OpenOSINT brings public traces into local investigations

What this is about

OpenOSINT is an open-source tool for researching publicly accessible data. It combines a command line, local web interface, agent, and MCP server. Users can investigate email addresses, usernames, domains, IP addresses, and phone numbers without opening every data source separately.

The project is available through GitHub and PyPI. GitHub release v2.23.1 was published on July 14, 2026, while project documentation now identifies version 2.25.0. OpenOSINT is therefore more than a concept: installation, a local interface, and concrete search modules are documented. It also belongs to a sensitive category because separate public facts can form a highly personal profile when combined.

What OpenOSINT actually does

OpenOSINT bundles existing research tools and data providers. Sherlock searches for a username across many platforms, Holehe checks links to an email address, Sublist3r finds subdomains, and python-whois reads domain records. Other modules query Have I Been Pwned, Censys, IPinfo, IP2Location, or AbuseIPDB when the required keys are available.

There are three operating modes. Direct CLI commands suit individual lookups. An interactive prompt accepts natural-language tasks and creates structured reports. The local web interface displays conversation history and tool results in a browser. Through MCP, OpenOSINT can also connect to Claude Code or Claude Desktop.

The agent workflow documents an Anthropic key by default, while Ollama can provide local inference in the web interface. Some sources are free or require no key; others need separate accounts or paid API quotas. The software uses the MIT license.

Why it matters

OSINT research often consists of many small, repetitive steps. An analyst checks the same name across services, reconciles the output, and then writes a report. OpenOSINT reduces that operational work and produces a consistent output format. It is particularly useful for authorized security testing, reviewing one's own attack surface, journalism, and investigating suspicious infrastructure.

MCP integration is a meaningful difference from a list of links. An agent can choose appropriate tools and connect results within one session. That increases speed but does not automatically improve truth. Name collisions, outdated profiles, and imprecise location data remain.

On August 9, 2026, the repository was active, licensed under MIT, and showed more than 1,300 GitHub stars. Popularity is not validation. The inspectable modules, PyPI release, and local installation are stronger evidence that the tool is genuinely usable.

In plain language

OpenOSINT is like a toolbox for following clues. Instead of fetching a screwdriver, flashlight, and tape measure from separate cupboards, they sit together and an assistant suggests which one to use. The assistant can still follow the wrong clue when two people share the same name.

A practical example

A small company wants to review its public attack surface before a penetration test. The security lead enters a company-owned domain. OpenOSINT collects WHOIS data, finds subdomains, and checks the discovered IP addresses against reputation services. The team then examines three official role accounts for known breach exposure.

The agent produces a report with 18 findings. Two subdomains belong to an old test system, five results are false associations, and one mailbox appears in a known incident. No finding is treated as a vulnerability without review. The team manually confirms ownership and context, records its legal basis, and only then authorizes targeted follow-up checks.

Scope and limits

• Law and ethics: Public data is not automatically exempt from privacy, employment, or criminal law. Research needs a legitimate purpose, minimal collection, and documented authorization.
• False associations: Shared usernames, shared IP addresses, and stale records can create incorrect links. Results are leads, not proof.
• Third parties: Several modules send search terms to external services. Privacy terms, retention, and transfer paths must be reviewed before sensitive queries.
• Cost and availability: Some functions require API keys or paid quotas. Changes at external services can break individual modules at any time.

SEO & GEO keywords

OpenOSINT, OSINT tool, AI research, MCP server, threat intelligence, Sherlock, Holehe, domain research, IP reputation, open-source security