mcp-maltego

mcp-maltego

Maltego OSINT for AI agents.
Run transforms and Machines, build and analyse link graphs, and hand the result back to Maltego as a native .mtgx, from Claude, Gemini, Codex, Copilot, Cursor or any MCP client.

mcp-maltego is a Model Context Protocol server that turns an AI agent into a Maltego operator. It runs real transforms (built-in, commercial providers or your own TRX/iTDS servers), chains them into Machines, keeps a persistent investigation graph with memory of every step, recommends the next pivot, and exports everything to Maltego Desktop. One graph is shared by every agent you use.

Key features

• 20 tools, portable to every model. Flat JSON schemas validated against Gemini's strict function-calling subset; variants grouped with an action parameter so agents are not flooded with tools.
• 38 real transforms out of the box. 26 without API keys (DNS over HTTPS, RDAP/WHOIS, certificate transparency via crt.sh and CertSpotter, HackerTarget, urlscan.io, Shodan InternetDB, Team Cymru & RIPE Stat ASN/netblocks, Gravatar, GitHub profile details, AlienVault OTX threat pulses, multi-network profile lookup, parsing) and 12 provider transforms that switch on when you set a key: VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, Have I Been Pwned, GreyNoise and Tatum.
• Your Maltego transforms too. Speaks the Maltego TRX/iTDS XML protocol, so an agent can run the same transforms you use in Maltego.
• Machines. DomainRecon, InfrastructureRecon, EmailRecon, CompanyFootprint, PersonalFootprint, PersonaFootprint, URLRecon, ThreatSweep, ASNToNetblocks and your own in TOML, with recursive rounds and cost budgets.
• HUMINT, Breach Router & Multi-Agent Swarms. Native humint.* entity ontology (humint.Alias, humint.Organization, humint.LocationHistory, humint.PsychologicalTrait), cross-platform pseudonym correlation, subject behavioral profiling ([Hipótesis]), chronological anomaly detection, weighted relationships, a local SQLite
  • k-Anonymity/XposedOrNot breach router (BreachSemanticPivot), and multi-agent case fork/delegate/merge with optimistic locking.
• An investigation copilot. osint_investigate does detection, case creation, the right Machine, scoring and recommendations in one call. Every step is remembered (what, on what, why, result), every entity has explainable provenance and a priority score, and next-best-action learns from how each transform performed.
• Native Maltego round-trip. .mtgx export with hierarchical, radial or force-directed layout and the investigation memory embedded; .mtgx import; local transforms inside Maltego Desktop to open a case, expand neighbours and send entities back to the agents; import of your exact Maltego entity ontology.
• Reports and CLI. Executive reports in Markdown or self-contained HTML, and maltegoctl for terminals and CI.
• Safe by default. OSINT content is treated as untrusted data, XML is parsed with defusedxml, archives are read with bounds, agents cannot supply arbitrary URLs, and API keys are never logged.

Requirements

• Node.js 18 or newer (for npx).
• uv — manages the Python 3.12 runtime automatically (if uv is not installed yet, mcp-maltego installs it automatically into ~/.maltego-mcp/bin on first run).

Prepare the runtime, ~/.maltego-mcp/.env template, Maltego Desktop bridge .mtz, and global CLI launchers (mcp-maltego, maltego-mcp, maltegoctl, maltego-mcp-bridge in ~/.local/bin / %USERPROFILE%\.local\bin added to your PATH) in one command:

npx -y mcp-maltego setup

You can also choose a specific deployment mode or client target on any OS / distribution (Windows PowerShell/CMD, macOS, Ubuntu/Debian, Kali, Fedora/RHEL, Arch, Alpine):

npx -y mcp-maltego setup --mode global              # (Default) Global CLI in ~/.local/bin + PATH (run from any directory)
npx -y mcp-maltego setup --mode local               # Isolated inside ~/.maltego-mcp without modifying PATH
npx -y mcp-maltego setup --mode http                # Prepare + print Streamable HTTP server startup
npx -y mcp-maltego setup --client claude            # Print ready-to-use config for a specific client (claude|gemini|codex|copilot|cursor|all)

Getting started

Standard configuration, valid for most MCP clients:

{
  "mcpServers": {
    "maltego": {
      "command": "npx",
      "args": ["-y", "mcp-maltego"]
    }
  }
}

