mcp-maltego

Maltego OSINT for AI agents.
Run transforms and Machines, build and analyse link graphs, and hand the result back to Maltego as a native .mtgx, from Claude, Gemini, Codex, Copilot, Cursor or any MCP client.

---

mcp-maltego is a high-performance Model Context Protocol server that turns any AI agent into an expert Maltego operator. It runs real OSINT transforms, chains them into autonomous reconnaissance Machines, maintains an in-memory or graph database investigation state with full provenance, recommends next-best pivots, and synchronizes seamlessly with Maltego Desktop via native .mtgx files.

Tip

Zero-Cost & No Commercial Maltego License Required: You do not need a paid Maltego Pro/XL plan or commercial API keys to start. mcp-maltego runs completely free out of the box, generating native .mtgx graphs compatible with the free Maltego Community Edition (CE) or Basic tier.

---

🏛️ Layered Architecture: From Zero-Cost Core to Full Platform

mcp-maltego is built in three decoupled layers so you can start instantly without cloud infrastructure or configuration overhead:

Layer	Component	Description & Cost
Layer 0: Zero-Cost Core	mcp-maltego CLI & Server	Instant execution (npx mcp-maltego). Generates and parses native .mtgx files for Maltego Community Edition (CE). Includes 33 zero-key built-in transforms (DoH, RDAP/WHOIS, crt.sh, ASN Cymru, CISA KEV, URLhaus, AlienVault OTX, URLscan, Mempool.space Bitcoin UTXO, CIOH wallet clustering, OFAC SDN crypto sanctions, VASP touchpoints) and dynamic community plugins (@custom_transform). 100% Free & Local.
Layer 1: Investigation Memory	Graph Memory & Copilot	Local deterministic case storage (~/.maltego-mcp/graph.json), entity fusion, step auditing, autonomous multi-round Machines, and osint_investigate copilot.
Layer 2: Advanced Platform	Web Console & CTI Vault	Interactive Web Dashboard (maltegoctl dashboard) with Web Worker acceleration and 4 spatial layouts (Organic, Hierarchical, Radial, Categorized), multi-dimensional filtering (edges, entities, continuous confidence, hops & live search), Impeccable vector rendering (canvas icons, confidence rings, Bézier curves), Universal Table Suite (compact/normal/expanded density toggles, pagination, expandable accordion detail cards), interactive multi-hop path tracing & blast radius inspection, Blockchain AML Ledger with mixer detection, strict multi-case isolation and modular scoping (global Topbar sync and focused module selector), secure case deletion and atomic graph purging, Categorized Accounts Vault (Social Networks, Underground Forums, Darknet Markets) with session cookies & Tor SOCKS5 routing, burner inboxes (Mail.tm + OTP extractor), Tor/Dark Web CTI feeds, and optional Azure Cosmos DB Gremlin clustering.

