repository·main·Indexed 21 days ago
https://github.com/openosint/openosintAn AI-powered OSINT agent, MCP server, and CLI for authorized security research. OpenOSINT provides 19 investigation tools for identity, infrastructure, web search, and security analysis through a natural-language interface. It supports an interactive REPL, Web UI, and direct tool execution, with AI backend compatibility for Anthropic Claude, local Ollama, and OpenAI-compatible endpoints.
The AI OSINT Prompt Pack is a collection of 30+ structured prompts designed to facilitate repeatable, disciplined, and auditable AI-assisted investigations. Instead of ad-hoc prompting, the pack provides a methodology that forces AI assistants (like Claude or ChatGPT) to follow a specific investigation loop: scope → collect → pivot → verify → document.
While the pack is designed to work with any AI assistant, it is optimized to pair with OpenOSINT.
OpenOSINT provides a suite of OSINT capabilities designed for security researchers:
--parallel flag to run complementary tools concurrently.~/.openosint/history/. Use openosint history to browse them.OpenOSINT provides a suite of 19 specialized OSINT tools for investigating various targets. Tools are categorized by their purpose, such as email enumeration, username searching, IP intelligence, and domain analysis.
Available Tools Overview:
search_email (via holehe), search_username (via sherlock), search_phone (via phoneinfoga), search_github (via GitHub API).search_ip (via ipinfo.io), search_whois, search_domain (via sublist3r), search_dns (via dnspython), search_shodan, search_censys, search_abuseipdb, search_ip2location.generate_dorks (local), search_dorks_live (via Bright Data), scrape_url (via Bright Data), search_footprint (via Bright Data), search_paste (via psbdmp.ws).search_breach (via HIBP), search_virustotal.For full per-tool documentation, CLI flags, and output formats, visit openosint.tech.
When running a playbook via the runner.py, the system handles missing configurations or tool errors gracefully to ensure the final report is still produced:
BRIGHTDATA_API_KEY), the report will include an ℹ️ Skipped block for that section instead of failing. It may also include a note regarding the missing requirement.RuntimeError due to a missing binary), the report will render a ⚠ Step error block for that specific section. The run_playbook method will not crash and will continue to process other steps.No results found for that section.reports/ directory with a filename following the pattern {YYYY-MM-DD}_{target}_{recipe}_report.md.Playbook steps do not use a simple pass/fail binary. Instead, each step results in one of the following StepState values, which determines how the output is rendered in the final report:
NOT_CONFIGURED: A required environment variable or binary is missing. The report renders an informational block explaining how to enable the tool (e.g., which API key to set).EMPTY: The tool ran successfully but returned no output.ERROR: An unexpected exception occurred during execution. The report renders a warning with the exception message.SUCCESS (Implicit): The tool ran and returned non-empty output. The output is rendered verbatim in a fenced Markdown block.Snapshots are stored as JSON files in data/metrics/YYYY-MM-DD.json. The schema includes GitHub repository metadata, traffic statistics (views and clones), and PyPI download data.
Note on Uniques: The trailing_30_days metric for unique visits is a daily-summed value. Because the GitHub API does not provide cross-day deduplication, summing daily uniques is not a true 30-day unique visitor count. The report labels this as unique visits (daily-summed) to avoid misinterpretation.
{
"date": "2026-07-25",
"repo": "OpenOSINT/OpenOSINT",
"github": {
"stars": 0,
"forks": 0,
"watchers": 0,
"traffic": {
"views": {"total": 0, "unique_total": 0, "daily": [{"date": "2026-07-20", "count": 0, "uniques": 0}]},
"clones": {"total": 0, "unique_total": 0, "daily": [{"date": "2026-07-20", "count": 0, "uniques": 0}]},
"referrers": [{"referrer": "google.com", "count": 0, "uniques": 0}],
"paths": [{"path": "/", "count": 0, "uniques": 0}]
}
},
"pypi": {
"downloads_last_day": 0,
"downloads_last_week": 0,
"downloads_last_month": 0
}
}The Playbooks feature in OpenOSINT allows for executing automated OSINT workflows defined as 'recipes' in YAML format. A playbook consists of multiple steps, where each step targets a specific tool and a target entity (e.g., a domain).
Key components include:
openosint.playbooks/recipes/*.yaml.Recipe and PlaybookStep).EXTRACTOR_REGISTRY.OpenOSINT is free and open source under the MIT License for any use, including commercial, SaaS, and closed-source applications. You do not need a commercial plan to use the software commercially.
Commercial plans are intended for organizations that require a formal vendor relationship, such as procurement compliance, written warranties, indemnification, or priority support.
| Feature | Free (MIT) | Commercial Plan |
|---|---|---|
| Personal, Academic, & Commercial use | ✅ | ✅ |
| Closed-source / SaaS use | ✅ | ✅ |
| Modification & redistribution | ✅ | ✅ |
| Community support (GitHub Issues) | ✅ | ✅ |
| Written commercial use agreement | — | ✅ |
| License assurance letter | — | ✅ |
| Priority email support | — | ✅ |
| Defined response-time target | — | ✅ |
| Named maintainer contact | — | ✅ |
| Basic indemnification clause | — | ✅ |
| SLA, Security, & Compliance docs | — | Enterprise |
| Vendor onboarding / Invoicing | — | Enterprise |
The recording pipeline automates a browser session to capture a high-quality demonstration of the OpenOSINT interface. The workflow follows these steps:
http://localhost:8080 in a headed Chromium browser (1440×860 @2x). It seeds the OPENOSINT_DEMO_KEY into sessionStorage.openosint_byok via addInitScript to ensure the key is never visible in logs or on screen.window._agentLoopReady === true), then sends the command "Investigate openosint.tech" to the #chat-input.out/raw.webm.To maximize lead generation, follow this funnel strategy:
/free-prompts capture page rather than directly to the checkout.https://tommasodev.gumroad.com/l/ai-osint-prompt-pack) on the capture page for users who are ready to purchase immediately.This approach ensures that even during launch spikes, you build an email list instead of losing potential customers who are not yet ready to purchase.
RapidProxy does not have a dedicated search_* tool. Instead, it is used via OpenOSINT's generic upstream proxy layer. By configuring a proxy URL, you can route outbound HTTP/SOCKS5 traffic for most OpenOSINT tools through RapidProxy residential IPs.
Setting a proxy applies to any tool that uses the standard proxy retrieval methods, including:
search_abuseipdbsearch_breachsearch_censyssearch_domainsearch_emailsearch_githubsearch_ipsearch_ip2locationsearch_pastesearch_phonesearch_shodansearch_usernamesearch_virustotalThe following are not proxyable via this method:
search_dns (requires raw DNS resolution)generate_dorks (no network calls)agent.py (LLM traffic)scrape_url, search_dorks_live, search_footprint) as they already use a residential network layer.# Using the environment variable
export OPENOSINT_PROXY_URL=http://user:pass@<rapidproxy-gateway-host>:<port>
openosint ip2location 8.8.8.8
# Using the CLI flag (overrides environment variable)
openosint --proxy socks5://user:pass@host:1080 email target@example.comTo enable advanced intelligence gathering in playbooks, ensure the following environment variables are set in your shell or deployment environment:
SHODAN_API_KEY: Required for search_shodan tool.VIRUSTOTAL_API_KEY: Required for search_virustotal tool.