Safety and responsible use
OpenOSINT is built so that a default install does not touch your target and cannot run away with requests.
Passive by default
In passive mode agents and MCP clients are only offered tools that query third-party data sources or compute locally. Tools that touch the target's infrastructure, or send many requests about it from your IP, are not just refused: they are not offered to the model at all, and an MCP client does not see them in tools/list. If a disabled tool is requested anyway, it returns a structured disabled_in_passive_mode result that says how to enable it.
Enable active tools only when you mean to:
| Where | How |
|---|---|
| CLI and REPL | openosint --allow-active ... |
| Any process | OPENOSINT_ALLOW_ACTIVE=1 |
| Web UI | Settings, "Enable active tools" (local installs only) |
| MCP server | openosint-mcp --allow-active, or OPENOSINT_ALLOW_ACTIVE=1 in the client's env |
A publicly reachable or demo web instance can never enable active tools, whatever its settings.
Tool-call cap
Each user request may spend at most OPENOSINT_MAX_TOOL_CALLS tool calls (default 15); every new message starts a fresh budget. investigate_multi shares one cap across all its targets (OPENOSINT_MAX_TOOL_CALLS_MULTI, default 30). When the cap is reached the investigation stops with an explicit message and keeps the results so far.
Noise labels
| Level | Meaning |
|---|---|
| passive | Queries third-party data sources or computes locally. Standard DNS lookups are the one indirect exception: they reach the target's nameservers through your resolver. |
| touches target | Makes requests the target's own infrastructure can see. |
| noisy | High request volume, or requests to many services about the target. Expect rate limits, blocks and possible alerts. |
| unverified | Network behaviour not yet confirmed with a traffic capture. Treated as non-passive. |
| inherits | A fan-out tool that only runs what the current mode allows. |
What each tool actually sends, generated from the code:
| Tool | Level | Default | What it actually sends, and where |
|---|---|---|---|
generate_dorks |
passive | on | Builds Google search URLs locally; sends nothing. |
graph_export |
passive | on | Reads the local graph database only. |
graph_neighbors |
passive | on | Reads the local graph database only. |
graph_review_candidates |
passive | on | Reads the local graph database only. |
investigate_graph |
inherits | on | Chains tools from a seed; in passive mode it routes only to passive tools. |
investigate_multi |
inherits | on | Runs one agent per target under a shared tool-call cap; passive unless active is enabled. |
scrape_url |
touches target | off | Bright Data fetches the URL, so the target's server logs a request (from Bright Data's IP, not yours). |
search_abuseipdb |
passive | on | One request to api.abuseipdb.com. |
search_breach |
passive | on | One request to haveibeenpwned.com. |
search_censys |
passive | on | Censys API; returns data Censys already holds. |
search_dns |
passive | on | Record lookups go through your DNS resolver; the target's nameservers see the resolver, not you. Active part: DKIM selector probes (enumeration) run only with active tools enabled. |
search_domain |
noisy | off | sublist3r scrapes several search engines and aggregators from your IP; expect captchas and blocks. |
search_dorks_live |
passive | on | Google results via Bright Data; the target is sent to those two services. |
search_email |
noisy | off | holehe probes many sites' sign-up/reset flows with the email from your IP; may notify the account owner or trigger security alerts. |
search_footprint |
passive | on | Up to 3 Google queries via Bright Data; the target is sent to those two services. |
search_gdelt_geo |
passive | on | Downloads GDELT's public news feed and filters it locally; your search term never leaves your machine. |
search_github |
passive | on | A few requests to api.github.com. |
search_ip |
passive | on | One request to ipinfo.io. |
search_ip2location |
passive | on | One request to api.ip2location.io. |
search_paste |
passive | on | One request to psbdmp.ws. |
search_phone |
unverified | off | Runs phoneinfoga; what it sends over the network has not been verified with a traffic capture. |
search_rdap |
passive | on | Queries IANA and the registry's RDAP server, not the target. |
search_shodan |
passive | on | Shodan API; reads Shodan's existing index, requests no new scan. |
search_username |
noisy | off | sherlock sends requests from your IP to hundreds of sites; expect rate limits and WAF blocks. |
search_virustotal |
passive | on | IP, domain and hash lookups read VirusTotal's existing data. URL submission is a separate active mode, off by default: it makes VirusTotal fetch the URL and makes it visible to the VirusTotal community. |
search_virustotal (URL submission) |
touches target | off | VirusTotal fetches the submitted URL, and the URL becomes visible to the VirusTotal community, which can reveal your investigation. |
search_whois |
passive | on | Queries the registry/registrar WHOIS server, not the target. |
Responsible use
- Passive is not private. Every service you query sees your search, and usually your API key or IP address. Treat lookups on Shodan, Have I Been Pwned, VirusTotal, Bright Data and similar services as visible to those providers.
- Authorization. Investigate only targets you are permitted to. Local laws on personal data differ; the legal and operational responsibility is yours. Read the disclaimer.
- Verify the output. Tool results are real; the AI's reading of them is not proof. Check a finding at its source before you act on it.
- Stored personal data. The optional entity graph keeps data on your disk. You are its controller.