPENOSINT_ENV_FILE.

For the MCP server, set the variables in the client's env block; see MCP server.

API keys and tokens

This table is generated from the key catalog in the code, so it matches the version you install.

Variable Used by Needed Notes
ANTHROPIC_API_KEY chat one provider Powers the chat. Alternatives: an OpenAI-compatible server (Settings) or free local Ollama.
OPENAI_API_KEY chat one provider Local servers may not need one.
OPENAI_BASE_URL chat one provider Alternative to Anthropic: OpenRouter, LiteLLM, vLLM, llama.cpp… e.g. https://openrouter.ai/api/v1 or http://localhost:4000/v1
OPENAI_MODEL chat one provider
ABUSEIPDB_API_KEY search_abuseipdb required for those tools Free tier available.
BRIGHTDATA_API_KEY search_dorks_live, scrape_url, search_footprint required for those tools A free tier (5,000 requests/month) is available. OpenOSINT earns a referral commission if you sign up through this link.
BRIGHTDATA_SERP_ZONE search_dorks_live, search_footprint required for those tools Your Bright Data SERP API zone name (e.g. 'serp_api1'); create the zone in the dashboard.
BRIGHTDATA_UNLOCKER_ZONE scrape_url required for those tools Your Bright Data Web Unlocker zone name (e.g. 'web_unlocker1'); create the zone in the dashboard.
CENSYS_API_ID search_censys required for those tools
CENSYS_SECRET search_censys required for those tools
HIBP_API_KEY search_breach required for those tools Paid subscription.
IP2LOCATION_API_KEY search_ip2location required for those tools Sponsor of OpenOSINT.
SHODAN_API_KEY search_shodan required for those tools Free tier available.
VIRUSTOTAL_API_KEY search_virustotal required for those tools Free tier available.
GITHUB_TOKEN search_github optional search_github works without it; a token raises the rate limit.
IPINFO_TOKEN search_ip optional search_ip works without it; a token raises the rate limit.

These tools need no key: search_email, search_username, search_whois, search_ip, search_domain, generate_dorks, search_paste, search_phone, search_github, search_rdap, search_dns, search_gdelt_geo. Tools that are noisy or touch the target also need --allow-active; see the tools reference.

Behaviour settings

Variable Default Purpose
OPENOSINT_ALLOW_ACTIVE off 1 enables active tools. Same as --allow-active.
OPENOSINT_MAX_TOOL_CALLS 15 Maximum calls per user request.
OPENOSINT_MAX_TOOL_CALLS_MULTI 30 One shared cap for investigate_multi across all targets.
ANTHROPIC_MODEL claude-sonnet-5 Model requested from Anthropic. OPENOSINT_MODEL still works but is deprecated.
OPENOSINT_HOME ~/.openosint Data directory: config.env, graph.db, session history.
OPENOSINT_GRAPH_DB $OPENOSINT_HOME/graph.db Overrides only the graph database path.
OPENOSINT_ENV_FILE unset Explicit path to a .env file. A bad path is an error.
OPENOSINT_PROXY_URL unset Upstream proxy (http://, https:// or socks5://) for web-facing tools. --proxy overrides it.
OPENOSINT_ALLOWED_HOSTS loopback names Extra Host values the web UI accepts, comma-separated.
OPENOSINT_ALLOWED_ORIGINS unset Extra browser origins allowed to call /api/*.
OPENOSINT_ALLOW_REMOTE off 1 is the same as --allow-remote for openosint web.
OPENOSINT_SETUP_TOKEN unset Lets a non-loopback browser save keys, sent as X-Setup-Token.
OPENOSINT_GDELT_WINDOW_HOURS 6 (max 24) Hours of news the globe keeps in memory.
OPENOSINT_GDELT_MAX_ARTICLES 30000 Hard cap on stored news articles; oldest are dropped first.
OPENOSINT_GDELT_USE_PROXY off Route GDELT downloads through the proxy.

A real environment variable always wins over a saved value, and the web UI says so when that happens.

A .env file

Create a file named .env in the directory you work from:

ANTHROPIC_API_KEY=sk-ant-...
SHODAN_API_KEY=your-key

Edit this page on GitHub