Best OSINT tools for developers, ranked for a scripted workflow

The best OSINT tools for developers are the ones you can script or wire into your own systems: AyeWatch for ongoing monitoring with an API and an MCP server, SpiderFoot and theHarvester for scanning a domain, Shodan for internet-facing services, Recon-ng as a modular framework, Sherlock for usernames, Maltego for link graphs and ExifTool for file metadata. Below is how they rank for a developer workflow, with costs as of November 2026.

How we ranked them

Three questions decided the order. Can you drive it from code or a terminal? Does it do a job the others on the list don't? And does it keep working after the first scan, or does it stop when you close the terminal?

The ranking

1. AyeWatch

Scanners hand you a snapshot. AyeWatch keeps looking. Point it at a URL such as a vendor's changelog, a security advisories page or a careers page, describe a topic in plain English, or pick a public X account or subreddit, and it sends a summary with source links when something relevant changes. Paid plans include a REST API and signed webhooks, so alerts can flow into your own pipeline, and the MCP server lets an AI coding assistant create, update or pause monitors. See the AyeWatch plans, which start with a free preview.

2. SpiderFoot

A Python tool under the MIT license that runs as a local web app or straight from the command line. It ships more than 200 modules, a YAML-configured correlation engine and exports to CSV, JSON and GEXF. Its README notes it can be run defensively, to see what your own organization exposes online.

3. theHarvester

Give it a domain and it collects hostnames, email addresses, IPs, URLs and ASNs from search engines, certificate transparency logs, DNS datasets and code repositories. It runs as a CLI, a local REST API or a local browser view. The README is direct: run it only against targets you own or have permission to test.

4. Shodan

A search engine for devices and services connected to the internet, with an API for search and IP lookups. The free account is limited; Shodan sells a one-time membership upgrade and monthly API plans for heavier use.

5. Recon-ng

A modular reconnaissance framework whose console will feel familiar to anyone who has used Metasploit. Modules are written in Python, so adding a data source is a small job.

6. Sherlock

Install it with pipx or Docker, pass one or more usernames, and it checks social networks for matching accounts and writes the hits to a text file. Use it on your own or your company's handles.

7. Maltego

Desktop link analysis that turns domains, organizations, accounts and people into nodes on a graph. There is a free Basic plan; paid tiers are billed yearly and aimed at professional investigators.

8. ExifTool

Phil Harvey's free command line tool and Perl library reads, writes and edits metadata in images, video and documents.

Rules of the road

Scan only systems you own or are allowed to test, stick to public sources, and never aim username or people tools at private individuals.

When another pick wins

For a single audit of one domain, SpiderFoot alone may cover everything you need. AyeWatch earns the top spot when the job repeats, such as tracking a vendor's advisories or a rival's releases for months. This walkthrough of an AI-assisted OSINT setup shows how the monitors fit together.