# OTInstaller

> OTInstaller is a free, public registry of OSINT tools and investigation guides. Its command-line tool, `ot`, installs digest-pinned, signature-verified tools and runs them on your own machine in a locked-down container. Use it only for lawful investigation; see the [acceptable use policy](https://otinstaller.com/policy/acceptable-use.md).

An MCP client can search the registry through the read-only remote server at https://api.otinstaller.com/mcp (Streamable HTTP, no account). Installing and running tools needs `ot mcp` on the person's machine; see https://otinstaller.com/docs/agents.md.

Every docs, policy, tool and guide page is also available as Markdown: add `.md` to its URL (`/<namespace>/<name>.md` for a tool, `/guides/<namespace>/<name>/<page>.md` for a guide page), or send `Accept: text/markdown`.

## Start here

- [Getting started](https://otinstaller.com/docs/getting-started.md): Install the ot command and run an OSINT tool from the registry.
- [AI agents and MCP](https://otinstaller.com/docs/agents.md): Let Claude, Cursor, Codex and other AI agents search, install and run OSINT tools through ot's MCP server, with your consent for every run that touches a target.
- [MCP tools](https://otinstaller.com/docs/mcp-tools.md): Every tool, resource and prompt the ot mcp server offers AI agents.
- [CLI reference](https://otinstaller.com/docs/cli.md): Every ot command and its options.
- [Scripts, CI and agents](https://otinstaller.com/docs/automation.md): Using ot from scripts, CI and AI agents: JSON output, JSON errors, exit codes and running without a terminal.
- [Results and the envelope](https://otinstaller.com/docs/results.md): The result envelope, saved runs, the .meta.json sidecar and how tools report entities.
- [Error codes](https://otinstaller.com/docs/errors.md): What each validation, check and API error means and how to fix it.
- [Registry API](https://otinstaller.com/docs/api.md): The OTInstaller Registry API: the OpenAPI description, signing in with scoped tokens, rate limits, caching, ETags, pagination and errors.

## Docs

- [Documentation](https://otinstaller.com/docs.md): How to find, install and run OSINT tools with ot, and how to publish your own tools and guides.
- [Manifest reference](https://otinstaller.com/docs/manifest.md): Every field of otinstaller.yaml, the file that describes a tool or guide.
- [Publishing](https://otinstaller.com/docs/publishing.md): How a tag on GitHub or GitLab becomes a published package on the registry.
- [Guides and tool docs](https://otinstaller.com/docs/guides.md): Publish versioned Markdown guides and a Docs tab for your tool.
- [Security model](https://otinstaller.com/docs/security.md): What the registry checks before publishing, and what ot does before running a tool.
- [FAQ](https://otinstaller.com/docs/faq.md): Common questions about the OTInstaller Registry.
- [Quick start](https://otinstaller.com/docs/quick-start.md): Three commands from nothing to a result on your own machine.

## API and schemas

- [OpenAPI](https://api.otinstaller.com/v1/openapi.json): OpenAPI 3.1 description of the registry API
- [Types and pivot map](https://api.otinstaller.com/v1/types): input types, entity types, and which input types each entity type can feed
- [Manifest](https://otinstaller.com/schema/v1.json): JSON Schema for otinstaller.yaml
- [Result envelope](https://otinstaller.com/schema/envelope-v1.json): JSON Schema for the output of `ot run --format json`
- [Run-all summary](https://otinstaller.com/schema/run-all-v1.json): JSON Schema for the summary of `ot run --all`, `ot playbook` and `ot auto`
- [Error](https://otinstaller.com/schema/error-v1.json): JSON Schema for JSON errors from `ot` and the registry API

## Policies

- [Acceptable use policy](https://otinstaller.com/policy/acceptable-use.md): What tools and guides may be published on the OTInstaller Registry.
- [Terms of service](https://otinstaller.com/policy/terms.md): The terms for using and publishing on the OTInstaller Registry.
- [Privacy](https://otinstaller.com/policy/privacy.md): What the OTInstaller Registry stores about you, and what it doesn't.
- [Reports and takedowns](https://otinstaller.com/policy/takedown.md): How to report a tool or guide, and what the registry does about it.

