🤖 AI-Agent OSINT & MCP

What is AI-agent OSINT, and how is it different?

AI-agent OSINT is open-source intelligence gathering driven by an autonomous AI agent rather than a human clicking through tools one at a time. You give the agent a starting point — an email, username, domain, or IP — and it scopes the task, decides which tools to run, chains them based on what each returns, verifies against real sources, and compiles a structured report. It is the difference between keeping fifteen browser tabs open and asking a competent junior analyst to "look into this and write it up."

The old workflow was passive aggregation: every tool a silo, every pivot manual, and the investigation logic — what to run next, what a finding means — living entirely in your head. The 2026 workflow is active and reasoning-driven. A typical agent loop looks like: generate search dorks for the target → enumerate accounts tied to an email → check breach databases → pivot to a discovered username → search that username across platforms → save the report. Each step is chosen by the model in response to the previous step's real output.

How does an OSINT MCP server work?

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic and now widely adopted, for connecting AI assistants to external tools and data. You implement an MCP server once — defining each tool, its input schema, and its description — and any MCP-compatible client (Claude Code, Claude Desktop, or another agent) can discover and invoke those tools automatically. Before MCP, you either hard-coded investigation logic into a fragile prompt or wrote a custom function-calling wrapper locked to one AI provider.

The design detail that makes this trustworthy is native tool use. When the agent decides to run, say, a breach check, it emits a tool call; your code executes the real underlying binary; and the real output is returned to the model. As the maintainer of OpenOSINT puts it, the model only ever reads real output and never generates it — so if a username tool finds twelve profiles, exactly those twelve go back into context and the model cannot invent a thirteenth. That is the maintainer's design claim, and it holds for the raw tool output; the model's summary of that output can still misread or overstate it, and text inside a tool result can carry instructions (see security), so check the summary against the raw output.

Which spec version applies? MCP versions are dates. The current revision is 2026-07-28, which makes the protocol stateless: each request carries its protocol version and client capabilities, servers must answer a server/discover call, and Roots, Sampling and Logging are deprecated (they keep working for at least twelve months). Clients and servers built for 2025-11-25 and earlier use the older handshake and can still interoperate through version negotiation. MCP versioning (checked 8 Oct 2026) Since 9 December 2025 the protocol is stewarded by the Agentic AI Foundation under the Linux Foundation rather than by Anthropic alone. Anthropic (9 Dec 2025)

Which AI apps support MCP in October 2026?

Every major assistant family now documents MCP support, but the details — which plans, which transports, read-only or read/write — differ. Only clients with a vendor documentation page are listed; each was checked on 8 October 2026.

Takeaway: write an OSINT MCP server once and it runs in all of these clients, but the plan you are on decides whether the agent can only read or can also act.

Which AI-agent OSINT tools matter in 2026?

A short, credible shortlist of what's actually shipping:

• OpenOSINT — an MIT-licensed, MCP-native framework offering an interactive AI REPL, a direct CLI, a browser Web UI, and an MCP server. It wraps proven tools (holehe, Sherlock, sublist3r, PhoneInfoga, Have I Been Pwned, plus Shodan, VirusTotal, Censys, AbuseIPDB, DNS and RDAP lookups — 21 tools in v2.31.0, released 6 October 2026) so an agent can chain them, and runs on Anthropic Claude (default), local Ollama, or any OpenAI-compatible endpoint. PyPI (6 Oct 2026)
• Vendor-run MCP servers — Have I Been Pwned, VirusTotal and Censys now host official MCP endpoints, so an agent can query those data sources directly with your own account and quota. Details, auth and caveats are in the verified table below.
• The underlying open-source tools the agents drive — Sherlock and Maigret (username search across hundreds to 3,000+ sites), holehe (email-to-accounts), PhoneInfoga (phone numbers), theHarvester and GHunt (domain/company footprint), and SpiderFoot (automated recon; its README claims 200+ modules).

For a broader, continuously updated catalog, the community lists awesome-osint and the OSINT Framework remain the standard reference points, and Bellingcat's toolkit and methodology guides are the gold standard for verification-first investigation.

OSINT MCP servers that exist (October 2026)

Every server below was checked on 8 October 2026 against its package registry (npm or PyPI), the official MCP Registry or the vendor's own documentation. "Last activity" is the most recent release or documentation update we could confirm, not a GitHub commit date. A row here means "exists and is maintained", not "audited" — treat every server as code that runs with your keys.

