breach_searchLABSCO SUMMARY
One conversation instead of six investigation tabs.
Breach data, registrant records and social activity normally live in separate consoles. Here a single prompt can pull a breach profile, pivot on the registrant email and check what X is saying about the same domain.
What it is
An MCP server for the Sycek OSINT platform. It exposes the platform's breach-intelligence and X/Twitter modules as tools, so an investigation that would otherwise mean moving between dashboards runs as one chain of calls.
What you get
- Credential-exposure searches across breach databases and stealer logs
- A full breach profile assembled for one subject in a single call
- WHOIS and reverse-WHOIS lookups that pivot from a domain to its registrant
- Caller-ID and Gmail-focused lookups on a number or address
- X/Twitter keyword search, plus an account's tweets and the replies under them
- An investigation pass over an account, and event timelines
Requirements
A Sycek account and an API key generated in the Developer Portal at sycek.io, which is shown once only. The README’s local install names sycek-osint-mcp, which PyPI does not have, so the route that works is the hosted SSE endpoint, with the key sent as a bearer token; nothing is installed. Tool calls draw on account credits.
Setup effort
Add the hosted endpoint plus a key — paste it into your client, then supply credentials
USE CASES
01
Working out who is behind a suspicious domain
Run WHOIS on the domain, then pivot on the registrant email to find everything else that address has registered.
02
Checking whether an employee's credentials have leaked
Search breach databases and stealer-log records for the address before deciding to force a reset.
03
Identifying an unknown caller
Look the number up and see which identity records are attached to it.
04
Following a story as it breaks on X
Pull an account's recent tweets and the replies under them, then widen to a keyword search on the same topic.
05
Profiling an account before you engage with it
Read the account's own details, then run the investigation pass across its activity and events.
20 tools
Listed in project docs. Your client may show a different list.
breach_whoisbreach_reverse_whoisbreach_caller_idbreach_gmail_osintbreach_full_profiletwitter_usertwitter_tweetstwitter_searchtwitter_repliestwitter_investigatetwitter_eventtwitter_full_profilesocial_searchsocial_streamsocial_analyzesocial_intelligencesocial_actor_profilesocial_stix_exportsocial_investigateBEFORE YOU INSTALL
What to know first
Tools you get
20 tools named in the project's documentation.
Requires
A Sycek API key, sent as the Bearer token in the Authorization header
Where it runs
The documented client connects to a hosted endpoint.
INSTALLATION
Connect your client
Server setup
ENDPOINT URL
https://sycek.io/mcp/sseAdd this hosted endpoint to your MCP client using the credentials listed under Requirements.
MCP Clients
Any MCP client — SSE
ANY MCP CLIENT — SSE · JSON
{
"mcpServers": {
"sycek-osint": {
"type": "sse",
"url": "https://sycek.io/mcp/sse",
"headers": {
"Authorization": "Bearer <YOUR_KEY>"
}
}
}
}On the hosted endpoint the key is the <YOUR_KEY> in the Authorization header of the block above. Create it at sycek.io under Developer Portal → Generate API Key; it is shown once only. SYCEK_API_KEY is only read by the local stdio server.
