Awesome OSINT MCP Servers

A curated list of MCP servers for OSINT (Open Source Intelligence).

An MCP server connects tools and services to LLM systems like Claude, Cursor, Windsurf, etc.
MCP servers simplify execution of OSINT tools by combining them with the ease of LLM querying
and the ability to create flexible reports.

---

Legend: 📦 Open Source  ·  🆓 Free / Has Free Tier  ·  💰 Paid / Requires Paid API

Contents

• SOCMINT
• Network Scanning
• Web Scraping
• Company Intelligence
• Threat Intelligence
• Meta / Discovery

SOCMINT

• 💰 Expose Team — AI-powered OSINT at lightspeed. Credit-based plans from $8/month.
• 📦🆓 Maigret — Collect user account information from various public sources by username.
• 📦💰 Xquik — X (Twitter) data extraction and automation with 40+ REST API endpoints, real-time account monitoring, and trending topics. MCP server with API key auth.

Network Scanning

• 📦🆓💰 Shodan — Query the Shodan API and CVEDB for IP reconnaissance, DNS operations, vulnerability tracking, and device discovery. Free tier available with limited queries, requires Shodan API key.
• 📦🆓💰 ZoomEye — Obtain network asset information by querying ZoomEye using dorks and other search parameters. 7-day free trial available, requires ZoomEye API key.
• 📦🆓 DNSTwist — DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
• 📦🆓 OSINT Toolkit — Unified interface for network reconnaissance with parallel execution of WHOIS, Nmap, DNS lookups, and typosquatting detection.
• 📦🆓💰 ContrastAPI — Security intelligence server with 49 tools: domain recon (DNS, WHOIS, SSL, subdomains, WAF, Wayback) plus orchestrated audit_domain, IP reputation plus orchestrated threat_report (Shodan + AbuseIPDB + ASN), CVE/EPSS/KEV lookup plus calculate_risk_score (CVSS+EPSS+KEV+PoC fusion) and bulk_cve_lookup (50/call), cve_leading (MITRE/GHSA pre-NVD), IOC enrichment plus bulk_ioc_lookup (50/call), threat intel, MITRE ATLAS (167 AI/ML attack techniques + bulk drill) and D3FEND defenses (149 techniques + coverage report), web intelligence (robots.txt, redirect chain, email validation, brand assets, SEO audit), check_dependencies (requirements.txt / package.json audit), and code security scanning. Anonymous tier + Pro tier with API key.

Web Scraping

• 🆓💰 AnySite — Structured data access to 115+ endpoints across 40+ platforms (LinkedIn, Instagram, X, Reddit, YouTube, GitHub, Amazon, etc.) via five meta-tools. 7-day free trial with 1,000 credits.
• 📦🆓💰 Bright Data — Real-time web search, scraping, and structured data extraction from 60+ sources (Amazon, LinkedIn, TikTok, Google Maps, etc.) with CAPTCHA and anti-bot bypass. Free tier: 5,000 requests/month.

Company Intelligence

• 📦🆓💰 CompanyScope — Company intelligence aggregating data from 8 public sources (Wikipedia, SEC EDGAR, OpenCorporates, RDAP, GitHub, and more) for corporate reconnaissance. Free tier 25 calls/day, pay-per-use tier on Apify.
• 📦🆓 StockScope — SEC EDGAR financial intelligence for stock research. Revenue, net income, margins, filings, and company comparisons for any US public company. Free, no API key needed.
• 📦💰 US Business Data — Search Secretary of State business registrations across 17 US states, building permits in 400+ cities, and Yellow Pages business leads. Returns entity details, filing status, and registered agents.
• 🆓💰 OpenRegistry — Real-time access to 27 national corporate registries worldwide (UK Companies House, France Sirene, Germany Handelsregister, South Korea OPENDART, Australia ABR, Canada Corporations, etc.) via a unified JSON schema. Returns company profiles, officers, shareholders, beneficial ownership, filings, and raw documents. Free tier: 20 rpm without signup, 30 rpm with email. Paid up to $29/mo. OAuth 2.1, no API keys.
• 📦💰 Checko MCP — Unofficial wrapper for the Russian Checko.ru API: verify counterparties (companies, sole proprietors, individuals) via EGRUL/EGRIP, arbitration cases, government contracts (44-FZ/223-FZ), Rosstat financials, inspections, Fedresurs and EFRSB bankruptcy records. 12 tools and 6 ready-made workflow prompts. Requires paid CHECKO_API_KEY.

Threat Intelligence

• 📦🆓 VirusTotal — Analyze URLs, files (by hash), IPs, and domains with detailed relationship mapping. Free API tier available, requires VIRUSTOTAL_API_KEY.
• 📦🆓 Voidly — Global internet censorship intelligence: 116 tools across 119+ countries. Query OONI / IODA / CensoredPlanet evidence, look up 5,356 citable incidents, check if a domain or service is blocked in a country, fetch ISP-level risk scores, run ML-driven shutdown forecasts, and verify censorship claims. Free, no API key needed for read endpoints. npx @voidly/mcp-server.
• 📦🆓 OpenOSINT — AI-powered OSINT agent with interactive REPL, MCP server, and CLI.

Meta / Discovery

• 🆓 Not Human Search — Agent-first discovery engine for MCP servers. Search, score, and live-probe (verify_mcp) 8,600+ servers via JSON-RPC or REST API. Useful for pivoting between OSINT MCP tools. MCP: https://nothumansearch.ai/mcp

Contributing

Contributions are welcome! Please open a pull request to add a new OSINT MCP server to the list.

License

MIT