# exposure Adopt this skill: https://proskills.md/skills/other/openosint-openosint-skills-exposure Page: https://proskills.md/skills/other/openosint-openosint-skills-exposure This document is the public skill bundle for that page. It contains SKILL.md and every helper file the catalog carries. No login is required. ## File: skills/exposure/SKILL.md size: 1318 sha: 59a0b16de701a364083c64e6c77a46cfa431871d upstream: https://github.com/openosint/openosint/blob/main/skills/exposure/SKILL.md ````text --- name: exposure description: Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or "how exposed is this domain". No API key needed. license: MIT compatibility: Needs uv (for `uvx`) and network access. argument-hint: "" --- # OpenOSINT: exposure report Domain: $ARGUMENTS (ask for one if empty). Only run this on domains the user owns or is authorized to assess. ```bash uvx --from openosint==2.38.0 openosint --json exposure DOMAIN ``` - The TLS and header checks connect to the domain on port 443. If the user wants no contact with the target, run `exposure DOMAIN --checks email,registration` instead (DNS and registry only; the result is not graded). - Optional: `--report PATH.html` writes a printable report; `--lookalikes` adds a DNS-only search for lookalike domains (not part of the grade). - Do not pass `--allow-active`. Report the grade, then each check's findings, each cited as `claim [exposure DOMAIN, ]`. The grade is a point-in-time summary, not a compliance result or a vulnerability scan. Findings are leads to verify, not proof. If the command fails or a check is skipped, say so; do not estimate a grade. ```` ## File: README.md upstream: https://github.com/openosint/openosint/blob/main/README.md ````text mcp-name: io.github.OpenOSINT/openosint
OpenOSINT

OpenOSINT

The OSINT toolkit for AI agents: Agent Skill, MCP server and CLI. Passive by default, no API keys needed to start, and every finding cites the tool call that produced it.

