# io.github.frangelbarrera/osint-agent-skills (npm · @frangelbarrera/osint-agent-skills)

OSINT MCP server — 23 tools: DNS, WHOIS, Shodan, breaches, GEOINT, crypto. Works with Claude Code.

- Trust score: 69/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@frangelbarrera/osint-agent-skills`: 69/100 (this document), [markdown](https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills.md), [page](https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills)

## Channel facts

- Registry: `npm`
- Package: `@frangelbarrera/osint-agent-skills`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1503 tokens (~65/item across 23 items; 23 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 97% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add frangelbarrera-osint-agent-skills -- npx -y @frangelbarrera/osint-agent-skills
```

### Codex

```bash
codex mcp add frangelbarrera-osint-agent-skills -- npx -y @frangelbarrera/osint-agent-skills
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "frangelbarrera-osint-agent-skills": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@frangelbarrera/osint-agent-skills"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add frangelbarrera-osint-agent-skills --command npx --arg -y --arg @frangelbarrera/osint-agent-skills
```

### Hermes

```yaml
mcp_servers:
  frangelbarrera-osint-agent-skills:
    command: "npx"
    args: ["-y", "@frangelbarrera/osint-agent-skills"]
```

### Other

```json
{
  "mcpServers": {
    "frangelbarrera-osint-agent-skills": {
      "command": "npx",
      "args": [
        "-y",
        "@frangelbarrera/osint-agent-skills"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 50, −13)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 63, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-29 (score 81, +18)

- [security improvement] Malware scan: unverified → pass

### 2026-07-28 (score 63, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 81, +34)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: excellent
- [functional] First check of Tool coverage: 97
- [functional] First check of Schema quality: fail

### 2026-07-26 (score 47)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (23)

### `dns_lookup` (~100 tokens)

Resolve DNS records for a domain using Google's DoH resolver. Returns A, AAAA, MX, NS, TXT, CNAME, SOA, PTR, CAA, or SRV records as structured JSON. Use this as the default DNS lookup tool — it requires no API key.

Input parameters:

- `domain` (string, required): Target domain (e.g., example.com). Lowercase, no trailing dot.
- `type` (string): DNS record type to query.

### `rdap_lookup_domain` (~54 tokens)

Look up structured registration data for a domain via RDAP. Returns registrar, registration date, expiry, name servers, and abuse contacts as JSON.

Input parameters:

- `domain` (string, required): Target domain (e.g., example.com).

### `rdap_lookup_ip` (~64 tokens)

Look up network registration data for an IP address via RDAP. Returns network CIDR, ASN, holder name, country, and abuse contacts.

Input parameters:

- `ip` (string, required): IPv4 or IPv6 address (e.g., 8.8.8.8).

### `crt_sh_search` (~61 tokens)

Search Certificate Transparency logs for certificates issued for a domain. Use wildcard %.example.com to enumerate subdomains. Returns issuer, serial, validity window, and SAN entries.

Input parameters:

- `domain` (string, required): Target domain. Use %.example.com for wildcard subdomain search.

### `wayback_cdx` (~120 tokens)

Query the Internet Archive's CDX index for historical snapshots of a URL. Returns list of (timestamp, original URL, status code, MIME type) tuples. Useful for recovering deleted content and tracking changes over time.

Input parameters:

- `collapse` (string): Field to collapse on (default: digest, dedupes identical content).
- `from` (string): Start timestamp YYYYMMDD (optional).
- `to` (string): End timestamp YYYYMMDD (optional).
- `url` (string, required): Target URL or pattern (e.g., example.com/*).

### `wayback_save` (~39 tokens)

Trigger a Wayback Machine snapshot of a URL. Use to preserve evidence at the time of investigation.

Input parameters:

- `url` (string, required): URL to archive.

### `shodan_internetdb` (~60 tokens)

Look up the public Shodan profile of an IP — returns hostnames, open ports, CVE list, and tags. No API key required; less detailed than the paid Shodan API.

Input parameters:

- `ip` (string, required): IPv4 address.

### `ipinfo_lookup` (~59 tokens)

Look up geolocation, ASN, and hosting metadata for an IP via ipinfo.io free tier. Returns city, region, country, org (ASN + holder name), and hostname.

Input parameters:

- `ip` (string, required): IPv4 or IPv6 address.

### `bgpview_asn` (~56 tokens)

Look up ASN details — holder name, country, RIR, route prefixes, and upstream peers.

Input parameters:

- `asn` (string, required): AS number as digits (e.g., 15169) or AS15169 form.

### `github_user_lookup` (~48 tokens)

Look up a GitHub user's public profile — name, bio, location, email (if public), avatar, account creation date, repository count.

