io.github.frangelbarrera/osint-agent-skills

NPM · @FRANGELBARRERA/OSINT-AGENT-SKILLS · SCANNED AUG 4

OSINT MCP server — 23 tools: DNS, WHOIS, Shodan, breaches, GEOINT, crypto. Works with Claude Code.

Available components

npm · @frangelbarrera/osint-agent-skills 69

+6 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security100

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
No production dependencies, so there is no dependency health to assess. View diagnostics → Pass

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 7 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1503 tokens (~65/item across 23 items; 23 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities20

Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @frangelbarrera/osint-agent-skills

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add frangelbarrera-osint-agent-skills -- npx -y @frangelbarrera/osint-agent-skills

# add to Codex CLI

codex mcp add frangelbarrera-osint-agent-skills -- npx -y @frangelbarrera/osint-agent-skills

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "frangelbarrera-osint-agent-skills": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@frangelbarrera/osint-agent-skills"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add frangelbarrera-osint-agent-skills --command npx --arg -y --arg @frangelbarrera/osint-agent-skills

# ~/.hermes/config.yaml

mcp_servers:
  frangelbarrera-osint-agent-skills:
    command: "npx"
    args: ["-y", "@frangelbarrera/osint-agent-skills"]

// mcp.json

{
  "mcpServers": {
    "frangelbarrera-osint-agent-skills": {
      "command": "npx",
      "args": [
        "-y",
        "@frangelbarrera/osint-agent-skills"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
1 Aug 26 −13
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
29 Jul 26 +18
- Malware scan: unverified → pass ▲ security
28 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 +34
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: pass functional
- First check of Schema quality: excellent functional
- First check of Tool coverage: 97 functional
- First check of Schema quality: fail functional
26 Jul 26 47

First indexed and scored.
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@frangelbarrera/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 0 packages

0 packages in the resolved dependency tree.

MCP tools — 23 exposed · ~1,503 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

alienvault_otx_lookup ~66

Look up an indicator (domain, IP, hostname, URL, email, hash) in AlienVault OTX. Returns related pulses, threat actors, and other indicators linked by the community.

Input Output Examples

Name	Type	Req	Description
indicator_type	string	yes	—
value	string	yes	Indicator value.

No output schema declared.

No examples provided.

bgpview_asn ~56

Look up ASN details — holder name, country, RIR, route prefixes, and upstream peers.

Input Output Examples

Name	Type	Req	Description
asn	string	yes	AS number as digits (e.g., 15169) or AS15169 form.

No output schema declared.

No examples provided.

blockchain_address_lookup ~34

Look up Bitcoin address balance and transactions via Blockchain.com. Free, no key.

Input Output Examples

Name	Type	Req	Description
address	string	yes	Bitcoin address.

No output schema declared.

No examples provided.

crt_sh_search ~61

Search Certificate Transparency logs for certificates issued for a domain. Use wildcard %.example.com to enumerate subdomains. Returns issuer, serial, validity window, and SAN entries.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Target domain. Use %.example.com for wildcard subdomain search.

No output schema declared.

No examples provided.

dns_lookup ~100

Resolve DNS records for a domain using Google's DoH resolver. Returns A, AAAA, MX, NS, TXT, CNAME, SOA, PTR, CAA, or SRV records as structured JSON. Use this as the default DNS lookup tool — it requires no API key.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Target domain (e.g., example.com). Lowercase, no trailing dot.
type	string	—	DNS record type to query.

No output schema declared.

No examples provided.

etherscan_address_lookup ~67

Look up Ethereum address transactions via Etherscan free API. Returns normal transactions, internal transactions, ERC-20 transfers, and ERC-721 transfers.

Input Output Examples

Name	Type	Req	Description
address	string	yes	Ethereum address (0x...).
api_key	string	yes	Etherscan free API key.

No output schema declared.

No examples provided.

github_code_search ~60

Search public GitHub code for keywords. Useful for finding leaked credentials, internal documentation, or references to a target. Severe rate limit without authentication.

Input Output Examples

Name	Type	Req	Description
query	string	yes	GitHub code search query (e.g., 'example.com filename:.env').

No output schema declared.

No examples provided.

github_user_lookup ~48

Look up a GitHub user's public profile — name, bio, location, email (if public), avatar, account creation date, repository count.

Input Output Examples

Name	Type	Req	Description
username	string	yes	GitHub username.

No output schema declared.

No examples provided.

gravatar_lookup ~57

Look up a Gravatar profile from an email address (MD5 hashed). Returns avatar URL, profile name, and links to other platforms if the user has linked them.

Input Output Examples

Name	Type	Req	Description
email	string	yes	Email address to hash and look up.

No output schema declared.

No examples provided.

hibp_breach_check ~92

Check whether an email appears in any HaveIBeenPwned breach. Free endpoint returns breach list (paid key required for breach names as of recent HIBP changes). NEVER use breach credentials to attempt login — that crosses from OSINT into intrusion.

