OSINT graphs are point-and-click busywork. maltego-mcp lets an LLM author the .mtgx and run the whois, DNS, ASN, and crt.sh lookups. Works on the Basic plan.
概览
An MCP server that lets an LLM author Maltego graph files and run primitive OSINT lookups. maltego-mcp is a Model Context Protocol (MCP) server that lets an LLM author Maltego .mtgx graph files and run primitive OSINT lookups (whois, DNS, ASN, crt.sh) from inside an agent session. It exists because graph-driven OSINT investigation in Maltego Desktop is normally point-and-click work, and an agent that can already reason over indicators should be able to produce the graph directly instead of dictating clicks to a human. It differs from a Maltego transform pack by living in the agent layer first: the graph is built and saved to disk by tool calls, then opened in Maltego, so it works even on the Basic plan and without paid connectors. A second optional layer (Phase B) does add native right-click transforms inside Maltego Desktop for teams that want that too.
README
以下为原文 README 节选，完整内容请查看原文。
maltego-mcp
An MCP server that lets an LLM author Maltego graph files and run primitive OSINT lookups.
Website
maltego-mcp is a Model Context Protocol (MCP) server that lets an LLM author Maltego .mtgx graph files and run primitive OSINT lookups (whois, DNS, ASN, crt.sh) from inside an agent session. It exists because graph-driven OSINT investigation in Maltego Desktop is normally point-and-click work, and an agent that can already reason over indicators should be able to produce the graph directly instead of dictating clicks to a human. It differs from a Maltego transform pack by living in the agent layer first: the graph is built and saved to disk by tool calls, then opened in Maltego, so it works even on the Basic plan and without paid connectors. A second optional layer (Phase B) does add native right-click transforms inside Maltego Desktop for teams that want that too.
What it does
maltego-mcp is an MCP server for Maltego Desktop OSINT that gives an LLM agent a small, typed toolset for building Maltego graphs and enriching indicators of compromise. An agent calls these tools to create a graph, add entities and links, run whois / DNS / ASN / certificate-transparency lookups, expand an IP or domain into a pivot map, and write the result to a .mtgx file you open in Maltego Graph Desktop. Keywords: Maltego, MCP server, OSINT, threat intelligence, graph, whois, DNS, ASN, crt.sh, indicators of compromise.
It ships as two cooperating layers:
- Phase A (TypeScript MCP server): lets an LLM author Maltego
.mtgxgraph files and run primitive OSINT lookups (whois / DNS / ASN / crt.sh). Graphs land on disk and you open them in Maltego Desktop. - Phase B (Python TRX transforms in a
.mtz): adds right-click pivots into MISP, TheHive, Cortex, and the bundled MITRE ATT&CK dataset directly inside Maltego Desktop. Seetransforms/README.md.
The two phases share the repo, nothing else. Either layer can be uninstalled without breaking the other.
Install
npm install -g maltego-mcp
Or from source (required for Phase B transforms):
git clone https://github.com/lidless-labs/maltego-mcp.git
cd maltego-mcp
npm install
npm run build
安装
npx maltego-mcp@latest whois example.com配置
{
"mcpServers": {
"maltego": {
"command": "maltego-mcp"
}
}
}