[![Release](https://img.shields.io/github/v/release/OpenOSINT/OpenOSINT?style=flat-square)](https://github.com/OpenOSINT/OpenOSINT/releases) [![PyPI downloads](https://img.shields.io/pypi/dm/openosint?style=flat-square&label=PyPI%20downloads)](https://pypi.org/project/openosint/) [![License MIT](https://img.shields.io/badge/license-MIT-green?style=flat-square)](LICENSE) [![MCP Registry](https://img.shields.io/badge/MCP_Registry-published-blueviolet?style=flat-square)](https://registry.modelcontextprotocol.io/servers/io.github.OpenOSINT/openosint) [![Sponsored by IP2Location](https://img.shields.io/badge/sponsored%20by-IP2Location.io-FF6B35?style=flat-square)](https://www.ip2location.io/?utm_source=openosint&utm_medium=readme&utm_campaign=ip2location) [![Sponsored by TestMu AI](https://img.shields.io/badge/sponsored%20by-TestMu%20AI-000000?style=flat-square)](https://www.testmuai.com/?utm_source=openosint&utm_medium=opensourcecollab) ![OpenOSINT in Claude Code: add the marketplace, install the plugin, run /openosint:osint example.com and get a report where every finding cites its tool call, ending with leads to verify](assets/demo/skill-demo.gif) *A real Claude Code session, nothing mocked: install the plugin and run a passive recon on `example.com`. [Sharper MP4](assets/demo/skill-demo.mp4).*
## Quickstart Needs [`uv`](https://docs.astral.sh/uv/). No API keys for the default flow. **Claude Code plugin** (skills plus a passive MCP server): ```text /plugin marketplace add OpenOSINT/OpenOSINT /plugin install openosint@openosint /openosint:osint example.com ``` **Any agent** (Codex, Gemini CLI, Cursor and other Agent Skills clients): ```bash npx skills add OpenOSINT/OpenOSINT ``` **MCP server or pip** ([other clients](https://openosint.tech/docs/mcp/)): ```bash claude mcp add openosint -- uvx --from openosint openosint-mcp pip install openosint && openosint exposure example.com ``` ## OpenOSINT Cloud The same engine as a hosted chat: ask about a domain, an IP address or a company. Every answer shows which public sources were checked, when, and a source on every claim. No install, no API keys. OpenOSINT Cloud answering a question about a company: three lookups with their times, then an answer with source chips [Try it: 10 free messages](https://chat.openosint.tech/?utm_source=github&utm_medium=readme&utm_campaign=cloud_demo) ## What you can do Real output, captured 2026-11-04 on v2.37.0 and trimmed. None of these commands needs an API key or an AI provider. ```text $ openosint exposure example.com Grade: B Score: 88/100 Checks: email OK [passive] · registration OK [passive] · tls OK [touches target] · http_headers OK [touches target] [LOW] DMARC has no aggregate report address (dmarc_no_rua) [LOW] Strict-Transport-Security header missing (hsts_missing) [INFO] Domain registered 31.2 years ago (domain_age) $ openosint dns example.com [DNS] NS: elliott.ns.cloudflare.com., hera.ns.cloudflare.com. [DNS] SPF: v=spf1 -all [DNS] DMARC: "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s" [DNS] DKIM not checked: selector probing is enumeration (needs --allow-active). $ openosint rdap example.com [+] Registrar: RESERVED-Internet Assigned Numbers Authority [+] Registered: 1995-08-14T04:00:00Z [+] Expires: 2027-08-13T04:00:00Z [+] Name servers: elliott.ns.cloudflare.com, hera.ns.cloudflare.com $ openosint ip 8.8.8.8 [+] Hostname: dns.google [+] Org: AS15169 Google LLC [+] City: Mountain View $ openosint gdelt example.com No geolocated coverage found for 'example.com'. Coverage: the last 15 min (...) $ openosint gdelt ukraine [+] White House, District Of Columbia, United States (38.8951, -77.0364) — 1 article(s) ``` The same commands are what the skill runs for an agent. All of them are in the [CLI reference](https://openosint.tech/docs/cli/). ## Why OpenOSINT - **Real tool executions.** Tools are Python code; only their actual output reaches the model. - **Provenance.** Every finding is shown with the tool call that produced it. AI summaries are leads to verify, not proof. - **Passive by default, with noise labels.** Tools that touch the target or are noisy are not even offered to the agent until you opt in. - **Works with no keys.** `exposure`, `dns`, `rdap`, `whois`, `ip`, `gdelt` and `dorks` need no account. | | Prompt-only OSINT skills | SpiderFoot | OpenOSINT | |---|---|---|---| | What runs the lookups | Nothing: the skill is instructions, and the agent improvises | Its own 200+ modules | Python tools shipped with it | | Breadth | Whatever the agent can reach | Much broader: 200+ modules and a correlation engine, per its README | A focused tool set | | Built to be driven by an agent | Yes, that is the format | Web UI or CLI, per its README | Agent Skill, Claude Code plugin, MCP server, CLI and web UI | | Passive/noisy labels, off by default | No | Not claimed here | Yes, per tool | | License | Varies | MIT | MIT | SpiderFoot is the better choice when you want a large standalone scanner. OpenOSINT is for agents that need a small set of real, labelled tools. ## Tools Level is the noise label: `passive` tools are on by default; anything else needs `--allow-active`. Per-tool docs: [openosint.tech/tools](https://openosint.tech/tools/). | Tool | Source | Level | Key needed | |---|---|---|---| | [`search_dns`](https://openosint.tech/tools/#search_dns) | dnspython (built-in) | passive | No | | [`search_rdap`](https://openosint.tech/tools/#search_rdap) | RDAP (IANA bootstrap) | passive | No | | [`search_whois`](https://openosint.tech/tools/#search_whois) | python-whois | passive | No | | [`search_ip`](https://openosint.tech/tools/#search_ip) | ipinfo.io | passive | Optional | | [`search_ip2location`](https://openosint.tech/tools/#search_ip2location) | IP2Location API *(sponsored)* | passive | Required | | [`search_gdelt_geo`](https://openosint.tech/tools/#search_gdelt_geo) | GDELT 15-minute GKG feed | passive | No | | [`generate_dorks`](https://openosint.tech/tools/#generate_dorks) | built-in | passive | No | | [`search_paste`](https://openosint.tech/tools/#search_paste) | psbdmp.ws | passive | No | | [`search_github`](https://openosint.tech/tools/#search_github) | GitHub REST API | passive | Optional | | [`search_breach`](https://openosint.tech/tools/#search_breach) | HaveIBeenPwned API | passive | Required | | [`search_shodan`](https://openosint.tech/tools/#search_shodan) | Shodan API | passive | Required | | [`search_censys`](https://openosint.tech/tools/#search_censys) | Censys API | passive | Required | | [`search_virustotal`](https://openosint.tech/tools/#search_virustotal) | VirusTotal API | passive | Required | | [`search_abuseipdb`](https://openosint.tech/tools/#search_abuseipdb) | AbuseIPDB v2 API | passive | Required | | [`search_dorks_live`](https://openosint.tech/tools/#search_dorks_live) | [Bright Data SERP API](https://get.brightdata.com/jx2wfi?sid1=readme&sid2=setup&sid3=search_dorks_live&utm_source=openosint&utm_medium=readme&utm_campaign=setup&utm_content=search_dorks_live)¹ | passive | Required | | [`search_footprint`](https://openosint.tech/tools/#search_footprint) | [Bright Data SERP API](https://get.brightdata.com/jx2wfi?sid1=readme&sid2=setup&sid3=search_footprint&utm_source=openosint&utm_medium=readme&utm_campaign=setup&utm_content=search_footprint)¹ | passive | Required | | [`scrape_url`](https://openosint.tech/tools/#scrape_url) | ````