## Tools by what you have

- [Email OSINT tools: find accounts, breaches and the sender behind an address](https://otinstaller.com/input/email): Free, open-source email OSINT tools you run with one command: check where an address is registered, trace a message's headers and find linked accounts, without alerting the owner.
- [Username OSINT tools: find accounts with the same handle across sites](https://otinstaller.com/input/username): Open-source username search tools (sherlock, maigret and more) that find where a handle is in use across thousands of sites. Install and run them in a sandbox with one command.
- [Phone number OSINT tools: carrier, country, line type and linked accounts](https://otinstaller.com/input/phone): Free phone number OSINT tools: parse a number offline for country, carrier and line type, then find the accounts and pages it is linked to. Run them sandboxed with one command.
- [Domain OSINT tools: DNS, subdomains, certificates, history and look-alikes](https://otinstaller.com/input/domain): Open-source domain OSINT and recon tools: DNS records, passive subdomain enumeration, certificate transparency, archived URLs, email security and typosquat detection, run sandboxed with one command.
- [IP address OSINT tools: ownership, open ports, services and CDN detection](https://otinstaller.com/input/ip): Free IP address OSINT tools: RDAP ownership and ASN, what Shodan has seen, open ports from passive sources, CDN and WAF detection. Run them sandboxed with one command.
- [URL OSINT tools: unpack links, archives, web servers, images and video metadata](https://otinstaller.com/input/url): Open-source URL tools for investigators: decode what a link encodes, find archived copies, probe the server behind it, and pull metadata from images, galleries and videos. Run sandboxed with one command.
- [Name OSINT tools: from a person's name to usernames and accounts](https://otinstaller.com/input/name): Open-source tools that turn a person's name into likely usernames to check across sites, run sandboxed with one command.
- [Image OSINT tools: metadata, reverse image search and geolocation](https://otinstaller.com/input/image): Free image verification tools: read EXIF and GPS metadata, build reverse image search links, hash images to find copies, and check a location on maps. Run them sandboxed with one command.
- [Crypto address OSINT tools: balance, history and counterparties of a Bitcoin or Ethereum address](https://otinstaller.com/input/crypto_address): Free blockchain OSINT tools: look up a Bitcoin or Ethereum address for balance, totals, recent transactions, ENS names and counterparties, one hop at a time. Run them sandboxed with one command.
- [Hash OSINT tools](https://otinstaller.com/input/hash): Tools that take a file or content hash and tell you what is known about it, run sandboxed with one command.
- [Company OSINT tools](https://otinstaller.com/input/company): Tools that take a company name and return what public records and the web say about it, run sandboxed with one command.

## Popular tools

- [osintverse-community/checkdmarc](https://otinstaller.com/osintverse-community/checkdmarc.md): Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problems
- [osintverse-community/dnstwist](https://otinstaller.com/osintverse-community/dnstwist.md): Finds registered look-alike domains for phishing, typosquatting and brand impersonation
- [osintverse-community/gallery-dl](https://otinstaller.com/osintverse-community/gallery-dl.md): Lists the images and metadata of posts and galleries on Reddit, Flickr, Imgur, Tumblr and 300+ sites
- [osintverse-community/ignorant](https://otinstaller.com/osintverse-community/ignorant.md): Checks whether a phone number is registered on Amazon, Instagram and Snapchat
- [osintverse-community/maigret](https://otinstaller.com/osintverse-community/maigret.md): Builds a profile of a person from a username: accounts on 3,000+ sites and the details they expose
- [osintverse-community/mailcat](https://otinstaller.com/osintverse-community/mailcat.md): Finds existing email addresses for a nickname across 25+ mail providers
- [osintverse-community/naminter](https://otinstaller.com/osintverse-community/naminter.md): Enumerates a username across the WhatsMyName site list with browser-like requests
- [osintverse-community/sherlock](https://otinstaller.com/osintverse-community/sherlock.md): Finds accounts by username across 400+ social networks and websites
- [osintverse-community/socialscan](https://otinstaller.com/osintverse-community/socialscan.md): Checks whether a username or email address is in use on major platforms, accurately and quickly
- [osintverse-community/tldextract](https://otinstaller.com/osintverse-community/tldextract.md): Splits a URL or hostname into subdomain, registered domain and public suffix
- [osintverse-community/unfurl](https://otinstaller.com/osintverse-community/unfurl.md): Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session data
- [osintverse-community/waybackpy](https://otinstaller.com/osintverse-community/waybackpy.md): Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a site
- [osintverse-community/yt-dlp](https://otinstaller.com/osintverse-community/yt-dlp.md): Extracts metadata from videos and channels on YouTube, TikTok, X, Instagram and 1,000+ other sites
- [osintverse-community/holehe](https://otinstaller.com/osintverse-community/holehe.md): Checks whether an email address is registered on 120+ sites, without alerting its owner
- [osintverse-community/dnsrecon](https://otinstaller.com/osintverse-community/dnsrecon.md): Enumerates a domain's DNS: standard records, SRV services, zone transfer checks and DNSSEC
- [osintverse-community/gau](https://otinstaller.com/osintverse-community/gau.md): Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscan
- [osintverse-community/cdncheck](https://otinstaller.com/osintverse-community/cdncheck.md): Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which one
- [osintverse-community/phoneinfoga](https://otinstaller.com/osintverse-community/phoneinfoga.md): Scans a phone number: carrier, line type and country, plus search links to find where it appears
- [osintverse-community/httpx](https://otinstaller.com/osintverse-community/httpx.md): Probes a host's web server: status, title, technologies, TLS, CDN and IP
- [osintverse-community/subfinder](https://otinstaller.com/osintverse-community/subfinder.md): Finds a domain's subdomains passively from dozens of public sources
- [osintverse-community/theharvester](https://otinstaller.com/osintverse-community/theharvester.md): Gathers emails, subdomains, hosts and IPs for a domain from public search engines and datasets
- [osintverse-community/ipwhois](https://otinstaller.com/osintverse-community/ipwhois.md): Looks up who holds an IP address through RDAP: network, ASN, organisation and contacts
- [osintverse-community/tlsx](https://otinstaller.com/osintverse-community/tlsx.md): Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARM
- [osintverse-community/naabu](https://otinstaller.com/osintverse-community/naabu.md): Lists an IP's open ports passively from Shodan InternetDB, without scanning it
- [osintverse-community/shodan-host](https://otinstaller.com/osintverse-community/shodan-host.md): Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, location
- [osintverse-community/mapcidr](https://otinstaller.com/osintverse-community/mapcidr.md): Expands, counts, splits and aggregates IP ranges in CIDR notation
- [osintverse-community/btc-address](https://otinstaller.com/osintverse-community/btc-address.md): Looks up a Bitcoin address: balance, totals, recent transactions and counterparties
- [osintverse-community/email-header-parser](https://otinstaller.com/osintverse-community/email-header-parser.md): Parses raw email headers into senders, relay hops, IPs and SPF/DKIM/DMARC results
- [osintverse-community/crtsh-subdomains](https://otinstaller.com/osintverse-community/crtsh-subdomains.md): Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotter
- [osintverse-community/eth-address](https://otinstaller.com/osintverse-community/eth-address.md): Looks up an Ethereum address: balance, ENS name, contract info, recent transactions
- [osintverse-community/dns-records](https://otinstaller.com/osintverse-community/dns-records.md): Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records
- [osintverse-community/geo-links](https://otinstaller.com/osintverse-community/geo-links.md): Turns coordinates into map, satellite, street-level and sun-position links for checking a place
- [osintverse-community/exif-meta](https://otinstaller.com/osintverse-community/exif-meta.md): Reads an online image or document's metadata with ExifTool: GPS, camera, authors, dates
- [osintverse-community/username-permutations](https://otinstaller.com/osintverse-community/username-permutations.md): Generates likely usernames from a person's name to search with username tools
- [osintverse-community/reverse-image-links](https://otinstaller.com/osintverse-community/reverse-image-links.md): Builds reverse image search links for an image URL: Google Lens, Bing, Yandex, TinEye and more
- [osintverse-community/phone-parse](https://otinstaller.com/osintverse-community/phone-parse.md): Parses a phone number offline: validity, formats, country, original carrier, line type, time zones
- [osintverse-community/image-hash](https://otinstaller.com/osintverse-community/image-hash.md): Computes perceptual hashes of an online image to match copies and near-duplicates

