Local MCP capabilities provider for Expo
Nothing to run from here
Maltego is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
100/100
trust score
15
downloads a day
local
runs on your machine
449
downloads in 30d
What it does
Maltego OSINT for AI agents: transforms, Machines, link-graph analysis and native .mtgx.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user data-unix-maltego-mcp '--' npx -y mcp-maltego
# 2 — ask your agent for something these tools do
# osint_list_entity_types, osint_list_transforms, osint_manage_case and 17 more
Maltego costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
DUAll 1 server
Data-Unix1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Maltego as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user data-unix-maltego-mcp '--' npx -y mcp-maltegoReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
20 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
Lista los tipos de entidad soportados (estándar de Maltego e importados de tu Maltego) por categoría, con su propiedad principal. El valor de maltego_type es el entity_type que usan las demás tools.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| category | string | no | Filtra por categoría (infraestructura, identidad...). |
| response_format | no | — |
Inventario: transforms (integrados sin API key, de proveedores con API key y de tus servidores TRX/iTDS) filtrables por tipo de entrada o categoría, Machines disponibles y estado de cada proveedor y servidor (check_servers=true comprueba la conexión).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| entity_type | string | no | Filtra por tipo de entrada; vacío = todos. |
| category | string | no | Filtra por categoría: dns, whois, proveedor:shodan... |
| include_machines | boolean | no | Incluir la lista de Machines. |
| check_servers | boolean | no | Comprobar conexión con servidores TRX/iTDS. |
| response_format | no | — |
Crea o actualiza un caso (action=create), divide un caso en sub-casos por rol para enjambres multi-agente (action=fork o delegate, sub_roles), fusiona otro caso o todos los sub-casos con bloqueo optimista (action=merge, source_case o 'all', expected_version) o lo borra (action=delete, confirm).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| sub_roles | array | no | Roles para dividir en sub-casos en fork/delegate (ej.: ['infra', 'humint']). |
| action | string | no | create, merge, delete, fork o delegate. |
| description | string | no | Objetivo del caso (create/fork). |
| source_case | string | no | Caso a fusionar en case_id, o 'all' para todos los sub-casos (merge). |
| expected_version | integer | no | Versión esperada para bloqueo optimista en merge (0=omitir). |
| confirm | string | no | Repite el case_id para confirmar delete. |
| response_format | no | — |
Lista los casos de investigación, del más reciente al más antiguo, con paginación.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | no | — | |
| offset | no | — | |
| response_format | no | — |
Resume un caso: recuentos por tipo, entidades prioritarias (puntuación explicable de confianza, fiabilidad de fuentes, conexiones y novedad), entidades aisladas e índices de calidad.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| top | integer | no | Cuántas entidades prioritarias mostrar. |
| response_format | no | — |
Guarda una entidad en un caso (lo crea si no existe). Normaliza el valor y devuelve su entity_id determinista. Reinsertar fusiona fuentes y propiedades. Úsala también para volcar al grafo datos de otros MCP (MISP, ATT&CK, TheHive...) con source=<origen>.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_type | yes | — | |
| value | string | yes | Valor de la entidad (ej.: example.com). |
| properties | yes | — | |
| confidence | no | — | |
| source | string | no | Origen del dato (manual, misp, attack...). |
| notes | string | no | Notas del analista. |
| response_format | no | — |
action=update cambia confianza, notas o propiedades. action=visual_style fija peso/color/tamaño visual para .mtgx. action=analyze_behavior ejecuta perfilado conductual HUMINT. action=generate_persona genera un kit operativo de Sock Puppet (humint.Alias + plantilla accounts.toml). action=delete…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_id | yes | — | |
| properties | yes | — | |
| remove_properties | array | no | Nombres de propiedades a quitar. |
| action | string | no | update, delete, visual_style, analyze_behavior o generate_persona. |
| confidence | number | no | Nueva confianza 0-1; -1 = no cambiar. |
