Docs

MCP server

Connect OSINT UI to Claude Desktop, Claude Code, or any MCP-compatible client. Requires PRO+.

MCP (Model Context Protocol) is the open standard that lets an AI assistant use external tools conversationally. OSINT UI exposes an MCP server so Claude (or any compatible client) can run the investigation tools directly with your API keys, which never leave the server. Requires the PRO+ plan.

Endpoint and authentication

https://osint-ui.com/api/mcp

Streamable HTTP transport, stateless. Authenticates with the same token (PAT) used by the REST API — create one in Settings → API/Connect. Every call is sent with this header:

Authorization: Bearer YOUR_TOKEN

Connecting it to Claude Desktop

Add the server to Claude Desktop's MCP configuration (the exact field name may vary by client version; check its own docs if this doesn't match):

{
  "mcpServers": {
    "osint-ui": {
      "url": "https://osint-ui.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Connecting it to Claude Code

claude mcp add --transport http osint-ui https://osint-ui.com/api/mcp \
  --header "Authorization: Bearer YOUR_TOKEN"

Tools available via MCP

MCP tool Equivalent in the app
ping Server health check
email_analyze Email Analyzer
phone_analyze Phone Analyzer
domain_analyze Domain Analyzer
ip_analyze IP Analyzer
reputation_check Reputation Checker
username_search Username Analyzer
dorks_generate Dorks Generator
leak_check Leak Check (Intelligence X)

This is a subset of the 20 tools — the rest of the REST API (URL Scanner, GitHub OSINT, Paste Search, Onion Finder, Port Scanner...) doesn't have an MCP tool equivalent yet.

Rate limit

600 requests / 5 minutes per PRO+ user — the same limit as the REST API, shared across both if you use the same token for both.

A conversational example

Once connected, you can ask Claude things like "analyze the domain example.com and tell me if it has any suspicious subdomains" or "check if this email shows up in any known breach" — Claude decides when to call the matching MCP tool and hands you back the interpreted result.

Security

The server checks the token on every request, enforces the per-user rate limit, and runs each call with your account's encrypted API keys — the same per-user isolation as the rest of the platform. You can revoke the token at any time from Settings without affecting the rest of your account.

REST APITeams & Enterprise