BeVigil OSINT MCP server

BeVigil MCP Server

Map a company's mobile attack surface from your AI assistant.

BeVigil has scanned millions of Android apps and extracted the infrastructure hiding inside them — backend hosts, staging subdomains, S3 buckets, API paths, and query parameters that never appear in DNS or search engines. This server puts that data behind seven MCP tools, so you can ask for it in plain language instead of stitching together curl calls.

Built for bug bounty hunters, pentesters, red teamers, and appsec engineers doing recon.

Tested with Claude Code, Claude Desktop, Codex, Cursor, and VS Code.

Quick start (2 minutes)

1. Get a free API key

Sign up at bevigil.com/osint-api. Free accounts get 25 credits, or 200 if you register with a work email. One lookup = one credit.

2. Add the server

No clone, no build — npx fetches and runs it.

Claude Code

claude mcp add bevigil -e BEVIGIL_API_KEY=your_key_here -- npx -y bevigil-mcp-server

Check it registered with claude mcp list.

Claude Desktop

Edit claudedesktopconfig.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "bevigil": {
      "command": "npx",
      "args": ["-y", "bevigil-mcp-server"],
      "env": { "BEVIGIL_API_KEY": "your_key_here" }
    }
  }
}

Restart Claude Desktop.

Codex

codex mcp add bevigil --env BEVIGIL_API_KEY=your_key_here -- npx -y bevigil-mcp-server

Check it registered with codex mcp list.

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "bevigil": {
      "command": "npx",
      "args": ["-y", "bevigil-mcp-server"],
      "env": { "BEVIGIL_API_KEY": "your_key_here" }
    }
  }
}

VS Code (Copilot)

Add to your VS Code MCP settings:

{
  "mcp": {
    "servers": {
      "bevigil": {
        "command": "npx",
        "args": ["-y", "bevigil-mcp-server"],
        "env": { "BEVIGIL_API_KEY": "your_key_here" }
      }
    }
  }
}

3. Ask your first question

Investigate com.whatsapp with BeVigil and summarise the infrastructure it exposes.

You should get back something like this — real hostnames pulled out of the app's code:

# Investigation Report: com.whatsapp
Source: BeVigil OSINT API

## Hosts / Domains (155 found)
• osaka.nyc3.cdn.digitaloceanspaces.com
• s3.getstickerpack.com
• logger.instagram.com
• dev503.prn2.facebook.com
...

That's it — you're doing OSINT from the chat window.

What you can ask

Recon a company's mobile footprint

Which Android apps talk to api.acme.com? Then pull the hosts out of each one.

Find staging and internal endpoints

Get subdomains for acme.com from BeVigil and flag anything that looks like

dev, staging, or internal.

Hunt for exposed storage

What S3 buckets does com.acme.mobile reference?

Build a target-specific fuzzing wordlist

Pull the BeVigil wordlist for com.acme.mobile and save the API paths to

paths.txt.

Shortened. The full README is on GitHub.