Introducing OTInstaller: every OSINT tool, one command
A free registry of open-source intelligence tools and guides, and a CLI that installs, runs and checks them the same way on Windows, macOS and Linux.
Every investigator has the same folder. It holds a username checker that needs an old Python, an email tool that stopped working when a site changed its sign-up page, a subdomain finder with its own output format, and a text file of install commands that worked once. Before the real work starts, there is an hour of setup.
OTInstaller is our answer: a free, public registry of OSINT tools and investigation guides, and ot, a small
command-line program that installs and runs any of them the same way.
One way to install and run everything
ot guide tools osintverse-community/email-investigation
ot run osintverse-community/holehe e:you@example.com
ot auto johndoe
The first command installs every tool the email investigation guide uses. The second checks which sites an address
is registered on. The third guesses that johndoe is a username and runs every installed tool that takes one. The
same verbs work for domains, phone numbers, IP addresses, images and cryptocurrency addresses.
Behind those commands, every tool on the registry has a manifest: what it takes as input (an email, a username, a
domain…), what it finds, how to run it, and whether it needs an API key. ot reads it, so you never need to know
whether a tool is a Docker image or a Python package, or what its flags are. Every run returns the same
JSON result envelope and is saved with a metadata file, which makes notes, reports and chaining tools
much easier.
No Docker? otlite installs the same kind of tools on Linux and macOS into their own Python environments.
Built to run other people’s code safely
Running a stranger’s script is the uncomfortable part of OSINT, so the registry is strict about what it lists:
- Signed by the author’s own build. A release from a repository is built and signed by the author’s GitHub or
GitLab CI.
otchecks the signature against the identity recorded when the package was first published, and refuses a mismatch. - Pinned. Images are referenced by digest and Python packages by hash, so a version can never change later.
- Scanned and reviewed. Every release is scanned for vulnerabilities, secrets and malicious packages and smoke-tested in a sandbox. A person reviews every new publisher before their first tool goes live.
- Locked down when it runs. Tools run in a read-only container with no capabilities, no network unless the tool declares it needs one, no access to your files beyond an output folder, and no shell between your input and the tool.
- Checked every night. OSINT tools break when websites change. Each tool’s test runs nightly, and its page says whether it worked last night.
The security model has the details.
Your investigations stay yours
Tools run on your own machine. The registry never sees who or what you look up, or what the tools find. Apart from
an anonymous install count, which you can turn off, ot sends nothing about your runs unless you choose to report a
broken one. Every tool declares whether it contacts the target, logs in to accounts or collects personal data, and
the acceptable use policy rules out stalkerware, credential attacks and leaked data. Anyone
can report a tool, and every removal is listed on the transparency page.
Guides that set up their own tools
The registry also hosts guides: investigation playbooks for an email address, a username, a domain, an IP
address, a phone number, an image, social media profiles and a cryptocurrency address, plus guides to publishing your
own tool and guide. Each guide links only to tools on the registry, and ot guide tools installs all of them at
once. Read them on the site or in the terminal with ot guide read. New to OSINT? Start with Learn.
Works with AI agents
ot has an MCP server built in, so Claude, Cursor, Codex, VS Code and Gemini CLI can search the registry, install
tools and run them for you: ot mcp install claude sets it up, and a Claude Code plugin adds investigation skills.
The agent has to ask you before any run that goes online, contacts the target or involves a person, naming the exact
tool and target, and every run it makes is written to a log on your machine (ot mcp audit). Tools still run in the
same locked-down container on your computer. See AI agents.
For tool authors
Your code stays where it is. Sign in with GitHub or GitLab, open the import wizard, pick a repository, and
the registry drafts the manifest and a release workflow and opens a pull or merge request. Merge it, run the
workflow, and every tagged release after that is checked and published automatically. No repository? ot publish
uploads a release straight to the registry. You get a package page, install counts, health checks, and backups: if
your repository is ever taken down by mistake, the registry’s mirror keeps installs working and you can restore your
code from a bundle. Publishing walks through it.
Many well-known tools are already on the registry as community-packaged wrappers, credited to their authors. If you maintain one, you can claim it and keep its history and installs.
What’s next
OTInstaller is free, and its code is open source under Apache-2.0 (github.com/OTInstaller/otinstaller). Next come more tools: tell us which ones on tool requests. What changes from week to week is in the changelog.
Get started in a minute:
curl -fsSL https://get.otinstaller.com/ot | sh # macOS and Linux
irm https://get.otinstaller.com/ot.ps1 | iex # Windows PowerShell
ot doctor
Then browse the registry at otinstaller.com, and tell us what you think with ot feedback.
More posts · Changelog · This post as Markdown