Pentest Osint

Turn Claude Desktop into a full OSINT workstation.

A Model Context Protocol (MCP) server that integrates 25+ open-source OSINT and reconnaissance tools into Claude Desktop. Dockerized on Kali Linux for one-command deployment. Built by a pentester, for pentesters.

---

What This Does

Instead of switching between 15 terminal tabs running different tools, you talk to Claude and it runs them for you. Ask Claude to:

• "Run a full passive recon on target.com" → Chains WHOIS + DNS + crt.sh + theHarvester + subfinder + dnstwist
• "Search for the username johndoe across all platforms" → Runs Sherlock + Maigret + Blackbird
• "Check this email for breaches and platform registrations" → Runs Holehe + h8mail
• "Scan 10.0.0.1 for open ports" → Runs Nmap with your preferred scan type
• "Generate Google dorks for target.com" → Outputs 20+ pentest-focused dork queries

All results come back in the chat. No copy-pasting. No tab switching.

---

🛠️ Integrated Tools (25+)

Username OSINT

Tool	Coverage	Description
Sherlock	400+ sites	Social media username search
Maigret	3000+ sites	Advanced username search with false-positive detection
Blackbird	581 sites	Fast username enumeration

Email OSINT

Tool	Description
Holehe	Check email registration on 120+ platforms
h8mail	Breach database search (supports HIBP, LeakCheck, EmailRep API keys)

Domain & Infrastructure

Tool	Description
theHarvester	Emails, subdomains, hosts from public sources
subfinder	Passive subdomain enumeration
Amass	OWASP subdomain enumeration
WHOIS	Domain/IP registration lookup
dig	DNS record queries (A, MX, NS, TXT, etc.)
dnstwist	Typosquatting & phishing domain detection
crt.sh	Certificate transparency log search
Wayback Machine	Historical URL discovery
WhatWeb	Website technology fingerprinting

Network & IP

Tool	Description
Nmap	Port scanning (quick, version, OS, full, vuln, stealth)
Shodan	Internet-connected device search (requires API key)
VirusTotal	Domain/IP/URL malware analysis (requires API key)

Phone OSINT

Tool	Description
PhoneInfoga	Phone number carrier, location, and OSINT data

Comprehensive

Tool	Description
SpiderFoot	Full automated OSINT scan (5-30 min)
recon-ng	Modular reconnaissance framework

Helpers

Tool	Description
Google Dorks	Generate pentest-focused dork queries (files, login, exposed, secrets, cloud)
GitHub Recon	Search GitHub for leaked code and secrets
Full Passive Recon	One-command chain: WHOIS → DNS → crt.sh → theHarvester → subfinder → dnstwist

---

🚀 Quick Start (Docker)

Prerequisites

• Docker & Docker Compose
• Claude Desktop

1. Clone & Build

git clone https://github.com/Hackerobi/pentest-osint-mcp-server.git
cd pentest-osint-mcp-server
docker compose build
docker compose up -d

2. Configure Claude Desktop

Copy the config to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pentest-osint": {
      "command": "docker",
      "args": [
        "exec", "-i", "pentest-osint-mcp",
        "python3", "/opt/osint-mcp/server.py"
      ],
      "env": {
        "PYTHONUNBUFFERED": "1"
      }
    }
  }
}

3. Restart Claude Desktop

The tools will appear automatically. Start asking Claude to run OSINT queries.

---

🔑 API Key Management

Some tools require API keys for full functionality. Three ways to configure:

Option 1: Ask Claude

Just tell Claude in chat:

"Set my Shodan API key to abc123def456"

Option 2: Interactive Script

bash scripts/setup_keys.sh

Option 3: Edit JSON Directly

vim ~/.osint-mcp/api_keys.json

Supported API Services (21)

Service	Free Tier	Get Key
Shodan	Limited	https://account.shodan.io/
VirusTotal	500 req/day	https://www.virustotal.com/gui/my-apikey
Hunter.io	25 req/month	https://hunter.io/api-keys
SecurityTrails	50 req/month	https://securitytrails.com/app/account
Censys	250 req/month	https://search.censys.io/account/api
GitHub	Generous	https://github.com/settings/tokens
Have I Been Pwned	Paid	https://haveibeenpwned.com/API/Key
GreyNoise	Limited	https://viz.greynoise.io/account/api-key
BinaryEdge	250 req/month	https://app.binaryedge.io/account/api
Intelligence X	Limited	https://intelx.io/account?tab=developer
And 11 more...		See scripts/setup_keys.sh

---

🐧 Native Install (Kali/Ubuntu/Debian)

If you prefer running without Docker:

git clone https://github.com/Hackerobi/pentest-osint-mcp-server.git
cd pentest-osint-mcp-server
sudo bash scripts/install.sh

Then update your Claude Desktop config to point directly to the server:

{
  "mcpServers": {
    "pentest-osint": {
      "command": "python3",
      "args": ["/opt/osint-mcp/server.py"],
      "env": {"PYTHONUNBUFFERED": "1"}
    }
  }
}

---

📁 Project Structure

pentest-osint-mcp-server/
├── src/
│   └── server.py              # MCP server (single-file, ~900 lines)
├── scripts/
│   ├── install.sh             # Native Kali/Ubuntu installer
│   └── setup_keys.sh          # Interactive API key configuration
├── configs/
│   └── claude_desktop_config.example.json
├── Dockerfile                 # Kali-based container
├── docker-compose.yml
└── README.md

---

💡 Usage Examples

Full Passive Recon

"Run a full passive recon on example.com"

Chains 6 tools automatically and returns a combined report.

Username Investigation

"Search for the username targetuser on all platforms using Maigret"

Returns confirmed profiles with extracted metadata (full name, avatar, account creation dates).

Email Intelligence

"Check [email protected] for platform registrations and breaches"

Runs Holehe (platform detection) and h8mail (breach check) together.

Network Scanning

"Run a version scan on scanme.nmap.org ports 22,80,443"

Executes Nmap with -sV flags and returns formatted results.

Typosquatting Detection

"Check for typosquatting domains targeting example.com"

Runs dnstwist and returns all registered lookalike domains.

---

⚠️ Legal Disclaimer

This tool is intended for authorized penetration testing and security research only. Always ensure you have proper authorization before scanning targets. Unauthorized access to computer systems is illegal.

The author is not responsible for misuse of this tool.

---

🤝 Contributing

Pull requests welcome. If you want to add a new tool:

1. Add a handler function in server.py
2. Add the tool definition to the TOOLS list
3. Add the handler to HANDLER_MAP
4. Update the Dockerfile if new dependencies are needed
5. Submit a PR

---

📬 Contact

• Discord: sgtwolf787
• GitHub: @Hackerobi

White hat or no hat 🎩

---

Built with Claude. Tested on targets with authorization. Stay legal.