Openosint

2.30.0

AI-powered OSINT agent with interactive REPL, MCP server, and direct CLI modes.

Verified 30 Sept 2026
pip 2.30.0
MIT
1.6k stars
Optional API keys

Source on GitHub · PyPI release · Markdown

Install and run

UsernameEmailDomain

otlite install openosint
Installs openosint==2.30.0 into its own virtualenv, with holehe, sherlock-project. otlite lists what it will install and asks before it starts.
otlite run openosint -- u:johndoe
openosint receives openosint username johndoe
otlite run openosint -- e:ada@example.com
openosint receives openosint email ada@example.com
otlite run openosint -- d:example.com
openosint receives openosint dns example.com

No otlite yet? Install it in one line

curl -fsSL https://get.otinstaller.com/otlite | sh

Linux and macOS, no Docker. It uses your Python and pipx when both are there, and otherwise brings its own Python. About otlite · otlite docs

Before you run it

Notes

Direct email and username scans work without ANTHROPIC_API_KEY; the AI REPL and MCP modes need it, or --api-key.
Other features need their own keys: SHODAN_API_KEY (Shodan), VIRUSTOTAL_API_KEY (VirusTotal), CENSYS_API_ID and CENSYS_SECRET (Censys), ABUSEIPDB_API_KEY (AbuseIPDB) and IP2LOCATION_API_KEY (IP2Location).
Bright Data tools need BRIGHTDATA_API_KEY with BRIGHTDATA_SERP_ZONE or BRIGHTDATA_UNLOCKER_ZONE; OPENAI_API_KEY selects the OpenAI provider and OPENOSINT_PROXY_URL sets a proxy.

What it takes

Typed inputs after -- become Openosint's own arguments. Anything else after -- passes through unchanged, so every option of the tool still works.

Input	With otlite	`openosint` receives
Username`u:`	`otlite run openosint -- u:johndoe`	`openosint username johndoe`
Email`e:`	`otlite run openosint -- e:ada@example.com`	`openosint email ada@example.com`
Domain`d:`	`otlite run openosint -- d:example.com`	`openosint dns example.com`

API keys

All optional: Openosint runs without them and uses each one you set. otlite keys set asks for the value without showing it and saves it in ~/.otlite/.env, readable only by you. Each tool receives only the keys it declares, and values never appear in logs or results.

Key	Needed	Set it
`ANTHROPIC_API_KEY`	Optional	`otlite keys set ANTHROPIC_API_KEY`
`SHODAN_API_KEY`	Optional	`otlite keys set SHODAN_API_KEY`
`VIRUSTOTAL_API_KEY`	Optional	`otlite keys set VIRUSTOTAL_API_KEY`
`CENSYS_API_ID`	Optional	`otlite keys set CENSYS_API_ID`
`CENSYS_SECRET`	Optional	`otlite keys set CENSYS_SECRET`
`ABUSEIPDB_API_KEY`	Optional	`otlite keys set ABUSEIPDB_API_KEY`
`IP2LOCATION_API_KEY`	Optional	`otlite keys set IP2LOCATION_API_KEY`
`BRIGHTDATA_API_KEY`	Optional	`otlite keys set BRIGHTDATA_API_KEY`
`BRIGHTDATA_SERP_ZONE`	Optional	`otlite keys set BRIGHTDATA_SERP_ZONE`
`BRIGHTDATA_UNLOCKER_ZONE`	Optional	`otlite keys set BRIGHTDATA_UNLOCKER_ZONE`
`OPENAI_API_KEY`	Optional	`otlite keys set OPENAI_API_KEY`
`OPENOSINT_PROXY_URL`	Optional	`otlite keys set OPENOSINT_PROXY_URL`

What a run leaves

Every run is saved under results/ where you run otlite (or --output, or OTLITE_RESULTS_DIR): what the tool printed, a sidecar with how it ran, and an envelope.

results/openosint/johndoe/<time>_openosint_johndoe_<run id>.txt
results/openosint/johndoe/<time>_openosint_johndoe_<run id>.meta.json
results/openosint/johndoe/<time>_openosint_johndoe_<run id>.envelope.json

{
  "envelope": 1,
  "tool": "openosint@2.30.0",
  "runtime": "otlite",
  "input": { "target": "johndoe" },
  "case": null,
  "started_at": "…", "ended_at": "…", "duration_ms": …,
  "exit_code": 0,
  "status": "complete",
  "entities": [{ "type": "url", "value": "…" }, …],
  "warnings": [],
  "output": { "path": "results/openosint/johndoe/<time>_openosint_johndoe_<run id>.txt", "sha256": "…", "bytes": … }
}

The envelope's shape, the same for every tool; values elided. Its entities are the emails, domains, IP addresses and URLs found in the output, or the tool's own when it prints them.

otlite results --tool openosint

otlite extract openosint

otlite diff openosint johndoe

List the saved runs, pull out every indicator, or compare the two latest runs against the same target.

With other tools

These run it with every other installed tool that takes the same input, a few at a time, and save each run:

otlite run --all u:johndoe

otlite auto johndoe

Related tools

All 47 tools →