OSINT MCP Server

A comprehensive MCP server providing tools for IP, domain, email, and image-based open-source intelligence. It integrates services like Shodan, VirusTotal, and HaveIBeenPwned to facilitate advanced security research and data gathering.

→ CloudWaddie/osint-mcp · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: STEAM_API_KEY, OPENXBL_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 21 credentials: ABSTRACT_PHONE_API_KEY, ALIENVAULT_API_KEY, EXA_API_KEY, GITHUB_TOKEN, GOOGLE_CLOUD_API_KEY, GREYNOISE_API_KEY, HIBP_API_KEY, HUNTER_API_KEY, IMAGGA_API_KEY, IMAGGA_API_SECRET, IP_API_KEY, OPENCORPORATES_API_KEY, OPENXBL_API_KEY, RDAP_API_KEY, SAUCENAO_API_KEY, SECURITYTRAILS_API_KEY, SHODAN_API_KEY, STEAM_API_KEY, VIRUSTOTAL_API_KEY, WHOISXML_API_KEY, ZOOMEYE_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretABSTRACT_PHONE_API_KEY— "": "your_abstract_key",

🔐 secretALIENVAULT_API_KEY— "": "your_otx_key",

🔐 secretEXA_API_KEY— "": "your_exa_key",

🔐 secretGITHUB_TOKEN— "": "your_github_pat",

🔐 secretGOOGLE_CLOUD_API_KEY— "": "your_google_key",

🔐 secretGREYNOISE_API_KEY— "": "your_greynoise_key",

🔐 secretHIBP_API_KEY— "": "your_hibp_key",

configHOST— "": "0.0.0.0"

🔐 secretHUNTER_API_KEY— "": "your_hunter_key",

🔐 secretIMAGGA_API_KEY— "": "your_imagga_key",

🔐 secretIMAGGA_API_SECRET— "": "your_imagga_secret",

🔐 secretIP_API_KEY

🔐 secretOPENCORPORATES_API_KEY

🔐 secretOPENXBL_API_KEY

configPORT

🔐 secretRDAP_API_KEY

🔐 secretSAUCENAO_API_KEY— "": "your_saucenao_key",

🔐 secretSECURITYTRAILS_API_KEY— "": "your_st_key",

🔐 secretSHODAN_API_KEY— "": "your_shodan_key",

🔐 secretSTEAM_API_KEY

🔐 secretVIRUSTOTAL_API_KEY— "": "your_vt_key",

🔐 secretWHOISXML_API_KEY— "": "your_whoisxml_key",

🔐 secretZOOMEYE_API_KEY— "": "your_zoomeye_key",

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/cloudwaddie-osint-mcp-sd11ww)](https://m8ven.ai/mcp/cloudwaddie-osint-mcp-sd11ww)

commit: 1d179a2a5b046de36a64fb2829a925b65ac1d348

code hash: 837607e2342abe90f9630c8e9741eb72a06a05c460a0d399f38be101a0b6f95e

verified: 4/11/2026, 2:50:24 PM

view raw JSON →