Checked and left out: we found no official MCP server from Maltego, Shodan or urlscan.io — only third-party wrappers or paid gateways that proxy your queries through someone else's infrastructure. The SpiderFoot wrapper we inspected had two commits. If you rely on one of these, read its code first and pin the version.

Takeaway: prefer vendor-run servers (HIBP, VirusTotal, Censys) and the reference servers, pin versions, and treat community wrappers as unaudited code holding your API keys.

Is MCP safe for OSINT? Security risks and incidents

MCP is a connection standard, not a sandbox. An OSINT agent is unusually exposed because its whole job is to read attacker-controllable content — web pages, profiles, paste dumps, WHOIS records — and feed it to a model that can call more tools. The documented risks:

• Prompt injection through tool output. Text in a fetched page or a GitHub issue can instruct the agent. Invariant Labs showed in May 2025 that a malicious public GitHub issue could make an agent using the official GitHub MCP server leak private-repository data. Invariant Labs (26 May 2025) OpenAI's MCP docs likewise warn that malicious servers "may include hidden instructions (prompt injections)". OpenAI (checked 8 Oct 2026)
• Tool poisoning. Instructions hidden in a tool's description — which the model reads but the user usually does not — can steer the agent; Invariant Labs disclosed this class in April 2025 and reported Cursor and other clients as susceptible. Invariant Labs (1 Apr 2025)
• Malicious or hijacked packages. The npm package postmark-mcp began silently BCC-ing every email it sent to an outside address from around version 1.0.16 (September 2025). Snyk (Sep 2025)
• Bugs in MCP plumbing. mcp-remote allowed OS command injection when connecting to an untrusted server (CVE-2025-6514, CVSS 9.6), and MCP Inspector before 0.14.1 allowed unauthenticated remote code execution (CVE-2025-49596, CVSS 9.4). Both are patched — keep tooling updated.
• Over-broad credentials. A stdio server reads its keys from your environment, so one compromised server can use every key in that shell. Give each server its own low-privilege key, and never let an OSINT agent hold credentials to your real accounts.

What the spec's authorization model does — and doesn't — cover. Authorization is optional in MCP. For HTTP servers it is OAuth 2.1-based: the server is a resource server, clients must request tokens bound to that specific server (RFC 8707 resource indicators), and servers "MUST NOT accept or transit any other tokens", which rules out token passthrough. Stdio servers instead take credentials from the environment. MCP authorization spec (2026-07-28) The tools spec adds that there "SHOULD always be a human in the loop with the ability to deny tool invocations". MCP tools spec None of this stops prompt injection: it governs who may call a server, not what a page tells your model. The project's security best practices cover confused-deputy, SSRF and scope-minimization attacks in detail.

Takeaway: assume anything an OSINT agent reads may try to give it orders, and limit what a hijacked agent could do with the tools and keys you have handed it.

How do you wire a safe OSINT agent?

A short checklist that applies whichever client and servers you choose. The OpSec half follows our OpSec & managed attribution guide; the legal half follows Is OSINT legal?

1. Plan before you connect anything. Write the question, scope and stop conditions first — the AI Investigation Planner turns a selector into a step-by-step plan you can hand to the agent.
2. Read-only by default. Connect lookup servers only; leave email-sending, posting and file-writing tools out of an investigation agent, and allow the filesystem server only on the case folder.
3. Keep human approval on for every tool call that sends data out (submissions, searches on a person's name or email). The MCP spec recommends a human who can deny tool calls, and OpenAI's Responses API lets you require explicit approval per call.
4. One key per server, least privilege, spend caps. Separate API keys you can revoke; set quota limits on paid sources (Censys credits, WhoisXML, VirusTotal's 1,000/day).
5. Separate the sock puppet from you. Browser automation must use a dedicated profile, account and egress — never your logged-in personal browser. See sock-puppet accounts and machine isolation.
6. Treat tool output as data, not instructions. Tell the agent so in its system prompt, and stop the run if it starts doing things you did not ask for.
7. Respect rate limits, robots.txt and terms. Do not disable the fetch server's robots.txt handling or use CAPTCHA-bypass tools on sites whose terms forbid scraping — automation does not change what the law and the courts say about scraping.
8. Log everything. Keep the agent's tool-call log and save each finding with a timestamp and hash in the Evidence Logger, so every claim in the report traces back to a captured source.
9. Pivot with known-good tools. When the agent turns up a selector, check it by hand: dorks for a name or domain in the Dork Generator, URL patterns for a profile or post in the URL Pivot Encyclopedia, and ready-made prompts in the AI dork library (infrastructure, contact details, due diligence, verification).
10. Verify before you report. Every agent finding is a lead until a human has opened the original source.