---

Key features

• 20 tools, portable to every model. Flat JSON schemas validated against Gemini's strict function-calling subset; variants grouped with an action parameter so agents are not flooded with tools.
• 45 real transforms out of the box. 33 without API keys (DNS over HTTPS, RDAP/WHOIS, CISA KEV active exploitation, Abuse.ch URLhaus malware, certificate transparency via crt.sh and CertSpotter, HackerTarget, urlscan.io, Shodan InternetDB, Team Cymru & RIPE Stat ASN/netblocks, Gravatar, GitHub profile details, AlienVault OTX threat pulses, multi-network profile lookup, Mempool.space Bitcoin UTXO transactions & inputs/outputs, Common-Input Ownership Heuristic (CIOH) clustering, OFAC SDN crypto sanctions check, VASP/Exchange touchpoints, parsing) and 12 provider transforms that switch on when you set a key: VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, Have I Been Pwned, GreyNoise and Tatum.
• Community Extensibility Engine (@custom_transform). Drop custom Python transform files in ~/.maltego-mcp/plugins/ or ./plugins/ to immediately expose custom OSINT logic to LLMs without touching core code.
• Your Maltego transforms too. Speaks the Maltego TRX/iTDS XML protocol, so an agent can run the same transforms you use in Maltego.
• Machines. DomainRecon, InfrastructureRecon, EmailRecon, CompanyFootprint, PersonalFootprint, PersonaFootprint, CryptoFlowRecon, URLRecon, ThreatSweep, ASNToNetblocks and your own in TOML, with recursive rounds and cost budgets.
• Cryptoforensics & Blockchain AML Traceability. Native ontology for cryptocurrency entities (maltego.CryptoCluster, maltego.VASPExchange, maltego.MixerContract, maltego.DeFiBridge), multi-hop transaction flow tracing, peeling chain and tumbler heuristics, OFAC SDN sanctions screening, and VASP deposit touchpoint detection.
• Multi-Case Isolation & Modular Project Scoping. Synchronized global project selector in the Topbar and live graph, paired with decoupled per-module focus selectors (defaulting to [Follow Active Case]), strictly preventing cross-contamination between independent forensic cases.
• Case Lifecycle & Atomic Purging. Safe, permanent removal of ad-hoc or temporary investigations with interactive confirmation, atomic deletion of entities and links from the graph store, local cache and evidence purging, and automated fallback to the next available case.
• HUMINT, Breach Router & Multi-Agent Swarms. Native humint.* entity ontology (humint.Alias, humint.Organization, humint.LocationHistory, humint.PsychologicalTrait), cross-platform pseudonym correlation, subject behavioral profiling ([Hipótesis]), chronological anomaly detection, weighted relationships, a local SQLite
  • k-Anonymity/XposedOrNot breach router (BreachSemanticPivot), and multi-agent case fork/delegate/merge with optimistic locking.
• An investigation copilot. osint_investigate does detection, case creation, the right Machine, scoring and recommendations in one call. Every step is remembered (what, on what, why, result), every entity has explainable provenance and a priority score, and next-best-action learns from how each transform performed.
• Native Maltego round-trip. .mtgx export with hierarchical, radial or force-directed layout and the investigation memory embedded; .mtgx import; local transforms inside Maltego Desktop to open a case, expand neighbours and send entities back to the agents; import of your exact Maltego entity ontology.
• Reports and CLI. Executive reports in Markdown or self-contained HTML, and maltegoctl for terminals and CI.
• Safe by default. OSINT content is treated as untrusted data, XML is parsed with defusedxml, archives are read with bounds, agents cannot supply arbitrary URLs, and API keys are never logged.

Community Contributions & Governance

We welcome contributions! All contributions are subject to our Contributing Guide. Pull requests are automatically analyzed by our AST Security & Blast Radius CI scanner, and all merges require manual sign-off by repository owner @Data-Unix.

Requirements

• Node.js 18 or newer (for npx).
• uv — manages the Python 3.12 runtime automatically (if uv is not installed yet, mcp-maltego installs it automatically into ~/.maltego-mcp/bin on first run).

Prepare the runtime, ~/.maltego-mcp/.env template, Maltego Desktop bridge .mtz, and global CLI launchers (mcp-maltego, maltego-mcp, maltegoctl, maltego-mcp-bridge in ~/.local/bin / %USERPROFILE%\.local\bin added to your PATH) in one command:

npx -y mcp-maltego setup

You can also choose a specific deployment mode or client target on any OS / distribution (Windows PowerShell/CMD, macOS, Ubuntu/Debian, Kali, Fedora/RHEL, Arch, Alpine):

npx -y mcp-maltego setup --mode global              # (Default) Global CLI in ~/.local/bin + PATH (run from any directory)
npx -y mcp-maltego setup --mode local               # Isolated inside ~/.maltego-mcp without modifying PATH
npx -y mcp-maltego setup --mode http                # Prepare + print Streamable HTTP server startup
npx -y mcp-maltego setup --client claude            # Print ready-to-use config for a specific client (claude|gemini|codex|copilot|cursor|all)

Getting started

Standard configuration, valid for most MCP clients:

{
  "mcpServers": {
    "maltego": {
      "command": "npx",
      "args": ["-y", "mcp-maltego"]
    }
  }
}

Then ask your agent:

Investigate example.com, give me the summary of the case and export it for Maltego.

📦 Installation & First Deploy by Operating System

🍏 macOS (Apple Silicon M1/M2/M3/M4 & Intel Core)

Native support for arm64 (Apple Silicon) and x86_64 (Intel). Zero C/C++ compilation or Xcode Command Line Tools required.

