---

Legend: 📦 Open Source  ·  🆓 Free / Has Free Tier  ·  💰 Paid / Requires Paid API

Contents

• SOCMINT
• Network Scanning
• Web Scraping
• Company Intelligence
• Public Records & Compliance
• Threat Intelligence
• Research Intelligence
• Meta / Discovery
• Blockchain Intelligence
• Market & Trading

SOCMINT

• 💰 Expose Team — AI-powered OSINT at lightspeed. Credit-based plans from $8/month.
• 📦🆓 Maigret — Collect user account information from various public sources by username.
• 📦💰 Xquik — X (Twitter) data extraction and automation with 40+ REST API endpoints, real-time account monitoring, and trending topics. MCP server with API key auth.
• 📦🆓 OSINT Tools MCP — Wraps seven classic OSINT CLIs behind one server: Sherlock and Blackbird (usernames), Maigret, Holehe (email), GHunt (Google accounts), theHarvester (domains) and SpiderFoot. Python, installs the underlying tools itself.
• 📦🆓 LinkedIn MCP — Search LinkedIn people, companies and jobs, and pull structured profile, company and post data. Uses your own session cookie; no API key.

Network Scanning

• 📦🆓💰 Shodan — Query the Shodan API and CVEDB for IP reconnaissance, DNS operations, vulnerability tracking, and device discovery. Free tier available with limited queries, requires Shodan API key.
• 📦🆓💰 ZoomEye — Obtain network asset information by querying ZoomEye using dorks and other search parameters. 7-day free trial available, requires ZoomEye API key.
• 📦🆓 DNSTwist — DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
• 📦🆓 OSINT Toolkit — Unified interface for network reconnaissance with parallel execution of WHOIS, Nmap, DNS lookups, and typosquatting detection.
• 📦🆓💰 ContrastAPI — Security intelligence server with 49 tools: domain recon (DNS, WHOIS, SSL, subdomains, WAF, Wayback) plus orchestrated audit_domain, IP reputation plus orchestrated threat_report (Shodan + AbuseIPDB + ASN), CVE/EPSS/KEV lookup plus calculate_risk_score (CVSS+EPSS+KEV+PoC fusion) and bulk_cve_lookup (50/call), cve_leading (MITRE/GHSA pre-NVD), IOC enrichment plus bulk_ioc_lookup (50/call), threat intel, MITRE ATLAS (167 AI/ML attack techniques + bulk drill) and D3FEND defenses (149 techniques + coverage report), web intelligence (robots.txt, redirect chain, email validation, brand assets, SEO audit), check_dependencies (requirements.txt / package.json audit), and code security scanning. Anonymous tier + Pro tier with API key.
• 🆓💰 DomScan — Domain intelligence with DNS, WHOIS/RDAP, SSL/TLS, subdomain enumeration, certificate search, typosquatting and brand monitoring, plus domain valuation and availability. One API and MCP server; free tools with paid API tiers.
• 🆓💰 CrawlGraph — Passive web footprinting via the Common Crawl webgraph - mapping which sites reference a target, without ever touching the target (passive, no active scanning). Two tools for OSINT research: inbound linking to target and link-gap between two or more targets. npx -y crawlgraph-mcp. Free sign up for 15 targets/mo ; paid lifetime API for higher limits and link-gap research.
• 🆓💰 DomainKits — Search newly registered, expired, and dropped domains across gTLDs for phishing, typosquatting, and brand-impersonation monitoring, with WHOIS, DNS, reverse-nameserver, IP geolocation, and Google Safe Browsing lookups. Requires paid API key.
• 📦🆓 IPInfo — IP geolocation, ASN and network details, Tor exit-node checks, and interactive maps for sets of IPs via ipinfo.io. Free API token required.

