maltego-mcp

Active

Graph-driven OSINT in Maltego Desktop is point-and-click work, so the agent that just reasoned over your indicators has to dictate clicks to a human. maltego-mcp lets it build the graph directly: create entities and links, run whois / DNS / ASN / crt.sh lookups, and write a ready-to-open .mtgx file, no canvas and no paid connector.

GitHub repo → npm →
$npm install -g maltego-mcp
maltegoctl CLIread-only CLINode 20+Maltego Basic OK

See it workrepresentative session

you
Build me a Maltego graph for example.com with whois, DNS, and ASN expansion.
tool
maltego_expand_domain{ domain: "example.com", outputPath: "example-com.mtgx" }
result
Domain example.com whois registrar: IANA, created 1995-08-14 DNS A 203.0.113.10, MX 10 mail.example.com, NS a.iana-servers.net ASN AS64500 / 203.0.113.0/24 / US / Example-Net saved 9 entities, 8 links -> ~/MaltegoGraphs/example-com.mtgx
tool
maltego_crtsh{ domain: "example.com" }
result
4 cert-transparency entries *.example.com Let's Encrypt 2026-06-02 -> 2026-08-31 vpn.example.com Let's Encrypt 2026-05-19 -> 2026-08-17
agent
Graph saved to ~/MaltegoGraphs/example-com.mtgx, open it in Maltego Desktop. crt.sh surfaces a vpn.example.com host not in the DNS answers, worth adding as a pivot before you dig further.

Representative session. Illustrative values, RFC 5737 addresses. Lookups query public records; the graph is written to your disk and never leaves the box.

What it does

maltego-mcp is an MCP server that lets an LLM author Maltego .mtgx graph files and run primitive OSINT lookups (whois, DNS, ASN, crt.sh) from inside an agent session. It exists because graph-driven investigation in Maltego Desktop is normally point-and-click work, and an agent already reasoning over indicators should produce the graph itself rather than dictate clicks. Unlike a Maltego transform pack, it lives in the agent layer first: the graph is built by tool calls and saved to disk, so it works on the Basic plan with no paid connectors, and an optional Phase B TRX pack (.mtz) adds native right-click pivots into MISP, TheHive, Cortex, and ATT&CK for teams that want them. The same package ships maltegoctl, a read-only CLI that exposes only the lookups and a .mtgx inspector for shells, cron, and CI.

Capabilities13 tools across two layers

Graph authoring

5 tools

Create a graph, add typed entities and links, save to .mtgx, or load an existing one back into a handle.

Primitive lookups

4 tools

whois, DNS (A/AAAA/MX/NS/TXT), Team Cymru ASN, and crt.sh certificate transparency for a single target.

Convenience expanders

4 tools

One call turns an IP, domain, hash, or enriched IOC into a saved .mtgx pivot map.

maltegoctl CLI

read-only

Same lookups plus a .mtgx inspector for shells, cron, and CI; never writes to disk.

Phase B transforms

optional .mtz

Python TRX right-click pivots into MISP, TheHive, Cortex, and the bundled ATT&CK dataset inside Maltego Desktop.

Full tool reference on GitHub →

Setup

01 · install
npm install -g maltego-mcp
02 · configure

Both env vars optional: MALTEGO_MCP_OUTPUT_DIR (default ~/MaltegoGraphs) and MALTEGO_MCP_LOOKUP_TIMEOUT_MS (default 30000, crt.sh only).

03 · mcp client config
{ "mcpServers": { "maltego": { "command": "maltego-mcp" } } }

Safety

how it stays safe
The bundled maltegoctl CLI is read-only: it exposes only the OSINT lookups and a .mtgx inspector, and inspect is confined to MALTEGO_MCP_OUTPUT_DIR. Graph authoring and file writes stay in the MCP surface because their effect is writing a file. Lookups query public records (whois, DNS, ASN, crt.sh); the graph itself is written to your disk and never leaves the box, and the Basic-friendly demo graph uses documentation-safe indicators only.

More in Threat Intelligence & OSINT3 tools

cyberbriefAI threat-intel briefings: BLUF reports, ATT&CK mapping, and IOC extraction. intel-workbenchBrowser-native ACH workbench: ATT&CK tagging, ICD 203 confidence, local-only. vervetThreat hunting for Zeek and Suricata logs: explainable per-host risk with ATT&CK evidence chains.