Input parameters:

- `username` (string, required): GitHub username.

### `github_code_search` (~60 tokens)

Search public GitHub code for keywords. Useful for finding leaked credentials, internal documentation, or references to a target. Severe rate limit without authentication.

Input parameters:

- `query` (string, required): GitHub code search query (e.g., 'example.com filename:.env').

### `urlscan_search` (~71 tokens)

Search urlscan.io public scans for a domain, IP, or URL. Returns recent scan results with page DOM, screenshots (if available), and detected technologies.

Input parameters:

- `query` (string, required): Search query (e.g., 'domain:example.com' or 'ip:1.2.3.4').

### `alienvault_otx_lookup` (~66 tokens)

Look up an indicator (domain, IP, hostname, URL, email, hash) in AlienVault OTX. Returns related pulses, threat actors, and other indicators linked by the community.

Input parameters:

- `indicator_type` (string, required)
- `value` (string, required): Indicator value.

### `hibp_breach_check` (~92 tokens)

Check whether an email appears in any HaveIBeenPwned breach. Free endpoint returns breach list (paid key required for breach names as of recent HIBP changes). NEVER use breach credentials to attempt login — that crosses from OSINT into intrusion.

Input parameters:

- `api_key` (string): HIBP API key (required for breach name listing).
- `email` (string, required): Email address to check.

### `gravatar_lookup` (~57 tokens)

Look up a Gravatar profile from an email address (MD5 hashed). Returns avatar URL, profile name, and links to other platforms if the user has linked them.

Input parameters:

- `email` (string, required): Email address to hash and look up.

### `virustotal_domain_report` (~75 tokens)

Look up a domain in VirusTotal. Returns detections, passive DNS records, related URLs, and historical categorizations. Free public API: 4 req/min, 500 req/day.

Input parameters:

- `api_key` (string, required): VirusTotal API key (free tier available).
- `domain` (string, required): Target domain.

### `shodan_host_lookup` (~57 tokens)

Look up full Shodan host data — banners, services, vulnerabilities, hostnames, tags. Requires Shodan API key.

Input parameters:

- `api_key` (string, required): Shodan API key.
- `ip` (string, required): IPv4 address.

### `securitytrails_history` (~81 tokens)

Look up historical DNS records for a domain via SecurityTrails. Returns A, AAAA, MX, NS, TXT history with timestamps. Useful for tracking infrastructure changes.

Input parameters:

- `api_key` (string, required): SecurityTrails API key.
- `domain` (string, required): Target domain.
- `record_type` (string): DNS record type to retrieve history for.

### `hunter_email_finder` (~51 tokens)

Find email addresses associated with a domain via Hunter.io. Returns candidate emails with confidence scores and sources.

Input parameters:

- `api_key` (string, required): Hunter.io API key.
- `domain` (string, required): Target domain.

### `nominatim_geocode` (~60 tokens)

Forward geocode an address or place name using OpenStreetMap Nominatim. Returns lat/long with bounding box. Strict 1 req/sec rate limit; must identify with User-Agent.

Input parameters:

- `query` (string, required): Address or place name.

### `blockchain_address_lookup` (~34 tokens)

Look up Bitcoin address balance and transactions via Blockchain.com. Free, no key.

Input parameters:

- `address` (string, required): Bitcoin address.

### `etherscan_address_lookup` (~67 tokens)

Look up Ethereum address transactions via Etherscan free API. Returns normal transactions, internal transactions, ERC-20 transfers, and ERC-721 transfers.

Input parameters:

- `address` (string, required): Ethereum address (0x...).
- `api_key` (string, required): Etherscan free API key.

### `mastodon_user_lookup` (~71 tokens)

Look up a Mastodon user by handle across the fediverse. Returns account ID, display name, bio, avatar, follower counts, and creation date.

Input parameters:

- `handle` (string, required): User handle without @ prefix.
- `instance` (string, required): Mastodon instance hostname (e.g., mastodon.social).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 50
- 2026-07-31: 63
- 2026-07-29: 81
- 2026-07-28: 63
- 2026-07-27: 81
- 2026-07-26: 47

## Links

- npm package: https://www.npmjs.com/package/@frangelbarrera/osint-agent-skills
- Socket report: https://socket.dev/npm/package/@frangelbarrera/osint-agent-skills
- Repository: https://github.com/frangelbarrera/osint-agent-skills
- Changelog RSS feed: https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills/changelog.json
- HTML version of this page: https://verifymcp.io/servers/frangelbarrera-osint-agent-skills/frangelbarrera-osint-agent-skills