# OSINT.SX (npm · osintsx-mcp)

Search an email, phone, username or name across every OSINT.SX source, plus account history tools.

- Trust score: 78/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `osintsx-mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp.md), [page](https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp)

## Channel facts

- Registry: `npm`
- Package: `osintsx-mcp`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 92 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to osintsx/osintsx-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1277 tokens (~159/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 86% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the OSINT.SX MCP server?

OSINT.SX runs locally as an npm package, launched with npx -y osintsx-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add osintsx-osintsx-mcp -- npx -y osintsx-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "osintsx-osintsx-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "osintsx-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "osintsx-osintsx-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "osintsx-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add osintsx-osintsx-mcp -- npx -y osintsx-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "osintsx-osintsx-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "osintsx-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add osintsx-osintsx-mcp --command npx --arg -y --arg osintsx-mcp
```

### Hermes

```yaml
mcp_servers:
  osintsx-osintsx-mcp:
    command: "npx"
    args: ["-y", "osintsx-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "osintsx-osintsx-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "osintsx-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add osintsx-osintsx-mcp -t stdio -c npx -a -y osintsx-mcp
```

### Other

```json
{
  "mcpServers": {
    "osintsx-osintsx-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "osintsx-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-31 (score 78, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-30 (score 63)

First indexed and scored.

## MCP tools (8)

### `search` (~204 tokens)

Search every source

Check one email address, phone number, username or full name against every OSINT.SX source at once and return each site where it's registered, with the details that site shows (names, usernames, photos, join dates). Costs 1 credit (a username search uses one of the day's free username searches first, if the account has any); if most sources fail and nothing is found, the credit is given back. Phone numbers must be in +E.164 format, like +14155550123.

Input parameters:

- `identifier` (string, required): The email, phone number, username or full name to search for.
- `include_alerting_sources` (boolean): Also run sources that may notify the person (for example a password-reset style check). Off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). Sources that haven't answered by then are cancelled.
- `type` (string, required): What kind of identifier this is.

### `google_account_lookup` (~167 tokens)

Google account lookup

Find Google accounts and their Gaia IDs by email address, full name or email domain, or look one up by Gaia ID. A name search matches the whole name; use * as a wildcard for a partial name. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `include_raw` (boolean): Return everything each source sent instead of the main fields. Much longer; off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `query` (string, required): The email, name, domain or Gaia ID.
- `query_type` (string, required)

### `microsoft_account_lookup` (~161 tokens)

Microsoft account lookup

Find Microsoft accounts by email address, full name or email domain, or look one up by CID. A name search matches the whole name; use * as a wildcard for a partial name. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `include_raw` (boolean): Return everything each source sent instead of the main fields. Much longer; off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `query` (string, required): The email, name, domain or CID.
- `query_type` (string, required)

### `epic_games_lookup` (~179 tokens)

Epic Games account lookup

Find Epic Games accounts by display name or account ID, or by the username on a linked platform (Xbox, PlayStation, Steam and others). Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `include_raw` (boolean): Return everything each source sent instead of the main fields. Much longer; off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `platform` (string): Required when query_type is platform: which linked platform the username is from.
- `query` (string, required): The display name, account ID, or the username on the linked platform.
- `query_type` (string, required)

### `twitter_history` (~132 tokens)

X (Twitter) profile history

Look up an X profile and its archived history: each earlier username, display name, bio, location and profile picture, including accounts X no longer shows. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `query` (string, required): The username (without @), numeric user ID or profile URL.
- `query_type` (string, required)

### `steam_history` (~127 tokens)

Steam profile history

Look up a Steam profile and its archived history: earlier names, custom URLs and avatars, and other accounts that held the same custom URL. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `query` (string, required): A custom URL, SteamID64 (the 17-digit account number) or profile URL.

### `instagram_share_trace` (~150 tokens)

Instagram share link trace

Find the account that shared an Instagram link, from a link copied with the Share button in the app. A link from a browser's address bar can't be traced. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `include_raw` (boolean): Return everything each source sent instead of the main fields. Much longer; off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `url` (string, required): The share link, as copied from the Instagram app.

### `tiktok_share_trace` (~157 tokens)

TikTok share link trace

Find the account that shared a TikTok link, from a short share link copied in the app. It works unless the sharer turned off account suggestions, and share links can expire. Costs 1 credit (or one of a pack's free daily tool searches); finding nothing or failing costs nothing.

Input parameters:

- `include_raw` (boolean): Return everything each source sent instead of the main fields. Much longer; off by default.
- `max_wait_seconds` (integer): Seconds to wait before returning what has arrived so far (default 50). The tool keeps running on OSINT.SX after that, so its credit may still be used.
- `url` (string, required): The short share link, as copied from the TikTok app.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp#diagnostics

## Score history

- 2026-11-05: 78
- 2026-11-04: 78
- 2026-11-03: 78
- 2026-11-02: 78
- 2026-11-01: 78
- 2026-10-31: 78
- 2026-10-30: 63

## Common questions

### What is the OSINT.SX MCP server?

OSINT.SX is an MCP server listed in the public MCP registry as io.github.osintsx/osintsx-mcp. Search an email, phone, username or name across every OSINT.SX source, plus account history tools. This page covers its npm package (osintsx-mcp).

### Is the OSINT.SX MCP server safe to use?

OSINT.SX scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the OSINT.SX MCP server expose?

OSINT.SX exposes 8 tools: search, google_account_lookup, microsoft_account_lookup, epic_games_lookup, twitter_history, and 3 more. Their descriptions and schemas cost roughly 1,277 tokens of context every time the server is loaded.

### Is the OSINT.SX MCP server still maintained?

OSINT.SX is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the OSINT.SX MCP server under?

OSINT.SX declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/osintsx-mcp
- Socket report: https://socket.dev/npm/package/osintsx-mcp
- Repository: https://github.com/osintsx/osintsx-mcp
- Website: https://osint.sx/api
- Changelog RSS feed: https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp.json
- HTML version of this page: https://verifymcp.io/servers/osintsx-osintsx-mcp/osintsx-mcp