1. Conduid
  2. Blockchain
  3. Falconeye
MCP server · Blockchain

Falconeye

Free self-hosted OSINT investigator's toolkit with an MCP server for Claude Code and Claude Desktop. Eighteen tools in one interface: crypto tracing, phishing fingerprinting, domain intel, Telegram OSINT, IP reputation, email header forensics with LLM scam detection, username enumeration, HIBP breach checks, ransomware victim tracking. AGPL-3.0.

39Low

Scored 13 days ago · breakdown

About Falconeye

Falconeye is an MCP server published by osintph in the Blockchain category: free self-hosted OSINT investigator's toolkit with an MCP server for Claude Code and Claude Desktop. Eighteen tools in one interface: crypto tracing, phishing fingerprinting, domain intel, Telegram OSINT, IP reputation, email header forensics with LLM scam detection, username enumeration, HIBP breach checks, ransomware victim tracking. AGPL-3.0.

The repository has 14 stars and 0 forks, with the last commit 5 days ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/osintph/falconeye

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Falconeye

Powered by Claude · Grounded in docs

I know everything about Falconeye. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Releases

v3.38.19v3.38.19: crt.sh retry-once and em-dash guard · 12 Oct 2026Hunt crt.sh lookup now retries once later in the run on a 502 or timeout (a short wait then a single second attempt, never a loop) before backing off and marking the source failed; a recovery on the retry returns the answer with no…
v3.38.18v3.38.18: Hunt coverage (urlscan depth, platform subdomains, resolve-before-cap, brand markers, free NRD) · 12 Oct 2026urlscan depth: newest-first pagination with search_after up to a page budget (default 5, operator 20), stopping past a 180-day age window, query narrowed to page.domain and excluding the legit apex, with a daily search budget that degrades…
v3.38.17v3.38.17: brand plus a known lure affix is always relevant · 12 Oct 2026The brand at an edge joined to a known phishing or theme affix (portal, online, login, secure, verify, update, account, payment, refund, claim, member and the lure family terms) is now always relevant and goes to scoring. It is the brand…
v3.38.16v3.38.16: generic consumer hosting is not distinctive; ground-truth set · 12 Oct 2026Generic consumer hosting and its default nameservers (Namecheap and Spaceship, Hostinger, GoDaddy/Secureserver, the Newfold family of Bluehost and HostGator, IONOS, SiteGround and similar, maintained list) are now treated as generic for…
v3.38.15v3.38.15: informational campaign member is brand-referencing, not Likely · 12 Oct 2026The v3.38.14 live re-run of philhealth exposed a regression from lure-family clustering: a real campaign on shared infrastructure boosted informational name-matches that share that infrastructure to Likely Phishing. Fix: campaign…
Questions

About Falconeye

How do I install Falconeye?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Falconeye safe to use with an AI agent?

Its trust score is 39 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Falconeye still maintained?

Yes — the latest release is v3.38.19 (12 Oct 2026), and the last commit was 5 days ago. The repository has 14 stars.