Metadata-Version: 2.5
Name: recon-tool
Version: 2.19.12
Summary: Public-metadata domain intelligence CLI and MCP server using DNS, certificate transparency, and unauthenticated identity discovery.
Project-URL: Homepage, https://github.com/blisspixel/recon
Project-URL: Repository, https://github.com/blisspixel/recon
Project-URL: Changelog, https://github.com/blisspixel/recon/blob/main/CHANGELOG.md
Project-URL: Issues, https://github.com/blisspixel/recon/issues
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: dns,domain-intelligence,mcp,osint,recon,saas-fingerprinting,security
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: System :: Networking
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: anyio>=4.14.2
Requires-Dist: deal>=4.24.0
Requires-Dist: defusedxml>=0.7
Requires-Dist: dnspython>=2.6
Requires-Dist: httpcore2>=2.10.0
Requires-Dist: httpcore[asyncio]<2,>=1.0.9
Requires-Dist: httpx2>=2.12.0
Requires-Dist: httpx>=0.27
Requires-Dist: jsonschema<5,>=4.23
Requires-Dist: mcp<3,>=2.0.0
Requires-Dist: networkx>=3.0
Requires-Dist: publicsuffixlist>=1.0
Requires-Dist: pyjwt>=2.14.0
Requires-Dist: python-multipart>=0.0.27
Requires-Dist: pyyaml>=6.0
Requires-Dist: rich>=13.0
Requires-Dist: typer>=0.27.3
Description-Content-Type: text/markdown

# recon

[![CI](https://github.com/blisspixel/recon/actions/workflows/ci.yml/badge.svg)](https://github.com/blisspixel/recon/actions/workflows/ci.yml)
[![PyPI](https://img.shields.io/pypi/v/recon-tool.svg?cacheSeconds=300)](https://pypi.org/project/recon-tool/)
[![Python](https://img.shields.io/pypi/pyversions/recon-tool.svg?cacheSeconds=300)](https://pypi.org/project/recon-tool/)
[![License](https://img.shields.io/pypi/l/recon-tool.svg?cacheSeconds=300)](https://github.com/blisspixel/recon/blob/main/LICENSE)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/blisspixel/recon/badge)](https://scorecard.dev/viewer/?uri=github.com/blisspixel/recon)

Point recon at a domain to see its **public technology and identity
footprint**: email providers and controls, identity indicators, SaaS services,
and cloud infrastructure. No credentials, API keys, or active scanning.
Use the CLI for a quick lookup, versioned JSON for automation, or the local
MCP server from an agent.

recon reports evidence-backed observations, not a complete inventory or a
security verdict. A domain does not establish an organization's boundaries.

## See the Output

![Synthetic recon output in a modern Linux terminal](https://raw.githubusercontent.com/blisspixel/recon/main/docs/assets/terminal-demo.svg)

**Synthetic illustration, generated, not captured.** The real formatter renders
a deterministic, no-network fixture for Example Industries Ltd. No real
organization is depicted, and no live lookup of reserved `example.com`
reproduces this fixture.

<!-- terminal-demo-transcript:start -->
<details>
<summary>Accessible text transcript</summary>

```text
demo@recon:~$ recon example.com    # synthetic fixture, not a captured run
Example Industries Ltd
example.com
──────────────────────────────────────────────────────────────────────────────
  Provider     Microsoft 365 + Proofpoint gateway
  Tenant       a1b2c3d4-e5f6-7890-abcd-ef1234567890 • NA
  Tenant domain example-industries.onmicrosoft.example.com
  Auth         Federated
  Confidence   ●●● High (4 sources)


Services
  Email            Microsoft 365, Proofpoint, DMARC reject, DKIM,
                   SPF strict, MTA-STS enforce
  Identity         Okta
  Cloud            Cloudflare (CDN/edge), AWS Route 53 (DNS)
  Security         Wiz Security
  Data & Analytics Snowflake, Datadog
  Collaboration    Slack, Atlassian (Jira/Confluence), GitHub, Zoom
                   Evidence roles: --explain


High-signal related domains
  login.example.com, support.example.com, status.example.com

Insights
  Federated identity observed; identity-vendor indicators: Okta
  Email security: observed controls: DMARC reject, DKIM, SPF strict, MTA-STS

