hunter-domain-search

v0.1.0Verified publisher
Report a problem

Lists the email addresses Hunter has found for a domain, with names, positions, confidence and the address pattern

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/hunter-domain-search","target":"example.com","input_type":"domain"}

Or just say: "Run osintverse-community/hunter-domain-search on example.com with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/hunter-domain-search d:example.com --format table
ot install osintverse-community/hunter-domain-search

Docker image in a read-only container · talks to api.hunter.io · needs HUNTER_API_KEY · up to 1 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.
  • Pinnedimage sha256:e4cd4bfd…442434. The same bytes on every install; ot pulls by digest, never by tag.
  • Signedby https://github.com/osintverse-community/hunter-domain-search/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
  • Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 100 packages.
  • Workssmoke test passed on 24 Oct 2026 (exit 3 in 3.2 s, offline sandbox); the nightly health check has not run yet.
  • Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/hunter-domain-search@0.1.0",
  "runtime": "docker",
  "input": {
    "domain": "example.com"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "email",
      "value": "ada@example.com",
      "confidence": "high"
    },
    {
      "type": "person",
      "value": "Jane Doe",
      "source": "gitlab.com"
    },
    {
      "type": "organization",
      "value": "Example Ltd"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

Lists the email addresses Hunter has found for a domain. Each address comes with its owner's name, position, department and seniority, whether it is a personal or generic address, Hunter's confidence score and verification status, any LinkedIn, X or phone details Hunter has, and the pages it was seen on. The organisation behind the domain is reported with its usual address pattern (such as {first}.{last}). Uses the pyhunter client for Hunter's API. Only Hunter's database is read, so nobody at the domain is contacted.

ot run osintverse-community/hunter-domain-search --domain example.com

Inputs

Input Required
domain yes
limit no Most addresses to return: 10 by default, which is what free plans get; paid plans allow up to 100

Keys

HUNTER_API_KEY, set with ot keys set HUNTER_API_KEY. A free Hunter account includes a monthly allowance of searches: https://hunter.io/api-keys. Without the key the tool exits with code 3.

Notes

The results are people's work addresses, so ot and agents treat a run as collecting personal data and ask before running it. Hunter's confidence score becomes the entity's confidence: high from 90, medium from 50.

Next steps

Check an address with osintverse-community/holehe, or look the organisation up in osintverse-community/companies-house or osintverse-community/gleif.

Development

pip install pyhunter==2.1.0
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

hunter-domain-search finds email, person, organization. Tools that take those:

email → 10 toolsperson → 2 toolsorganization → 6 toolsot auto, with a saved result

Other domain tools

All domain tools →

Alternatives to hunter-domain-search that also take a domain; ot auto runs every installed one on the same value.

osintverse-community/checkdmarc

Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problems

Takes domain → finds dns record, domain
No key · Python wheel · 149 installs / 30 days
Worked todayVerified publisher

osintverse-community/tlsx

Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARM

Takes domain → finds certificate, domain
No key · Docker
Worked todayVerified publisher

osintverse-community/dns-records

Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records

Takes domain → finds dns record, domain, ip
No key · Docker
Worked todayVerified publisher

osintverse-community/dnstwist

Finds registered look-alike domains for phishing, typosquatting and brand impersonation

Takes domain → finds domain, ip
No key · Python wheel
Worked todayVerified publisher

osintverse-community/dnsrecon

Enumerates a domain's DNS: standard records, SRV services, zone transfer checks and DNSSEC

Takes domain → finds dns record, domain, ip
No key · Docker
Worked todayVerified publisher
Esc

Try

↑ ↓ to move↵ to open