Web Scraping

• 🆓💰 AnySite — Structured data access to 115+ endpoints across 40+ platforms (LinkedIn, Instagram, X, Reddit, YouTube, GitHub, Amazon, etc.) via five meta-tools. 7-day free trial with 1,000 credits.
• 📦🆓💰 Bright Data — Real-time web search, scraping, and structured data extraction from 60+ sources (Amazon, LinkedIn, TikTok, Google Maps, etc.) with CAPTCHA and anti-bot bypass. Free tier: 5,000 requests/month.
• 🆓💰 Parallel Search MCP — Web search and page-content extraction (web_search, web_fetch) for LLM agents. Default endpoint works without an API key; an account with credits is needed for production rate limits. MCP: https://search.parallel.ai/mcp
• 📦🆓 Wayback Machine MCP — Query and save Internet Archive snapshots: check archive status, fetch archived URLs, search the CDX index, and compare two snapshots of a page. No API key for reads. npx -y mcp-wayback-machine

Company Intelligence

• 📦🆓💰 CompanyScope — Company intelligence aggregating data from 8 public sources (Wikipedia, SEC EDGAR, OpenCorporates, RDAP, GitHub, and more) for corporate reconnaissance. Free tier 25 calls/day, pay-per-use tier on Apify.
• 📦🆓 StockScope — SEC EDGAR financial intelligence for stock research. Revenue, net income, margins, filings, and company comparisons for any US public company. Free, no API key needed.
• 🆓💰 FilingFirehose — Hosted SEC EDGAR MCP for any US ticker: 8-K body-text parsing (catches buried items beyond what the filer reported), 10-K / 10-Q / S-3 / Schedule 13D reads, forensic risk scoring (LOW/MODERATE/ELEVATED/HIGH), and cyber-incident tracking. Free public endpoints + paid tiers from $9/mo. MCP: https://filingfirehose.com/mcp
• 📦💰 US Business Data — Search Secretary of State business registrations across 17 US states, building permits in 400+ cities, and Yellow Pages business leads. Returns entity details, filing status, and registered agents.
• 🆓💰 OpenRegistry — Real-time access to 27 national corporate registries worldwide (UK Companies House, France Sirene, Germany Handelsregister, South Korea OPENDART, Australia ABR, Canada Corporations, etc.) via a unified JSON schema. Returns company profiles, officers, shareholders, beneficial ownership, filings, and raw documents. Free tier: 20 rpm without signup, 30 rpm with email. Paid up to $29/mo. OAuth 2.1, no API keys.
• 📦💰 Checko MCP — Unofficial wrapper for the Russian Checko.ru API: verify counterparties (companies, sole proprietors, individuals) via EGRUL/EGRIP, arbitration cases, government contracts (44-FZ/223-FZ), Rosstat financials, inspections, Fedresurs and EFRSB bankruptcy records. 12 tools and 6 ready-made workflow prompts. Requires paid CHECKO_API_KEY.
• 🆓 Fylings — African company intelligence across 18+ official national registries (Nigeria's CAC, Tanzania's BRELA, Mauritius's CBRD, Senegal's RCCM, and more) via a unified schema, with the official registry source and a last-verified date on every record. Company search & verification, beneficial ownership, government-contract awards, and sanctions screening. Free, no API key. Hosted MCP: https://www.fylings.com/api/mcp
• 📦🆓 Companies House MCP — 38 tools over the UK Companies House API: company and officer search, profiles, filing history and documents, charges, insolvency, PSC/beneficial ownership and disqualifications. Free API key required. AGPL-3.0.

Public Records & Compliance

• 🆓💰 DataNexus MCP — Public records intelligence across 7 domains: domain recon (RDAP, DNS, SSL, subdomains, email security), patent search & inventor portfolios (EPO/WIPO), US government contract awards & vendor history (SAM.gov), regulatory filings & dockets (Regulations.gov + Federal Register), US/UK nonprofit 990 data & health scores, CVE/SBOM/EPSS vulnerability intelligence, and professional licence verification (NPI, FINRA, SAM exclusions). 55 tools, no API key required for free tier, hosted remote MCP.
• 📦💰 Nummeropslag — Privacy-first Danish phone-number intelligence using official CVR and telecom-register data. Look up registered companies, operators, number types, and community spam/trust signals without exposing private individuals' names. Requires a paid API key.

