15 #osint MCP Servers & Clients

ZoomEye MCP Server

zoomeye-ai

A Model Context Protocol server that provides network asset information based on query conditions. This server allows LLMs to obtain network asset information and supports querying network asset information by zoomeye dork etc.

NetworksDB-MCP

MorDavid

Fast MCP integration for NetworksDB API - Query IP addresses, organizations, ASNs, and DNS records using natural language through Model Context Protocol

Warmth Engine Observatory

warmthengine

AI infrastructure coordination intelligence. Read-only tools serve verified events, Coordination Connections, Sovereign Capability Profiles, and methodology with semantic anchor mappings. Open free tier plus a token-authenticated analyst tier.

Domain security reconnaissance for AI agents — 13 tools (DNS, SSL, HTTP headers, email auth, port scan, ASN, RDAP) with a 0–100 Health Score. Free, no API key

Areacode.fyi Mcp Server

riv-lc

North American NANP area-code and phone-number intelligence for AI agents: area-code lookup, NANP validation, local time, city/state/province coverage, overlays, scam/spoofing context, and block-allocation carrier metadata backed by areacode.fyi.

A Model Context Protocol (MCP) server that provides comprehensive IP and domain intelligence. This server allows Large Language Models (LLMs) to obtain detailed security information, reputation assessments, and threat intelligence by analyzing IP addresses and domains through the

26 free OSINT tools as MCP tools for AI agents one tool to installs and use everything

Exposes 280+ free dev/security tools from onlinecybertools.com as MCP tools in one server: Base64/URL/JWT encoders, MD5/SHA/HMAC/bcrypt/argon2 hashes, JSON/YAML/XML formatters, regex tester, network diagnostics (ping/traceroute/dig/whois/SSL/SPF/DMARC), and OSINT lookups. No auth

Audits a GitHub repository's stargazers for signs of fake-star injection across five deterministic axes (burst, suffix-farm, sequential-id cluster, same-second cluster, inter-star gap regularity) over two windows (oldest 100 + newest 30), plus extended signals. Returns LOW / MEDI

TraceHunt is an MCP server (and CLI) for OSINT username reconnaissance across 480+ platforms. Tools: hunt_username() returns where a handle exists, and footprint_score() returns a 0-100 digital-footprint score. Python, MIT, runs locally, no API keys, privacy-first.

Mlab - IOC & Threat Intelligence

mlab-sh

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C

ChronoVerify

beeswaxpat

ChronoVerify checks when a photo was taken and whether it shows signs of editing. It validates C2PA Content Credentials against the official trust lists, reads EXIF and XMP, runs pixel forensics, and returns one typed verdict with a confidence score. Works on any image, signed or

A lightweight, extensible cybersecurity toolkit that connects AI assistants to security tools through the Model Context Protocol (MCP), enabling AI-assisted security research, scanning, and analysis.