Then ask your agent:

Investigate example.com, give me the summary of the case and export it for Maltego.

claude mcp add maltego -- npx -y mcp-maltego

codex mcp add maltego -- npx -y mcp-maltego

[mcp_servers.maltego]
command = "npx"
args = ["-y", "mcp-maltego"]

{ "servers": { "maltego": { "command": "npx", "args": ["-y", "mcp-maltego"] } } }

{ "mcp": { "maltego": { "type": "local", "command": ["npx", "-y", "mcp-maltego"], "enabled": true } } }

npx -y mcp-maltego --transport http --port 8000   # http://127.0.0.1:8000/mcp

Tools

entity_type accepts any Maltego type, your own prefix.Name, or "auto" to detect it from the value.

Transforms

Pass keys through your client's configuration:

{ "mcpServers": { "maltego": { "command": "npx", "args": ["-y", "mcp-maltego"],
  "env": { "SHODAN_API_KEY": "...", "VIRUSTOTAL_API_KEY": "..." } } } }

Your own Maltego transform servers (TRX / iTDS) are declared in ~/.maltego-mcp/transforms.toml; see config/transforms.example.toml. Custom Machines go in the same file.

Maltego Desktop integration

Local transforms work in Maltego CE and the commercial editions, with no transform server. For the bridge, install the package globally (npm i -g mcp-maltego) so the command path stays stable. Details in docs/MALTEGO.md.

Configuration

More in docs/USO.md (Spanish).

CLI

npx mcp-maltego ctl inspect case.mtgx           # validate a .mtgx
npx mcp-maltego ctl lookup DomainToMX gmail.com  # quick lookup, nothing saved
npx mcp-maltego ctl transforms --type maltego.Domain
npx mcp-maltego ctl export demo --format report_html
npx mcp-maltego ctl import-entities config.mtz
npx mcp-maltego ctl mtz

Example prompts

• Investigate [email protected] and tell me which pivots are worth running next.
• Run DomainRecon on example.com with two rounds and a budget of 200 entities.
• Find every path between the IP 93.184.216.34 and the email in case demo.
• Export case demo for Maltego with a radial layout and write me an HTML report.
• Import the graph I saved in Maltego as acme.mtgx into case acme and continue from there.

AI agents and skills for contributors and analysts

The repository ships 10 agents and 15 skills from a single source (.agents/), generated for Claude Code, Gemini CLI, Qwen Code, GitHub Copilot and Codex, with skills in the open Agent Skills format (also read by Cursor):

• Investigation agents (use this MCP): osint-analyst (copilot with next-best-action loop and memory), cti-analyst (defensive exposure and IOC triage), ioc-composer (multi-MCP IOC graphs with MISP, ATT&CK, TheHive, Cortex), recon-toolchain-integrator (theHarvester, amass, recon-ng, SpiderFoot output into the graph).
• Investigation skills: company footprint, identity footprint, infrastructure mapping, IOC graph composition, external OSINT tools, investigation methodology.
• Development agents and skills: MCP tool design, transforms and custom providers, Machines, graph model, Maltego formats, non-standard entities, security review, tests, release and deployment.

Inspired by community work (SulimanAbdulrazzaq/maltego-mcp, lidless-labs/maltego-mcp, HexStrike AI, MCP-Kali-Rust); offensive capabilities (exploitation) are deliberately out of scope.

Security and responsible use

OSINT content is untrusted and is never followed as instructions. See SECURITY.md for the design and for how to report vulnerabilities. You are responsible for complying with the law, each provider's terms of service and data-protection rules (for example GDPR) in your jurisdiction.

Development

git clone https://github.com/Data-Unix/MCP-MALTEGO.git && cd MCP-MALTEGO
uv sync
uv run pytest -q && uv run ruff check . && uv run mypy src   # Python
npm test                                                       # npm launcher
npx @modelcontextprotocol/inspector uv run maltego-mcp        # inspect the server

Architecture, conventions for contributors and AI agents: AGENTS.md. Coverage of the functional specification: docs/COBERTURA.md. Changes: CHANGELOG.md.

License

MIT. Maltego is a trademark of Maltego Technologies GmbH. This project is independent and not affiliated with or endorsed by Maltego Technologies.