| notes | string | no | Notas (sustituyen a las actuales). |
| visual_weight | integer | no | Peso visual 1-100 en .mtgx (-1 = automático por criticidad). |
| visual_color | string | no | Color hex del nodo en .mtgx (ej.: #e11d48). |
| visual_size | string | no | Tamaño visual del nodo en .mtgx. |
| reason | no | — | |
| response_format | no | — |
Devuelve una entidad con propiedades, notas, fuentes, puntuación explicada, qué paso la descubrió (procedencia), qué transforms se ejecutaron sobre ella y cuáles quedan pendientes.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_id | yes | — | |
| response_format | no | — |
Busca entidades por texto contenido en el valor y/o tipo, en un caso o en todos (case_id vacío: correlación entre casos). sort=priority ordena por puntuación (requiere case_id).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | no | Texto a buscar; vacío = todas. |
| entity_type | string | no | Filtra por tipo Maltego; vacío = todos. |
| case_id | string | no | Caso donde buscar; vacío = todos los casos. |
| sort | string | no | value o priority. |
| limit | no | — | |
| offset | no | — | |
| response_format | no | — |
action=link crea/refuerza la relación dirigida source -> target (con rol, sentimiento y peso HUMINT opcionales); action=analyze infiere rol/sentimiento/peso; action=correlate calcula la probabilidad de solapamiento de identidad entre alias/perfiles y enlaza si >=0.85; action=unlink elimina la…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| source_id | yes | — | |
| properties | yes | — | |
| target_id | string | no | Id de entidad destino (vacío en action=correlate para comparar con todo el caso). |
| edge_label | string | no | Tipo de relación (ej.: resolves_to, owns). |
| action | string | no | link, unlink, correlate o analyze. |
| confidence | no | — | |
| source | string | no | Origen de la relación. |
| role | string | no | Rol relacional HUMINT opcional. |
| sentiment | string | no | Sentimiento o naturaleza del vínculo HUMINT. |
| weight | integer | no | Peso o frecuencia de interacción (1-100). |
| response_format | no | — |
Lista las entidades relacionadas con una entidad, con el tipo y la dirección de cada relación.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_id | yes | — | |
| edge_label | string | no | Filtra por tipo de relación; vacío = todas. |
| direction | string | no | out, in o both. |
| limit | no | — | |
| response_format | no | — |
Encuentra caminos (sin ciclos, en cualquier dirección, el más corto primero) entre dos entidades.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| source_id | yes | — | |
| target_id | yes | — | |
| max_depth | integer | no | Máximo de saltos (1-6). |
| limit | integer | no | Máximo de caminos (1-20). |
| response_format | no | — |
Ejecuta un transform (integrado, de proveedor o de tus servidores TRX/iTDS) sobre una entidad. Con save=true guarda entidad, resultados, relaciones y el paso en la memoria del caso.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| transform | string | yes | Nombre del transform (ver osint_list_transforms). |
| entity_type | yes | — | |
| value | string | yes | Valor de la entidad de entrada. |
| properties | yes | — | |
| case_id | string | no | Caso donde guardar (obligatorio si save=true). |
| save | boolean | no | Guardar en el grafo del caso. |
| soft_limit | no | — | |
| reason | no | — | |
| response_format | no | — |
Ejecuta sobre una entidad del caso todos los transforms disponibles que declaran su tipo (como 'Run All' en Maltego) y guarda los resultados. Indica los que faltan por API key.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_id | yes | — | |
| max_transforms | integer | no | Máximo de transforms a ejecutar. |
| soft_limit | no | — | |
| reason | no | — | |
| response_format | no | — |
Ejecuta una Machine (DomainRecon, InfrastructureRecon, EmailRecon, CompanyFootprint, PersonalFootprint, URLRecon, ThreatSweep, ASNToNetblocks o las de tu catálogo) o una cadena propia (transforms en orden). max_rounds repite la expansión sobre lo nuevo; los presupuestos limitan coste.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| entity_type | yes | — | |
| value | string | yes | Valor de la entidad inicial. |
| transforms | array | no | Cadena propia (si no usas machine). |
| machine | string | no | Nombre de la Machine (ver osint_list_transforms). |
| max_rounds | integer | no | Rondas de expansión recursiva. |
| max_inputs_per_step | integer | no | Máximo de entidades por transform. |
