An LLM-powered Open Source Intelligence (OSINT) agent that automatically investigates IPs, domains, emails, usernames, and companies.
An LLM agent that automatically detects the target type and triggers the right OSINT tools in sequence — performing information pivoting (e.g., found an email → checks breaches → found a domain → maps subdomains → analyzes IPs on Shodan).
At the end, it generates a structured Markdown report with everything discovered.
| Target type | Tools triggered |
|---|---|
| Domain | WHOIS · Full DNS · Subdomains (crt.sh) · Wayback Machine · URLScan · VirusTotal · SecurityTrails |
| IP | Geolocation (ipinfo) · AbuseIPDB · Shodan (ports/CVEs) · VirusTotal · BGPView/ASN |
| HaveIBeenPwned (breaches) · Hunter.io · Gravatar · Holehe (120+ services) | |
| Username | Sherlock (300+ networks) · GitHub deep OSINT · Paste search |
| CNPJ/Company (Brazil) | BrasilAPI · ReceitaFederal · Partners · Auto Google Dorks |
| CEP / .br domains | Registro.br RDAP · BrasilAPI CEP |
git clone https://github.com/brunoaugusto1978/osint-agent.git
cd osint-agent
# Install dependencies
pip install -r requirements.txt
# Configure API keys
cp .env.example .env
# Edit .env with your keys (see section below)Copy .env.example to .env and configure at least one LLM provider:
# Choose ONE LLM provider:
LLM_PROVIDER=openai
LLM_MODEL=gpt-4o-mini
OPENAI_API_KEY=sk-...
# Or Anthropic Claude:
# LLM_PROVIDER=anthropic
# LLM_MODEL=claude-sonnet-4-6
# ANTHROPIC_API_KEY=sk-ant-...
# Or Ollama (local, free):
# LLM_PROVIDER=ollama
# LLM_MODEL=llama3.2| API | Link | Free limit |
|---|---|---|
| Shodan | account.shodan.io | 100 queries/month |
| VirusTotal | virustotal.com | 4 req/min |
| HaveIBeenPwned | haveibeenpwned.com | Personal use |
| Hunter.io | hunter.io | 25 searches/month |
| AbuseIPDB | abuseipdb.com | 1,000 req/day |
| URLScan.io | urlscan.io | Free tier |
| IPInfo.io | ipinfo.io | 50k req/month |
| SecurityTrails | securitytrails.com | 50 req/month |
The agent works without any of these keys, using only open sources (WHOIS, DNS, crt.sh, Wayback Machine, BGPView, BrasilAPI).
# Interactive mode (recommended)
python main.py
# Direct query
python main.py --query "google.com"
python main.py --query "user@email.com"
python main.py --query "8.8.8.8"
python main.py --query "00.000.000/0001-00"
python main.py --query "johndoe"
# Without saving report
python main.py --query "target" --no-save
# List all available tools
python main.py --tools
# Show configured API status
python main.py --statusosint> google.com → investigates the domain
osint> /tools → list tools
osint> /status → API status
osint> /help → target examples
osint> /exit → quit
osint-agent/
├── main.py # Interactive CLI
├── osint_agent/
│ ├── agent.py # LangChain ReAct agent
│ ├── config.py # Configuration and API keys
│ ├── tools/
│ │ ├── domain_tools.py # WHOIS, DNS, crt.sh, Wayback, URLScan
│ │ ├── ip_tools.py # ipinfo, AbuseIPDB, Shodan, VirusTotal, BGP
│ │ ├── email_tools.py # HIBP, Hunter, Gravatar, Holehe
│ │ ├── username_tools.py # Sherlock, GitHub OSINT, Pastes
│ │ └── company_tools.py # CNPJ, CEP, Registro.br, Dorks
│ └── utils/
│ ├── target_detector.py # Auto target type detection
│ └── reporter.py # Rich CLI + Markdown export
├── reports/ # Generated reports (gitignored)
├── .env.example # Configuration template
└── requirements.txt
This project is intended for educational and legitimate research purposes only. Use it only to investigate targets you have authorization for. The author is not responsible for misuse. Respect privacy laws (LGPD, GDPR) and each API's terms of service.
MIT © Bruno Lobo