1. Prerequisite: Node.js 18+ (brew install node or official package).
2. One-Command Autonomous Setup:

   npx -y mcp-maltego setup

   Auto-detects your CPU architecture, installs standalone uv, provisions isolated Python 3.12 runtime inside ~/.maltego-mcp, creates .env template, generates Maltego Desktop .mtz configuration, and links global CLI commands (maltegoctl, mcp-maltego) into ~/.zshrc and ~/.zprofile.
3. Launch the Interactive Command Center / Dashboard:

   maltegoctl dashboard

   (Automatically launches http://127.0.0.1:8000/dashboard in Safari / Chrome with interactive graph visualization and CTI vault).
4. Environment Health Check:

   maltegoctl doctor

5. Maltego Desktop CE Integration (/Applications/Maltego.app):
   • Generate local transforms: maltegoctl mtz
   • In Maltego Desktop: Go to Import | Export → Import Config and select ~/.maltego-mcp/maltego-mcp-local.mtz.

---

🪟 Windows (Windows 10 / 11 · PowerShell & Terminal)

1. Prerequisite: Node.js 18+ (winget install OpenJS.NodeJS or official installer).
2. One-Command Setup:

   npx -y mcp-maltego setup

   Provisions standalone uv.exe in %USERPROFILE%\.maltego-mcp\bin, installs global .cmd / .ps1 shims in %USERPROFILE%\.local\bin, and updates Windows User PATH and PowerShell profiles.
3. Launch Dashboard:

   maltegoctl dashboard

---

🐧 Linux (Ubuntu, Debian, Kali Linux, Arch, Fedora)

1. Prerequisite: Node.js 18+ and curl.
2. One-Command Setup:

   npx -y mcp-maltego setup

3. Launch Dashboard:

   maltegoctl dashboard

Antigravity IDE (Google Deepmind)

Add to .gemini/settings.json or project MCP tool configuration:

{
  "mcpServers": {
    "maltego": {
      "command": "mcp-maltego"
    }
  }
}

or portable via npx without prior installation:

{
  "mcpServers": {
    "maltego": {
      "command": "npx",
      "args": ["-y", "mcp-maltego"]
    }
  }
}

Example Agent prompt in Antigravity:

"Start an OSINT case for example.com, run the DomainRecon machine to discover subdomains and DNS records, and store the entities in graph memory so I can explore them in maltegoctl dashboard."

Claude Code

claude mcp add maltego -- npx -y mcp-maltego

Claude Desktop

Edit claude_desktop_config.json (Settings → Developer → Edit Config) and add the standard configuration above.

Gemini CLI

Add the standard configuration to ~/.gemini/settings.json (all projects) or .gemini/settings.json (one project).

Codex

codex mcp add maltego -- npx -y mcp-maltego

or in ~/.codex/config.toml:

[mcp_servers.maltego]
command = "npx"
args = ["-y", "mcp-maltego"]

GitHub Copilot CLI

Add the standard configuration to ~/.copilot/mcp-config.json, or to .mcp.json / .github/mcp.json in a repository.

VS Code

.vscode/mcp.json:

{ "servers": { "maltego": { "command": "npx", "args": ["-y", "mcp-maltego"] } } }

Cursor

Add the standard configuration to ~/.cursor/mcp.json or .cursor/mcp.json.

OpenCode

opencode.json:

{ "mcp": { "maltego": { "type": "local", "command": ["npx", "-y", "mcp-maltego"], "enabled": true } } }

Qwen Code

Add the standard configuration to ~/.qwen/settings.json or .qwen/settings.json.

Orca IDE and other multi-agent setups

Clone this repository and open it in Orca: it ships the project file each agent reads (.mcp.json, .gemini/settings.json, .codex/config.toml, .cursor/mcp.json, .qwen/settings.json, opencode.json), so every worktree gets the server without manual registration. All agents share one graph in ~/.maltego-mcp. See docs/ORCA.md.

Remote (Streamable HTTP)

npx -y mcp-maltego --transport http --port 8000   # http://127.0.0.1:8000/mcp

The server binds to localhost only. It has no authentication yet, so do not expose it to a network.