Input Output Examples

Name	Type	Req	Description
api_key	string	—	HIBP API key (required for breach name listing).
email	string	yes	Email address to check.

No output schema declared.

No examples provided.

hunter_email_finder ~51

Find email addresses associated with a domain via Hunter.io. Returns candidate emails with confidence scores and sources.

Input Output Examples

Name	Type	Req	Description
api_key	string	yes	Hunter.io API key.
domain	string	yes	Target domain.

No output schema declared.

No examples provided.

ipinfo_lookup ~59

Look up geolocation, ASN, and hosting metadata for an IP via ipinfo.io free tier. Returns city, region, country, org (ASN + holder name), and hostname.

Input Output Examples

Name	Type	Req	Description
ip	string	yes	IPv4 or IPv6 address.

No output schema declared.

No examples provided.

mastodon_user_lookup ~71

Look up a Mastodon user by handle across the fediverse. Returns account ID, display name, bio, avatar, follower counts, and creation date.

Input Output Examples

Name	Type	Req	Description
handle	string	yes	User handle without @ prefix.
instance	string	yes	Mastodon instance hostname (e.g., mastodon.social).

No output schema declared.

No examples provided.

nominatim_geocode ~60

Forward geocode an address or place name using OpenStreetMap Nominatim. Returns lat/long with bounding box. Strict 1 req/sec rate limit; must identify with User-Agent.

Input Output Examples

Name	Type	Req	Description
query	string	yes	Address or place name.

No output schema declared.

No examples provided.

rdap_lookup_domain ~54

Look up structured registration data for a domain via RDAP. Returns registrar, registration date, expiry, name servers, and abuse contacts as JSON.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Target domain (e.g., example.com).

No output schema declared.

No examples provided.

rdap_lookup_ip ~64

Look up network registration data for an IP address via RDAP. Returns network CIDR, ASN, holder name, country, and abuse contacts.

Input Output Examples

Name	Type	Req	Description
ip	string	yes	IPv4 or IPv6 address (e.g., 8.8.8.8).

No output schema declared.

No examples provided.

securitytrails_history ~81

Look up historical DNS records for a domain via SecurityTrails. Returns A, AAAA, MX, NS, TXT history with timestamps. Useful for tracking infrastructure changes.

Input Output Examples

Name	Type	Req	Description
api_key	string	yes	SecurityTrails API key.
domain	string	yes	Target domain.
record_type	string	—	DNS record type to retrieve history for.

No output schema declared.

No examples provided.

shodan_host_lookup ~57

Look up full Shodan host data — banners, services, vulnerabilities, hostnames, tags. Requires Shodan API key.

Input Output Examples

Name	Type	Req	Description
api_key	string	yes	Shodan API key.
ip	string	yes	IPv4 address.

No output schema declared.

No examples provided.

shodan_internetdb ~60

Look up the public Shodan profile of an IP — returns hostnames, open ports, CVE list, and tags. No API key required; less detailed than the paid Shodan API.

Input Output Examples

Name	Type	Req	Description
ip	string	yes	IPv4 address.

No output schema declared.

No examples provided.

urlscan_search ~71

Search urlscan.io public scans for a domain, IP, or URL. Returns recent scan results with page DOM, screenshots (if available), and detected technologies.

Input Output Examples

Name	Type	Req	Description
query	string	yes	Search query (e.g., 'domain:example.com' or 'ip:1.2.3.4').

No output schema declared.

No examples provided.

virustotal_domain_report ~75

Look up a domain in VirusTotal. Returns detections, passive DNS records, related URLs, and historical categorizations. Free public API: 4 req/min, 500 req/day.

Input Output Examples

Name	Type	Req	Description
api_key	string	yes	VirusTotal API key (free tier available).
domain	string	yes	Target domain.

No output schema declared.

No examples provided.

wayback_cdx ~120

Query the Internet Archive's CDX index for historical snapshots of a URL. Returns list of (timestamp, original URL, status code, MIME type) tuples. Useful for recovering deleted content and tracking changes over time.

Input Output Examples

Name	Type	Req	Description
collapse	string	—	Field to collapse on (default: digest, dedupes identical content).
from	string	—	Start timestamp YYYYMMDD (optional).
to	string	—	End timestamp YYYYMMDD (optional).
url	string	yes	Target URL or pattern (e.g., example.com/*).

No output schema declared.

No examples provided.

wayback_save ~39

Trigger a Wayback Machine snapshot of a URL. Use to preserve evidence at the time of investigation.

Input Output Examples

Name	Type	Req	Description
url	string	yes	URL to archive.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 4 Aug

Day	Score
26 Jul	47
27 Jul	81
28 Jul	63
29 Jul	81
31 Jul	63
1 Aug	50
2 Aug	65
3 Aug	65
4 Aug	69