Awesome OSINT MCP Servers

An MCP (Model Context Protocol) server connects tools and services to LLM-systems like Claude, Cursor, Windsurf, etc. When you request a task through the LLM, the MCP server engages the appropriate tool to perform it automatically.

MCP servers simplify the execution of a large number of OSINT tools, especially console-based ones, by combining it with the ease of querying in LLM and the ability to create flexible reports in LLM output.

SOCMINT

Maigret

Maigret - A powerful OSINT tool that collects user account information from various public sources

Network Scanning

Shodan

Shodan - A Model Context Protocol (MCP) server for querying the Shodan API and Shodan CVEDB. This server provides comprehensive access to Shodan's network intelligence and security services, including IP reconnaissance, DNS operations, vulnerability tracking, and device discovery.

ZoomEye

ZoomEye - A tool to obtain network asset information by querying ZoomEye using dorks and other search parameters.

DNSTwist

DNSTwist - A powerful DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.

OSINT Toolkit

OSINT Toolkit - A unified interface for network reconnaissance with parallel execution of OSINT tools including WHOIS, Nmap, DNS lookups, and typosquatting detection for security researchers and network administrators.

Other

VirusTotal

VirusTotal - Tools to analyze URLs, files (by hash), IP, Domain, and get relationships for detailed analysys.VIRUSTOTAL_API_KEY is needed