Tools

Group	Tool	What it does
Catalog	osint_list_entity_types	Entity ontology by category (standard + native humint.* + imported from your Maltego)
	osint_list_transforms	Transforms, Machines, provider keys and server status
Cases	osint_manage_case	Create, fork/delegate sub-cases for multi-agent swarms, merge (with optimistic locking) or delete
	osint_list_cases	Paginated list
	osint_get_case_summary	Counts, priority entities and quality indicators
Entities	osint_upsert_entity	Create or merge an entity (normalised value, deterministic id, notes)
	osint_manage_entity	Edit confidence/notes/properties, set .mtgx visual_style, run HUMINT analyze_behavior, or delete
	osint_get_entity	Details, explained score, provenance, pending transforms
	osint_search_entities	Search a case or across cases; sort by priority
Links	osint_link_entities	Link/unlink entities, analyze HUMINT role/sentiment/weight, or correlate cross-platform identities
	osint_get_neighbors	Related entities with direction and link type
	osint_find_paths	Paths between two entities
Transforms	osint_run_transform	One transform on one entity
	osint_expand_entity	Every applicable transform ("Run All")
	osint_run_machine	A Machine or an ad-hoc chain, with rounds and budgets
Copilot	osint_investigate	Everything in one call: detect, case, Machine, score, recommend, report
	osint_suggest_next_steps	Deterministic next-best-action with transform performance history
	osint_get_timeline	Investigation procedural memory (steps) or subject chronological timeline & anomalies (subject)
Exchange	osint_export_case	mtgx (with layout and memory), json, graphml, csv, report_md, report_html
	osint_import_graph	Import a .mtgx saved in Maltego (with its memory) or a CSV

entity_type accepts any Maltego type, your own prefix.Name, or "auto" to detect it from the value.

Transforms

Category	Transforms	API key
DNS (over HTTPS + passive)	DNSToIP, DNSToIPv6, DomainToMX, DomainToNS, DomainToTXT, DNSToCNAME, IPToReverseDNS, HackerTargetSubdomains	—
WHOIS (RDAP with ARIN fallback)	DomainToWhois, IPToWhois	—
Network & Exposure	IPToAS, IPToNetblock (Team Cymru), RIPEStatASNToNetblocks, InternetDBIPToServices (ports, CPEs, CVEs)	—
Certificates & Web	DomainToSubdomains (crt.sh + CertSpotter fallback), CertSpotterSubdomains, URLScanDomainSearch	—
Identity, Social & HUMINT	AliasToProfiles (GitHub, GitLab, Hacker News, Keybase, DEV), GitHubAliasToDetails, GravatarEmailToProfile, EmailToAlias, AnalyzeSubjectBehavior	—
Breach & Threat Intel (keyless)	BreachSemanticPivot (local SQLite + HIBP Pwned Passwords k-Anonymity + XposedOrNot), OTXHashToThreatPulses	—
Parsing	EmailToDomain, URLToDomain, WebsiteToDomain, DomainToWebsite	—
VirusTotal	VTDomainToIP, VTIPToDomain, VTDomainToSubdomains, VTHashToDetection	VIRUSTOTAL_API_KEY
Shodan	ShodanIPToServices, ShodanDomainToSubdomains	SHODAN_API_KEY
SecurityTrails	SecurityTrailsSubdomains	SECURITYTRAILS_API_KEY
Censys	CensysIPToServices	CENSYS_API_ID, CENSYS_API_SECRET
Hunter.io	HunterDomainToEmails	HUNTER_API_KEY
Have I Been Pwned	HIBPEmailToBreaches	HIBP_API_KEY
GreyNoise	GreyNoiseIPContext	GREYNOISE_API_KEY
Tatum	TatumBTCAddressToTx	TATUM_API_KEY

Pass keys through your client's configuration:

{ "mcpServers": { "maltego": { "command": "npx", "args": ["-y", "mcp-maltego"],
  "env": { "SHODAN_API_KEY": "...", "VIRUSTOTAL_API_KEY": "..." } } } }

Your own Maltego transform servers (TRX / iTDS) are declared in ~/.maltego-mcp/transforms.toml; see config/transforms.example.toml. Custom Machines go in the same file.