## Guides

- [osintverse-community/crypto-address-tracing](https://otinstaller.com/guides/osintverse-community/crypto-address-tracing.md): Cryptocurrency address tracing playbook. Balance, history and counterparties of a Bitcoin or Ethereum address, one hop at a time
- [osintverse-community/domain-investigation](https://otinstaller.com/guides/osintverse-community/domain-investigation.md): Domain investigation playbook. DNS, subdomains, certificates, history and look-alikes of a domain, passively first
- [osintverse-community/email-investigation](https://otinstaller.com/guides/osintverse-community/email-investigation.md): Email investigation playbook. Trace a suspicious message and find where an address is registered, without alerting its owner
- [osintverse-community/image-geolocation](https://otinstaller.com/guides/osintverse-community/image-geolocation.md): Image verification and geolocation playbook. Check a photo's metadata, find earlier copies, and work out where and when it was taken
- [osintverse-community/ip-investigation](https://otinstaller.com/guides/osintverse-community/ip-investigation.md): IP address investigation playbook. Who holds an IP, what it exposes and what runs next to it, without scanning it
- [osintverse-community/phone-investigation](https://otinstaller.com/guides/osintverse-community/phone-investigation.md): Phone number investigation playbook. Parse a number offline, then find accounts and mentions linked to it
- [osintverse-community/publish-a-guide](https://otinstaller.com/guides/osintverse-community/publish-a-guide.md): Publish a guide. Write, check and release a Markdown guide on the OTInstaller Registry
- [osintverse-community/publish-your-first-tool](https://otinstaller.com/guides/osintverse-community/publish-your-first-tool.md): Publish your first tool. Package a command-line OSINT tool and publish it to the OTInstaller Registry in about 20 minutes
- [osintverse-community/social-media-profiles](https://otinstaller.com/guides/osintverse-community/social-media-profiles.md): Social media profiles playbook. Collect and preserve what a public profile shows: posts, media metadata and archived copies
- [osintverse-community/username-investigation](https://otinstaller.com/guides/osintverse-community/username-investigation.md): Username investigation playbook. From a name or one handle to verified accounts across thousands of sites

## Optional

- [Full docs](https://otinstaller.com/llms-full.txt): every docs and policy page in one file