{"name":"sh.clearfront/clearfront","slug":"clearfront","title":null,"description":"OSINT sweep of a digital footprint: breaches, accounts, data brokers, domains and IPs","url":"https://mcp.market/server/clearfront","rating":null,"grade":"C","score":60,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":24,"stars":7,"forks":0,"downloads_week":null,"last_push_at":"2026-08-26T03:08:32.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/scottmartinanderson/clearfront","website":null,"version":"2.7.3","remotes":[],"packages":[{"registryType":"pypi","identifier":"clearfront","version":"2.7.3","runtimeHint":"uvx","transport":{"type":"stdio"},"runtimeArguments":[{"value":"clearfront","type":"named","name":"--from"}],"packageArguments":[{"value":"clearfront-mcp","type":"positional"}],"environmentVariables":[{"description":"Have I Been Pwned API key, enables breach and paste lookups","format":"string","isSecret":true,"name":"HIBP_API_KEY"},{"description":"ipinfo.io token, enables IP geolocation and exposure reports","format":"string","isSecret":true,"name":"IPINFO_TOKEN"},{"description":"Shodan API key, enables internet-exposed device lookups","format":"string","isSecret":true,"name":"SHODAN_API_KEY"},{"description":"VirusTotal API key, enables reputation checks on IPs, domains, URLs and file hashes","format":"string","isSecret":true,"name":"VIRUSTOTAL_API_KEY"},{"description":"Anthropic API key, only needed for the AI-assisted multi-target sweep tool","format":"string","isSecret":true,"name":"ANTHROPIC_API_KEY"}]}],"tools":[{"name":"generate_dorks","description":"Generate targeted Google dork URLs for any target (name, email, username, domain).","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_breach","description":"Check if an email appears in data breaches via HaveIBeenPwned. Requires HIBP_API_KEY env var.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_crypto","description":"Validate a Bitcoin or Ethereum address and return a keyless on-chain summary (balance, transactions, total received).","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_domain","description":"Enumerate subdomains of a target domain using sublist3r.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_email","description":"Enumerate accounts linked to an email using holehe.","write_action":true,"price_micros":0,"input_schema":null},{"name":"search_emailrep","description":"Email reputation and footprint summary via EmailRep.io (profiles seen, breach/abuse flags). Requires EMAILREP_API_KEY.","write_action":true,"price_micros":0,"input_schema":null},{"name":"search_gravatar","description":"Look up an email's public Gravatar profile: avatar, display name, bio, location, and linked/verified accounts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_harvester","description":"Passive organisation/domain recon via theHarvester: emails, people, and subdomains from public sources (passive only, no active probing).","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_maigret","description":"Broad username/identity discovery across 3,400+ sites via maigret (also extracts profile details).","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_paste","description":"Search public paste sites for an email or username (HIBP paste index + search-engine dorking).","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_phone","description":"Gather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_username","description":"Enumerate and verify platforms where a username is registered, using sherlock plus a WhatsMyName subset of modern/niche sites.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_whois","description":"Retrieve WHOIS registration data for a domain.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":60,"grade":"C","scanned_at":"2026-09-24T17:23:37.520Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-24T17:23:37.413Z","components":{"code":{"score":13,"max":25,"notes":["59 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 30 days ago"]},"identity":{"score":5,"max":10,"notes":["namespace and repository owner differ","GitHub account older than a year"]}},"findings":[{"id":"net.suspicious-host","severity":"high","component":"code","title":"Network call to a paste/tunnel/webhook host","evidence":"clearfront-2.7.3/clearfront/tools/search_paste.py: …lower() == \"pastebin\": return f\"https://pastebin.com/{paste_id}\" return f\"(id: {paste_id…"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"clearfront","version":"2.7.3","found":true,"license":"MIT","dependencyCount":37,"publishedAt":"2026-07-30T14:52:58.287138Z","repositoryUrl":"https://github.com/scottmartinanderson/clearfront"}],"repo":{"found":true,"owner":"scottmartinanderson","repo":"clearfront","archived":false,"pushedAt":"2026-08-26T03:08:32Z","stars":7,"forks":0,"openIssues":1,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/217986189?v=4","ownerCreatedAt":"2025-06-25T19:50:19Z","license":"MIT"},"icon":{"url":null,"source":"none"},"presence":{"stars":7,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-08-26T03:08:32.000Z","score":24}}}},"grade_history":[],"reviews":[]}