Huntkit

OSINT investigation toolkit providing two MCP servers for infrastructure reconnaissance and threat intelligence lookups, covering WHOIS, DNS, Wayback, VirusTotal, URLhaus, ThreatFox, and certificate transparency.

Huntkit bundles two MCP servers for OSINT investigations: osint-infra handles infrastructure reconnaissance including WHOIS, DNS lookups, reverse DNS, and Wayback Machine snapshots without requiring API keys, while threat-intel integrates VirusTotal, URLhaus, ThreatFox, and crt.sh certificate transparency for threat intelligence analysis. Both servers integrate into a structured investigation lifecycle with case management, evidence capture, and chain-of-custody protocols. Installable as a Claude Code plugin or via git clone.