maltego-mcp
ActiveGraph-driven OSINT in Maltego Desktop is point-and-click work, so the agent that just reasoned over your indicators has to dictate clicks to a human. maltego-mcp lets it build the graph directly: create entities and links, run whois / DNS / ASN / crt.sh lookups, and write a ready-to-open .mtgx file, no canvas and no paid connector.
See it work
one question, the tools it calls, the answer
Representative session. Illustrative values, RFC 5737 addresses. Lookups query public records; the graph is written to your disk and never leaves the box.
What it does
maltego-mcp is an MCP server that lets an LLM author Maltego .mtgx graph files and run primitive OSINT lookups (whois, DNS, ASN, crt.sh) from inside an agent session. It exists because graph-driven investigation in Maltego Desktop is normally point-and-click work, and an agent already reasoning over indicators should produce the graph itself rather than dictate clicks. Unlike a Maltego transform pack, it lives in the agent layer first: the graph is built by tool calls and saved to disk, so it works on the Basic plan with no paid connectors, and an optional Phase B TRX pack (.mtz) adds native right-click pivots into MISP, TheHive, Cortex, and ATT&CK for teams that want them. The same package ships maltegoctl, a read-only CLI that exposes only the lookups and a .mtgx inspector for shells, cron, and CI.
Capabilities
13 tools across two layers
Set it up
Both env vars optional: MALTEGO_MCP_OUTPUT_DIR (default ~/MaltegoGraphs) and MALTEGO_MCP_LOOKUP_TIMEOUT_MS (default 30000, crt.sh only).
MCP client config
{ "mcpServers": { "maltego": { "command": "maltego-mcp" } } }The bundled maltegoctl CLI is read-only: it exposes only the OSINT lookups and a .mtgx inspector, and inspect is confined to MALTEGO_MCP_OUTPUT_DIR. Graph authoring and file writes stay in the MCP surface because their effect is writing a file. Lookups query public records (whois, DNS, ASN, crt.sh); the graph itself is written to your disk and never leaves the box, and the Basic-friendly demo graph uses documentation-safe indicators only.