Maltego Desktop integration

Direction	How
Agent → Maltego	osint_export_case writes a .mtgx; open it with File → Open
Maltego → agent	Save as .mtgx in ~/.maltego-mcp/imports/ and ask the agent to import it
Live, inside Maltego	npx mcp-maltego ctl mtz generates local transforms (MCP · Abrir caso, MCP · Vecinos en el caso, MCP · Guardar en el caso); import the file with Import | Export → Import Config
Your ontology	Export your config from Maltego and run npx mcp-maltego ctl import-entities config.mtz

Local transforms work in Maltego CE and the commercial editions, with no transform server. For the bridge, install the package globally (npm i -g mcp-maltego) so the command path stays stable. Details in docs/MALTEGO.md.

Configuration

Variable	Default	Purpose
MALTEGO_MCP_HOME	~/.maltego-mcp	Shared state: graph, catalog, imports, exports, runtime
MALTEGO_MCP_TRANSFORMS_FILE	<home>/transforms.toml	Catalog of your transform servers and Machines
MALTEGO_MCP_BACKEND	memory	memory (local JSON, multi-process safe) or gremlin (Azure Cosmos DB, experimental)
MCP_MALTEGO_UV	auto-detected	Full path to uv if it is not on PATH

More in docs/USO.md (Spanish).

CLI

npx mcp-maltego ctl inspect case.mtgx           # validate a .mtgx
npx mcp-maltego ctl lookup DomainToMX gmail.com  # quick lookup, nothing saved
npx mcp-maltego ctl transforms --type maltego.Domain
npx mcp-maltego ctl export demo --format report_html
npx mcp-maltego ctl import-entities config.mtz
npx mcp-maltego ctl mtz

Example prompts

• Investigate ana@example.com and tell me which pivots are worth running next.
• Run DomainRecon on example.com with two rounds and a budget of 200 entities.
• Find every path between the IP 93.184.216.34 and the email in case demo.
• Export case demo for Maltego with a radial layout and write me an HTML report.
• Import the graph I saved in Maltego as acme.mtgx into case acme and continue from there.

AI agents and skills for contributors and analysts

The repository ships 10 agents and 15 skills from a single source (.agents/), generated for Claude Code, Gemini CLI, Qwen Code, GitHub Copilot and Codex, with skills in the open Agent Skills format (also read by Cursor):

• Investigation agents (use this MCP): osint-analyst (copilot with next-best-action loop and memory), cti-analyst (defensive exposure and IOC triage), ioc-composer (multi-MCP IOC graphs with MISP, ATT&CK, TheHive, Cortex), recon-toolchain-integrator (theHarvester, amass, recon-ng, SpiderFoot output into the graph).
• Investigation skills: company footprint, identity footprint, infrastructure mapping, IOC graph composition, external OSINT tools, investigation methodology.
• Development agents and skills: MCP tool design, transforms and custom providers, Machines, graph model, Maltego formats, non-standard entities, security review, tests, release and deployment.

Inspired by community work (SulimanAbdulrazzaq/maltego-mcp, lidless-labs/maltego-mcp, HexStrike AI, MCP-Kali-Rust); offensive capabilities (exploitation) are deliberately out of scope.

Security and responsible use

OSINT content is untrusted and is never followed as instructions. See SECURITY.md for the design and for how to report vulnerabilities. You are responsible for complying with the law, each provider's terms of service and data-protection rules (for example GDPR) in your jurisdiction.

Development

git clone https://github.com/Data-Unix/MCP-MALTEGO.git && cd MCP-MALTEGO
uv sync
uv run pytest -q && uv run ruff check . && uv run mypy src   # Python
npm test                                                       # npm launcher
npx @modelcontextprotocol/inspector uv run maltego-mcp        # inspect the server

Architecture, conventions for contributors and AI agents: AGENTS.md. Coverage of the functional specification: docs/COBERTURA.md. Changes: CHANGELOG.md.

License

MIT. Maltego is a trademark of Maltego Technologies GmbH. This project is independent and not affiliated with or endorsed by Maltego Technologies.