Threat Intelligence

• 📦🆓 VirusTotal — Analyze URLs, files (by hash), IPs, and domains with detailed relationship mapping. Free API tier available, requires VIRUSTOTAL_API_KEY.
• 📦🆓 Voidly — Global internet censorship intelligence: 116 tools across 119+ countries. Query OONI / IODA / CensoredPlanet evidence, look up 5,356 citable incidents, check if a domain or service is blocked in a country, fetch ISP-level risk scores, run ML-driven shutdown forecasts, and verify censorship claims. Free, no API key needed for read endpoints. npx @voidly/mcp-server.
• 📦🆓 OpenOSINT — AI-powered OSINT agent with interactive REPL, MCP server, and CLI.
• 📦🆓 osint-agent-skills — 23 MCP tools (DNS, Shodan InternetDB, crt.sh, Wayback CDX, GitHub code search, OTX, HIBP, Etherscan, Mastodon) with zero-dependency Node.js server for Claude Code, Cursor, and Ollama.
• 📦🆓 VulneraMCP — AI-powered bug bounty MCP server with recon (subfinder, httpx, gau, ffuf), vulnerability testing (XSS/SQLi/IDOR/CSRF), API/auth/cloud scanning, knowledge-graph analysis, and Markdown reporting. Integrates OWASP ZAP and CLI tools with PostgreSQL storage.
• 📦🆓 Clearfront — Self-OSINT footprint scanner exposing 30 tools over MCP: username enumeration (Sherlock, Maigret, WhatsMyName), email and breach checks (holehe, HIBP, Hudson Rock infostealer logs), domain and IP recon (crt.sh, Shodan, Censys, GreyNoise, Wayback Machine), and EXIF/GPS extraction. Correlates findings into an evidence graph and rates each by source, confidence and severity. Configurable sweep depth and a local web console. pip install clearfront, runs locally, most tools keyless.
• 📦🆓 ScanMalware — Submit a URL for sandboxed browser analysis, then pivot across the scan archive: search by domain, IP, ASN, JARM, favicon mmh3, TLSH/ssdeep fuzzy hash, screenshot hash, OCR text, or JavaScript fingerprint. Also exposes YARA matches, TLS/RDAP records, Certificate Transparency pivots, detected technologies, and pastejacking/clipboard events. 128 tools, no API key required. MCP: https://mcp.scanmalware.com/mcp
• 📦🆓 Darknet MCP — 66 tools for dark web and breach intelligence: ransomware group tracking and victim listings, stealer logs, HIBP breach lookups, IntelX search, Tor .onion fetching and exit-node checks, MalwareBazaar/ThreatFox/URLhaus feeds, and Bitcoin address intel. Many tools work with no API key; premium sources unlock with your own keys. npx darknet-mcp-server
• 📦🆓 OpenCTI MCP — Natural-language access to an OpenCTI instance: latest reports, campaigns by name, attack patterns, indicators, labels and marking definitions over the GraphQL API. Requires your own OpenCTI URL and token.

Research Intelligence

• 📦🆓💰 BGPT MCP — Scientific paper search with structured full-text evidence: methods, sample sizes, results, limitations, quality scores, and falsification prompts. Useful for claim verification and literature OSINT. Remote MCP + REST. Free tier: 50 results. docs · MCP: https://bgpt.pro/mcp/sse

Meta / Discovery

• 🆓 Not Human Search — Agent-first discovery engine for MCP servers. Search, score, and live-probe (verify_mcp) 8,600+ servers via JSON-RPC or REST API. Useful for pivoting between OSINT MCP tools. MCP: https://nothumansearch.ai/mcp
• 📦🆓 Claudii Exploratores — OSINT suite exposing 898 curated OSINT tools across 24 categories (people, usernames, email, domains, IP, phones, companies, crypto, IBAN, media, social platforms…) as both a Claude Agent Skill and an MCP server. Auto-classifies an indicator, builds only the search URLs that fit it, and includes an offline ISO 13616 IBAN verifier and a reversible PII redactor. Python / FastMCP, AGPL-3.0. Alpha.

Blockchain Intelligence

• 💰 TWZRD Agent Intel — Blockchain OSINT for AI agent trust scoring — reads public Solana on-chain data (wallet history, transaction patterns) to score agent trustworthiness. Free preflight + paid signed V5 trust receipts via x402 micropayments. MCP: https://intel.twzrd.xyz/mcp
• 💰 The Stall — Multi-tool blockchain OSINT server: OFAC sanctions screening (19,000+ SDN entries, fuzzy name match + AKA aliases), wallet risk scoring, agent KYA trust scoring, EVM and Solana transaction intelligence, and token security analysis. Pay-per-call via x402 USDC micropayments on Base — no accounts or API keys. MCP: https://the-stall.intuitek.ai/mcp

Market & Trading

• 📦🆓💰 Helium MCP — 37-dimensional news bias scoring across 216 sources, market data, and ML options pricing. Remote MCP + REST. Demo · docs

Contributing

Contributions are welcome! Please open a pull request to add a new OSINT MCP server to the list.

License

MIT