OpenOSINT

AI-powered OSINT agent, MCP server, and CLI · repo

Run bounded, authorized OSINT checks only. Jobs execute inside this isolated container with a timeout, rate limit, and downloadable stdout/artifacts.

Command: openosint

Advanced CLI UI

Detected CLI options (15)
Anthropic API key (overrides ANTHROPIC_API_KEY env
Ollama model name (default: llama3.2). Used when
Ollama server URL (default: http://localhost:11434).
Model name to request from the OpenAI-compatible
API key for the OpenAI-compatible endpoint. Falls back
Port to listen on (default: 8080).
Host/IP to bind to (default: 0.0.0.0).
Extra args are parsed as argv, not a shell command. Max 40 args.
Raw upstream help
$ openosint --help
usage: openosint [-h] [-v] [--api-key KEY] [--parallel] [--json]
                 [--provider {anthropic,ollama,openai}] [--ollama-model MODEL]
                 [--ollama-host URL] [--openai-base-url URL]
                 [--openai-model MODEL] [--openai-api-key KEY] [--no-pdf]
                 command ...

OpenOSINT — AI-powered OSINT framework.
Run without arguments to start the interactive REPL.

positional arguments:
  command
    shell               Start the interactive REPL (default when no command
                        given).
    email               Direct email scan via holehe (no AI).
    username            Direct username scan via sherlock (no AI).
    shodan              Shodan host lookup or keyword search (no AI). Requires
                        SHODAN_API_KEY.
    virustotal          VirusTotal lookup for IP, domain, URL, or file hash
                        (no AI). Requires VIRUSTOTAL_API_KEY.
    censys              Censys lookup for IP or domain (no AI). Requires
                        CENSYS_API_ID and CENSYS_SECRET.
    github              GitHub OSINT: profile, repos, and commit-email
                        discovery (no AI).
    dns                 DNS record enumeration with email security analysis
                        (no AI).
    abuseipdb           AbuseIPDB reputation check for an IP address (no AI).
                        Requires ABUSEIPDB_API_KEY.
    ip2location         IP2Location lookup for geolocation, ISP,
                        VPN/Proxy/Tor/Datacenter detection (no AI). Requires
                        IP2LOCATION_API_KEY.
    multi               Investigate multiple targets in parallel (AI-powered).
    web                 Start the web server (opens browser automatically).
    history             Browse saved REPL session history.

options:
  -h, --help            show this help message and exit
  -v, --verbose         Enable debug-level logging.
  --api-key KEY         Anthropic API key (overrides ANTHROPIC_API_KEY env
                        var).
  --parallel            Run independent complementary tools concurrently using
                        asyncio.gather(). For 'email': runs search_email +
                        search_breach in parallel. For 'username': runs
                        search_username + search_paste in parallel.
  --json                Output results as structured JSON instead of formatted
                        text.
  --provider {anthropic,ollama,openai}
                        AI provider for the interactive REPL (default:
                        anthropic).
  --ollama-model MODEL  Ollama model name (default: llama3.2). Used when
                        --provider ollama.
  --ollama-host URL     Ollama server URL (default: http://localhost:11434).
  --openai-base-url URL
                        Base URL of an OpenAI-compatible endpoint (LiteLLM,
                        llama-swap, vLLM, …). Used when --provider openai.
                        Default: $OPENAI_BASE_URL or http://localhost:8080/v1.
  --openai-model MODEL  Model name to request from the OpenAI-compatible
                        endpoint. Used when --provider openai. Default:
                        $OPENAI_MODEL or gpt-4o-mini.
  --openai-api-key KEY  API key for the OpenAI-compatible endpoint. Falls back
                        to $OPENAI_API_KEY (local servers may ignore it).
  --no-pdf              Disable automatic PDF generation alongside Markdown
                        reports.

Examples:
  openosint                                   # interactive AI session
  openosint email target@example.com          # direct email scan
  openosint username johndoe99                # direct username scan
  openosint shodan 8.8.8.8                    # Shodan host lookup
  openosint censys 8.8.8.8                   # Censys host lookup
  openosint censys example.com               # Censys certificate search
  openosint ip2location 8.8.8.8              # IP2Location lookup
  openosint multi targets.txt                 # multi-target from file
  openosint multi a@x.com,b@y.com             # multi-target inline
  openosint --parallel email target@example.com
  openosint --json email target@example.com
  openosint --provider ollama                 # use local Ollama
  openosint --provider ollama --ollama-model mistral


$ openosint web --help
usage: openosint web [-h] [--port PORT] [--host HOST] [--no-browser]

options:
  -h, --help    show this help message and exit
  --port PORT   Port to listen on (default: 8080).
  --host HOST   Host/IP to bind to (default: 0.0.0.0).
  --no-browser  Do not open a browser tab automatically.


$ openosint-mcp --help
Extra notes
Some OpenOSINT features require ANTHROPIC_API_KEY, OpenAI/Ollama config, or optional external tools. This wrapper installs the CLI and optional web dependencies; use Extra args for subcommands beyond the parsed help.

Source / README search