OSINT Plugin for Claude Code
An open source intelligence (OSINT) research skill for Claude Code. Investigate people, locations, domains, images, infrastructure, and digital artifacts using publicly available information.
Installation
/plugin install osint@github:lawriec/claude-osint-plugin
What It Does
When you ask Claude Code to investigate something — a person, a location in a photo, a suspicious domain, an image's metadata — this plugin activates a structured OSINT methodology based on the intelligence cycle:
- Define the intelligence requirement
- Plan the collection strategy
- Collect data across multiple sources
- Analyze and cross-reference findings
- Report with evidence provenance and confidence ratings
OSINT Domains
| Domain | Capabilities |
|---|
| Geolocation | Identify locations from photos/video using signs, vegetation, road markings, sun position, architecture |
| People / Social Media | Username enumeration, profile correlation across platforms, SOCMINT |
| Domain / Infrastructure | WHOIS, DNS enumeration, subdomain discovery, certificate transparency, IP enrichment |
| Image / Video Forensics | EXIF extraction, reverse image search, manipulation detection, metadata analysis |
| Document Analysis | PDF metadata, email header analysis, file forensics |
| Vehicle / Object ID | License plates, aircraft tracking (ADS-B), ship tracking (AIS) |
| Cryptocurrency | Blockchain address lookup, wallet tracing, transaction analysis |
| Radio / Signals | Broadcast identification, amateur radio callsign lookup |
MCP Servers
This plugin configures 9 MCP servers:
| Server | Package | Purpose | API Key Required |
|---|
| searxng | github:lawriec/mcp-searxng | Primary search tool. Multi-engine web search via self-hosted SearXNG — queries Google, Bing, Brave, Yahoo, DuckDuckGo, and 250+ engines simultaneously. Full operator pass-through, category-based search, language filtering, and engine attribution. | No API key — requires Docker (see SearXNG Setup) |
| tavily | tavily-mcp@latest | Targeted web search with date filtering, content extraction, site crawling | Yes — TAVILY_API_KEY |
| gemini | github:lawriec/mcp-gemini-media | AI analysis of images, video, and audio files | Yes — GEMINI_API_KEY |
| google-reverse-image | github:lawriec/mcp-google-reverse-image | Reverse image search via Google Cloud Vision Web Detection — finds pages containing an image, exact/partial/visually-similar matches, and detected web entities. Accepts local paths or public URLs. | Yes — GOOGLE_VISION_API_KEY |
| yt-dl | @kevinwatt/yt-dlp-mcp@latest | YouTube search, metadata, downloads | No (but cookies strongly recommended — see below) |
| internet-archive | github:lawriec/mcp-internet-archive | Wayback Machine and Internet Archive access | No |
| video-reader | github:lawriec/mcp-video-reader | Video/image frame extraction, thumbnails, ffmpeg operations | No |
| common-crawl | github:lawriec/mcp-common-crawl | Search and extract content from Common Crawl web archives | No |
| reddit | adhikasp/mcp-reddit | Reddit thread discovery and post scraping | No (optional OAuth for higher rate limits) |
SearXNG Setup
SearXNG is the plugin's primary search tool. It requires a local Docker instance — without
it, searches fall back to the less capable WebSearch tool.
1. Install Docker if you don't have it: https://docs.docker.com/get-docker/
2. Start SearXNG using the pre-configured Docker Compose setup in the
mcp-searxng repo:
git clone https://github.com/lawriec/mcp-searxng.git
cd mcp-searxng/docker
docker compose up -d
3. Verify it's running:
curl "http://localhost:8080/search?q=test&format=json" | head -c 200
4. Note the URL — you'll be asked for it when you install the plugin.
The default is http://localhost:8080.
SearXNG runs as a lightweight Docker container. Start it before launching Claude Code and
leave it running — it uses minimal resources when idle.
Optional: VPN protection — SearXNG queries upstream engines (Google, Bing, etc.) directly
from your IP. During intensive OSINT sessions this can lead to rate-limiting or blocking.
The mcp-searxng Docker setup includes an optional OpenVPN sidecar that routes all search
traffic through a VPN tunnel:
- Place
.ovpn files from your VPN provider (NordVPN, ExpressVPN, Surfshark, ProtonVPN,
Mullvad, etc.) into a folder
- If your provider requires auth, add a
default.auth file (username line 1, password line 2)
- Set environment variables and start with the VPN override:
thedotmack
Lucklyric
anthropics