OpenOSINT Cloud — IP & domain infrastructure intelligence for AI agents and MCP clients.

A single MCP server (with a REST fallback) that gives AI agents and MCP clients structured intelligence about IP addresses and domains — geolocation, proxy/VPN/Tor detection, abuse reputation, DNS, and subdomain enumeration — without wiring up five separate providers and five API keys. One call, one bill, no infra to manage. Billing via Polar (Merchant of Record — handles international VAT automatically).

OpenOSINT Cloud provides structured, machine-readable intelligence about IP addresses and domains — the kind of data security engineers, fraud analysts, and backend developers need to make trust decisions in real time.

The API exposes five tools:

• search_ip — IP geolocation, ISP, ASN, hostname (ipinfo.io)
• search_ip2location — enriched IP intelligence: proxy/VPN/datacenter/Tor detection, threat score, usage type (sponsored by IP2Location.io — server key included, no setup required)
• search_abuseipdb — IP abuse reputation and report history (AbuseIPDB) (requires your own AbuseIPDB key — BYOK)
• search_dns — DNS record lookup: A, AAAA, MX, NS, TXT, CNAME, SOA
• search_domain — subdomain enumeration via passive DNS

Each tool call consumes one credit. Credits are never deducted for upstream errors.

The same five tools are available as an MCP server for Claude Desktop, Claude Code, and any MCP-compatible client — no extra infrastructure required.

Claude Code

claude mcp add openosint-cloud \
  --env OPENOSINT_API_KEY=YOUR_KEY \
  python /path/to/OpenOSINT/openosint/mcp_server.py

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "openosint-cloud": {
      "command": "python",
      "args": ["/path/to/OpenOSINT/openosint/mcp_server.py"],
      "env": { "OPENOSINT_API_KEY": "YOUR_KEY" }
    }
  }
}

Once configured, Claude can call search_ip, search_ip2location, search_abuseipdb, search_dns, and search_domain directly from the chat interface.

• AI agents and MCP clients that need structured IP and domain intelligence in one tool call
• Developers building enrichment pipelines, evaluation harnesses, and agent workflows
• Backend developers enriching IP addresses at sign-up or login
• Security engineers building threat-intelligence pipelines
• Anti-fraud platforms detecting proxies, VPNs, and datacenter traffic

Credits unused at month-end do not roll over for subscription plans. Contact us if you need higher volume.

After purchase you receive an API key. Make your first call in under a minute:

curl -s -X POST https://api.openosint.tech/v1/enrich \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tool":"search_ip","target":"8.8.8.8"}'

{
  "tool": "search_ip",
  "target": "8.8.8.8",
  "results": ["[+] Hostname: dns.google", "[+] Org: AS15169 Google LLC", "[+] City: Mountain View"],
  "credits_left": 99
}

Swap search_ip for any of the five tools; swap the target accordingly (IP, domain, or subdomain). One call = one credit.

All requests require an X-API-Key header containing the license key issued on purchase.

Check balance

GET /v1/usage
X-API-Key: YOUR_KEY

→ {"plan":"starter","credits":999}

Run a tool

POST /v1/enrich
X-API-Key: YOUR_KEY
Content-Type: application/json

{"tool": "search_ip", "target": "8.8.8.8"}

{
  "tool": "search_ip",
  "target": "8.8.8.8",
  "timestamp": "2026-06-13T10:00:00+00:00",
  "results": [
    "[+] Ip: 8.8.8.8",
    "[+] Hostname: dns.google",
    "[+] Org: AS15169 Google LLC",
    "[+] City: Mountain View",
    "[+] Country: US"
  ],
  "error": null,
  "credits_left": 998
}

Tools that require upstream API keys use BYOK (Bring Your Own Key): store your key once with POST /v1/keys, and the gateway resolves it automatically on every call. search_ip2location is server-keyed — no setup required.

What counts as one credit?
Each POST /v1/enrich call consumes one credit, regardless of which tool is invoked or how long it takes. Credits are never deducted for upstream API errors.

Do unused credits roll over?
No. Monthly credits reset at the start of each billing cycle. The pay-as-you-go pack ($10 / 100 credits) does not expire.

Which tools are included?
search_ip, search_ip2location (IP2Location key included — no setup required), search_abuseipdb (requires your own AbuseIPDB key — BYOK), search_dns, and search_domain. Store your AbuseIPDB key once via POST /v1/keys and it is resolved automatically on every call.

Is there personal data in the responses?
No. The API is scoped to IP addresses and domain names only. It does not search for, store, or return personal data about individuals, and does not use leaked or breached data sources.

Can I cancel a subscription?
Yes, at any time via the Polar billing portal. Your key remains active until the end of the current billing period.

I need more than 5,000 calls/month.
Contact us for a custom volume quote.

Terms of Service  ·  Privacy Policy  ·  Acceptable Use Policy  ·  Sub-processors

Contact: openosint@yahoo.com