| max_total_entities | integer | no | Para al alcanzar este total. |
| soft_limit | no | — | |
| reason | no | — | |
| response_format | no | — |
Punto de entrada: detecta el tipo del valor, crea el caso (o usa case_id), ejecuta la Machine adecuada (o expand_entity), puntúa entidades, propone los siguientes pasos y devuelve un informe en línea.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| value | string | yes | Dato inicial: dominio, IP, correo, URL, alias... |
| case_id | string | no | Caso; vacío = se crea inv-<valor>-<fecha>. |
| entity_type | no | — | |
| machine | string | no | Forzar Machine; vacío = automática por tipo. |
| max_rounds | integer | no | Rondas de expansión. |
| max_total_entities | integer | no | Presupuesto de entidades. |
| reason | no | — | |
| response_format | no | — |
Recomienda de forma determinista y explicada los pivotes más valiosos: entidad prioritaria x transform aplicable aún no ejecutado x rendimiento histórico del transform (aprendizaje por resultados).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| limit | integer | no | Cuántas acciones devolver. |
| include_stats | boolean | no | Incluir rendimiento histórico de transforms. |
| response_format | no | — |
mode=investigation devuelve la memoria procedimental del caso (pasos ejecutados, con since_seq). mode=subject construye la cronología vital/conductual del sujeto a partir de fechas de entidades (whois.created, breach.date, github.created_at...) y detecta anomalías temporales (de-confliction).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| mode | string | no | investigation (pasos del MCP) o subject (cronología del sujeto y de-confliction). |
| entity_id | string | no | Opcional en mode=subject: filtrar por una entidad y su vecindario. |
| since_seq | integer | no | Solo pasos posteriores a este seq (sondeo incremental). |
| limit | integer | no | Máximo de pasos o eventos. |
| response_format | no | — |
Exporta a fichero: mtgx (grafo nativo de Maltego con layout hierarchical/radial/force y la memoria de la investigación dentro), json, graphml (SIEM/SOAR, Gephi), csv, report_md o report_html (informe ejecutivo). inline=true devuelve además el informe Markdown en la respuesta.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| format | string | no | mtgx, json, graphml, csv, report_md o report_html. |
| layout | string | no | Disposición del .mtgx. |
| inline | boolean | no | Incluir el informe Markdown en la respuesta. |
Importa (fusiona) en un caso un grafo .mtgx guardado en Maltego —con su memoria si la trae— o un CSV (source_type,source_value,relation,target_type,target_value,confidence). El fichero debe estar en ~/.maltego-mcp/imports o exports.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| case_id | yes | — | |
| file_name | string | yes | Nombre del fichero, p. ej. caso.mtgx. |
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Maltego or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 100 / 100
Release 0.2.0 · scanned 2 Nov 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score100
Findings1 threat · 0 capability
Capabilityminimal
Coveragesource
Verificationsource
Surface digest30363e02c4d21ad6100bab561a6c595c67bb6bcda52c1e6335e85033bd9c3278
Score vectorthreat 100 → client 100
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | minimal | capability blast radius (minimal) — client exposure if the model is manipulated | −0 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (20 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| osint_list_entity_types | no tags | |
| osint_list_transforms | no tags | |
| osint_manage_case | no tags | |
| osint_list_cases | no tags | |
| osint_get_case_summary | no tags | |
| osint_upsert_entity | no tags | |
| osint_manage_entity | no tags | |
| osint_get_entity | no tags | |
| osint_search_entities | no tags | |
| osint_link_entities | no tags | |
| osint_get_neighbors | no tags | |
| osint_find_paths | no tags | |
| osint_run_transform | no tags | |
| osint_expand_entity | no tags | |
| osint_run_machine | no tags | |
| osint_investigate | no tags | |
| osint_suggest_next_steps | no tags | |
| osint_get_timeline | no tags | |
| osint_export_case | no tags | |
| osint_import_graph | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest30363e02c4d21ad6
Scanned2026-11-02
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.2.0. Pin a release below and the command asks for exactly that one.
0.2.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Maltego can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.