OsintX MCP Server: Connect Claude, Cursor & Gemini CLI

Let Claude, Cursor, or Gemini CLI call OsintX tools over Streamable HTTP.

The OsintX MCP server lets an AI client call OsintX directly. Instead of copying identifiers between a chat window and the dashboard, you ask Claude, Cursor or Gemini CLI to run the lookup and read the result in the same conversation.

MCP (Model Context Protocol) is an open standard that lets an AI client discover and call external tools. OsintX publishes its tools over Streamable HTTP at /api/mcp, so any client with remote MCP support can connect with a URL and an API key.

Tools the server exposes

• osintx_search: run a lookup of type breach, social, discord or fivem for a query, with an optional mode
• osintx_assistant_turn: one AI Assistant turn with a slash command or natural language, plus up to 16 earlier messages as history
• osintx_assistant_help: the slash command list for your plan, with no quota charge

All three tools are marked read-only. They query data and never change your account, so a client can call them without a destructive-action prompt. Stealer and victim-log modules are intentionally not exposed through MCP, which matches the dashboard AI Assistant.

Requirements

• An Enterprise plan with API access enabled (Settings, API Manager). MCP is in Beta
• An API key with the osintxio_ prefix (legacy ox_live_ keys are still accepted)
• An MCP client that supports remote Streamable HTTP servers
• The key sent as a Bearer token in the Authorization header, or in an x-osintx-api-key header

Connect your client

Most clients accept the same snippet. Replace osintxio_YOUR_KEY with your API key, then restart the client so it reloads its MCP config.

{
  "mcpServers": {
    "osintx": {
      "url": "https://osintx.io/api/mcp",
      "headers": {
        "Authorization": "Bearer osintxio_YOUR_KEY"
      }
    }
  }
}

Supported clients

• Cursor: Settings, MCP, or .cursor/mcp.json in the project
• Claude Desktop: Settings, Developer, Edit Config
• Claude Code: MCP settings in the CLI config
• Gemini CLI: mcpServers in .gemini/settings.json (the field may be url or httpUrl, depending on version)
• Windsurf, Cline, Continue and Zed: their MCP settings with the same URL and header
• Kimi: works when your build exposes custom MCP or plugin servers
• DeepSeek: the apps do not host MCP tools, so use an MCP-capable IDE and pick DeepSeek as the model

Example prompts

• Search breaches for analyst@example.com and list each source with its leak date.
• Look up Discord ID 1163586699490762872 and check FiveM for the same snowflake.
• Run /social on this handle, then summarize which platforms returned a hit.
• Show me the OsintX assistant commands available on my plan.

A typical session

You write one prompt, for example a Discord ID and a request to check FiveM for the same ID. The client calls osintx_search twice, once per type, and reads both results. It then answers with the hits and names the source of each field. If a result is empty, a good client says so and does not guess.

• Name the identifier type in the prompt, so the client picks the right mode
• Ask for sources and leak dates in the answer
• Keep one case per conversation, so earlier results do not mix with new ones
• Ask the client to list what it has not searched yet before you close the case

Quota and safety

osintx_search costs one Enterprise API daily request and one search, the same as the REST API. osintx_assistant_turn runs its lookups through the same search route. Its AI analysis uses the dashboard Assistant search quota (3 searches per reply by default), and a chat-only turn costs one Enterprise API request. Blacklisted targets are rejected before any request is made. Treat results as leads: ask the client to cite which source returned each field, and verify before you act on it.

Troubleshooting

• Tools do not appear: restart the client and confirm it supports remote HTTP MCP
• Request rejected: check that the Authorization header holds a valid Enterprise API key
• Empty result: a miss is a valid answer, so try another identifier type before retrying