The Definitive List of MCP Servers for OSINT (2026 Edition)

Today, Model Context Protocol (MCP) allows an AI assistant to interact directly with these tools, orchestrating complete investigative workflows instead of simply answering questions.

As highlighted in recent research, the revolution is not about new OSINT tools, but about existing tools becoming autonomous through standardized AI connectors.

An MCP (Model Context Protocol) server exposes an application or data source through a standardized interface that any LLM can use.

Instead of building custom integrations for every AI model and every OSINT platform:

LLM
 │
 ├── MCP → Shodan
 ├── MCP → VirusTotal
 ├── MCP → Maigret
 ├── MCP → WHOIS
 ├── MCP → Company Registry
 ├── MCP → DNS
 ├── MCP → BrightData
 └── MCP → Internal Database

The AI becomes an orchestrator:

• decides which tool to use

• executes the query

• interprets the result

• determines the next investigative step

• writes the report

This evolution aligns with the broader shift from manual intelligence collection to AI-assisted orchestration described in recent OSINT literature.

Traditional workflow:

Investigator
    ↓
Shodan
    ↓
VirusTotal
    ↓
WHOIS
    ↓
DNS
    ↓
LinkedIn
    ↓
Company Registry
    ↓
Excel
    ↓
Report

MCP workflow:

Investigator
      ↓
Prompt
"Investigate ACME Ltd"
      ↓
LLM
      ↓
MCP Servers
      ↓
Automatic Investigation
      ↓
Structured Intelligence Report

The analyst moves from executing searches to validating intelligence.

Purpose:

Username investigation

Capabilities:

• username enumeration

• account discovery

• social profile correlation

• forgotten accounts

• historical usernames

Ideal for:

• SOCMINT

• Threat Hunting

• Insider investigations

A ransomware negotiator publishes under the username:

darkphoenix

Prompt:

Find every public account associated with “darkphoenix”.

The AI:

• launches Maigret

• queries thousands of platforms

• discovers:

• GitHub

• Reddit

• Mastodon

• old forum profile

• Steam account

• archived blogs

The AI automatically correlates:

• reused avatar

• reused email

• reused bio

• timezone

instead of forcing the analyst to pivot manually.

Purpose

Infrastructure Intelligence

Capabilities

• exposed services

• banners

• CVEs

• SSL certificates

• open ports

• technologies

• vulnerabilities

Investigating a phishing domain.

Prompt:

Analyze infrastructure related to phishing-example.com

The AI:

• queries Shodan

• discovers

IP
ASN
Hosting
Apache version
Open RDP
VPN
Exposed Jenkins

Then automatically pivots to:

• VirusTotal

• WHOIS

• DNS

• SSL history

Purpose

Threat Intelligence

Capabilities

• URL analysis

• malware reports

• domain reputation

• IP reputation

• passive DNS

• relationships

Investigating malware.

Prompt:

Investigate hash XXXXX.

The AI retrieves:

• sandbox execution

• contacted IPs

• associated domains

• malware family

• previous campaigns

Then automatically investigates every discovered IOC.

Purpose

Corporate Intelligence

Capabilities

• shareholders

• directors

• subsidiaries

• filings

• addresses

The recent MCP ecosystem includes connectors capable of querying company registries across dozens of jurisdictions, making corporate investigations significantly faster.

A procurement fraud investigation.

Prompt:

Investigate Alpha Consulting Ltd.

The AI finds:

• directors

• dissolved companies

• beneficial owners

• registered addresses

• linked entities

It automatically pivots into:

• LinkedIn

• leaked documents

• social media

• procurement databases

Purpose

Web Collection

Capabilities

• scraping

• structured extraction

• JavaScript rendering

• anti-bot browsing

Threat actor marketplace monitoring.

Prompt:

Collect all vendor profiles mentioning “RedLine Stealer”.

The AI extracts:

• usernames

• prices

• Telegram handles

• Bitcoin wallets

• PGP keys

into a structured dataset.

Purpose

Typosquatting Detection

Capabilities

• homoglyph domains

• phishing domains

• certificate monitoring

Monitoring Microsoft.

Prompt:

Detect suspicious Microsoft typosquatting domains.

The AI:

• generates thousands of permutations

• checks DNS

• checks SSL

• checks WHOIS

• checks hosting

and ranks suspicious domains automatically.

Purpose

Internet-wide reconnaissance

Ideal for:

• exposed services

• ICS

• IoT

• infrastructure hunting

Useful alternative to Shodan.

Purpose

Registration Intelligence

Automatically retrieves:

• registrant

• registrar

• dates

• abuse contacts

• expiration

• ownership history

Capabilities

• A

• AAAA

• MX

• TXT

• NS

• SPF

• DMARC

• DKIM

Useful during phishing investigations.

Allows automatic pivoting across

• historical IPs

• historical domains

• infrastructure reuse

Example Investigation

Suppose a security team discovers:

invoice-update[.]com

Instead of opening fifteen browser tabs, an analyst could prompt:

Investigate invoice-update.com and identify related infrastructure, phishing indicators, historical ownership, malware associations, exposed services, and connected social profiles.

The AI could automatically execute:

WHOIS
↓
DNS
↓
Passive DNS
↓
VirusTotal
↓
Shodan
↓
Certificate Transparency
↓
ASN
↓
GitHub
↓
Maigret
↓
Report generation

The output is a fully structured intelligence report requiring analyst validation rather than manual data collection.

Despite their capabilities, MCP-powered agents are not replacements for analysts.

Recent research emphasizes an important methodological principle:

The agent must execute real tools and consume their outputs—not invent information. A WHOIS record retrieved from a registry is evidence; a WHOIS value “remembered” by an LLM is not.

Human expertise remains essential for:

• evaluating source reliability

• resolving conflicting evidence

• assessing deception

• applying legal and ethical constraints

• making analytical judgments

This mirrors established OSINT methodologies, where collection, processing, analysis, and reporting remain distinct phases requiring critical thinking rather than blind automation.

MCP is not replacing the traditional OSINT toolbox described by practitioners such as Michael Bazzell or Rae Baker; rather, it is providing a standardized orchestration layer on top of it. The same foundational resources—search engines, social networks, infrastructure intelligence, corporate records, and threat intelligence—are now accessible through AI-driven workflows instead of isolated manual searches.

The next generation of analysts will likely spend less time copying data between browser tabs and more time validating hypotheses, identifying patterns, and producing high-confidence intelligence. In that sense, MCP servers represent one of the most significant shifts in OSINT since the emergence of automated reconnaissance tools: not because they introduce entirely new sources, but because they enable AI to chain trusted tools together into repeatable investigative workflows while keeping the analyst in control of the final judgment.

If this is useful, share it.

This is the weekly selection. But it’s not the only one.

If you’d like to read more: → full articles on the website

👉 https://projectosint.com

If you’d like to get the latest updates first: → Telegram

👉 https://t.me/osintprojectgroup