Takeaway: a safe OSINT agent is read-only, separated from your identity, approval-gated and fully logged.

AI geolocation: finding where a photo was taken — without EXIF

Most geolocation tools depend on EXIF metadata, which is stripped the moment an image is posted to most social platforms. The 2026 development is visual-inference geolocation. GeoSeer, launched in late 2025, uses a parallel multi-agent architecture to read raw visual cues — landmarks, architecture, terrain, signage, vegetation, lighting — and returns GPS coordinates, city, and country from a single image, no EXIF required. On the face-search side, PimEyes layered AI enhancements in 2026 to match a face across the open web despite changes in angle, age, and background.

These are powerful and correspondingly sensitive. Use them for legitimate verification — confirming the origin of footage, supporting missing-persons work — and never for stalking, doxxing, or surveillance of private individuals. If you want to work from the metadata side first, our in-browser EXIF Viewer maps any embedded GPS coordinates and lets you scrub metadata before sharing.

Browser-based alternatives to the CLI classics (no install)

Here's the catch with almost every tool above: it's a command-line Python program you have to install. That's fine for analysts with a configured environment, but a real barrier if you're on a locked-down machine, new to OSINT, or just need one quick lookup. Browser-based suites run the same categories of lookups against the same public sources, with no install and no signup. This is where Max Intel fits — as the no-setup alternative:

The trade-off is real: the CLI tools are more configurable and scriptable, and an MCP-driven agent can chain them at speed. The browser tools win on zero setup and instant access. Many investigators use both — a browser suite for the first pass and quick pivots, the CLI/agent stack for depth.

Using AI agents for OSINT responsibly

OSINT works only with publicly available information, but legality depends on how you collect and use it. The reputable AI-OSINT projects state plainly that they are for authorized security research, penetration testing, and investigative journalism, and that users are responsible for compliance with laws such as GDPR, CCPA, and the CFAA. Automation raises the stakes because it makes it trivial to gather a lot, fast:

• Verify everything. Even tool-grounded agents can misread output; a general chatbot asked to "investigate" someone will confidently invent accounts and connections. Always trace an AI-surfaced finding back to its original source.
• Respect terms and rate limits. Aggressive automated scraping breaks platform rules and gets you blocked or worse.
• Never use these tools for stalking, harassment, doxxing, or unauthorized surveillance. The same ethical guardrails that apply to any OSINT work apply here — automation just makes discipline more important.
• Keep your identity out of the agent's footprint. Run agents from sock-puppet accounts and isolated browsers, as set out in our OpSec & managed attribution guide, and check the jurisdiction-specific rules in Is OSINT legal? before automating collection on people.

The limitations (an honest assessment)

Agentic OSINT is genuinely useful, but it is not magic. Agents can only see what's already public — private profiles, paywalled content, and login-gated data stay invisible. Non-tool-grounded "AI investigation" is prone to hallucination, and even tool-grounded agents can be steered by instructions planted in the pages and records they read. Running many API-backed tools costs money, and platforms actively rate-limit and block automated access. And the broader lesson from 2026 research holds: AI answer systems behave like consensus engines, trusting facts that appear across multiple independent sources — so a single tool's output is a lead to verify, not a conclusion. Treat the agent as a fast, tireless junior analyst whose work you always check.

Sources and further reading

OpenOSINT (github.com/OpenOSINT/OpenOSINT) and openosint.tech; the awesome-osint list; the OSINT Framework; Bellingcat's Online Investigation Toolkit; GeoSeer (geoseeer.com); and the official Model Context Protocol documentation (modelcontextprotocol.io). Statistics and tool capabilities are directional and change monthly — re-verify anything that will drive a decision, and confirm each tool is current and reputable before use.

Added in the October 2026 update (all checked 8 October 2026):

• MCP specification: versioning, 2026-07-28 changelog, authorization, tools, security best practices, registry and its moderation policy.
• Governance and history: Anthropic, Introducing the Model Context Protocol (25 Nov 2024) and Donating MCP and establishing the Agentic AI Foundation (9 Dec 2025).
• Client documentation: linked in the client table.
• Server data: npm and PyPI release metadata, the MCP Registry API, and the vendor pages linked in the server table.
• Incidents: Invariant Labs (tool poisoning, GitHub MCP), Snyk on postmark-mcp, and NVD entries for CVE-2025-6514, CVE-2025-49596, CVE-2025-53109 and CVE-2025-53110.