```

</details>
<!-- terminal-demo-transcript:end -->

## Quick Start

**macOS / Linux:**

```bash
curl -fsSL https://raw.githubusercontent.com/blisspixel/recon/main/scripts/install.sh | bash
```

**Windows (PowerShell):**

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/blisspixel/recon/main/scripts/install.ps1 | iex"
```

The installer sets up recon for your user account, including Python when needed.
Open a new terminal afterward. Already have Python 3.11 through 3.14? Use
`pip install recon-tool` in a virtual environment.
For review-before-run instructions, other package managers, updates, and recovery,
see the [installation guide](https://github.com/blisspixel/recon/blob/main/docs/getting-started.md#install-or-update).

```bash
recon --version      # offline install check
recon doctor         # online connectivity and installation diagnostics
```

Lookups make DNS queries visible to recursive and authoritative infrastructure.
MTA-STS is the only default target-owned HTTP request; Google CSE and BIMI
certificate probes require explicit `--direct-probes`. There is no port
scanning or application crawling. Replace the placeholder to start:

```bash
recon "<domain-you-want-to-review>"
```

Ordinary lookups may reuse the 24-hour result cache. Use `--no-cache` to bypass
it; certificate-transparency enrichment has a separate cache. See
[first lookup and cache behavior](https://github.com/blisspixel/recon/blob/main/docs/getting-started.md#first-lookup).

## Common Commands

The bare command stays compact. Request evidence or structured output when needed:

```bash
recon example.com                      # compact panel
recon example.com --explain             # evidence and source status
recon example.com --json                # structured record
recon example.com --plain               # linear text for screen readers and grep
recon review example.com               # fresh, evidence-linked review bundle
recon batch domains.txt --json          # look up a supplied domain list
recon delta example.com                # compare with a cached baseline
recon update                           # update through the original package manager
```

These examples use reserved domains; real lookups will not reproduce the
synthetic illustration above. For multi-domain reviews, recon describes
observed similarities and differences without inferring ownership or a
corporate relationship. See the
[evidence-first review workflow](https://github.com/blisspixel/recon/blob/main/docs/defender-workflow.md)
and [batch guide](https://github.com/blisspixel/recon/blob/main/docs/getting-started.md#batch-and-delta).

## Use with an Agent

The PyPI package installs the CLI and MCP runtime. Connect the local server to
Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or Kiro:

```bash
recon mcp install --client=claude-desktop
recon mcp doctor
```

Restart the client and begin with manual tool approvals. Ask for one domain's
email and identity indicators, or a service comparison across supplied domains.
Missing evidence means "not observed", not "not used"; collection failures
remain explicit. Local execution is the default, and the project does not
operate a hosted service.

See [MCP setup and supported clients](https://github.com/blisspixel/recon/blob/main/docs/mcp.md)
and [skills, plugins, and their validation status](https://github.com/blisspixel/recon/blob/main/agents/README.md).

## Documentation

| Need | Guide |
|---|---|
| Install, update, uninstall, or troubleshoot | [Getting started](https://github.com/blisspixel/recon/blob/main/docs/getting-started.md) |
| Find a command or flag | [CLI reference](https://github.com/blisspixel/recon/blob/main/docs/cli-surface.md) |
| Build automation or hand off evidence | [JSON schema](https://github.com/blisspixel/recon/blob/main/docs/schema.md), [review bundles](https://github.com/blisspixel/recon/blob/main/docs/review-bundles.md) |
| Understand results and their limits | [How it works](https://github.com/blisspixel/recon/blob/main/docs/how-it-works.md), [limitations](https://github.com/blisspixel/recon/blob/main/docs/limitations.md), [reporting observations](https://github.com/blisspixel/recon/blob/main/docs/reporting-observations.md) |
| Check plans and shipped changes | [Roadmap](https://github.com/blisspixel/recon/blob/main/ROADMAP.md), [changelog](https://github.com/blisspixel/recon/blob/main/CHANGELOG.md) |
| Find architecture, security, research, or release procedures | [Full documentation index](https://github.com/blisspixel/recon/blob/main/docs/README.md) |

## Contributing and Support

Catalog corrections and documented vendor patterns are especially useful.
Start with [CONTRIBUTING.md](https://github.com/blisspixel/recon/blob/main/CONTRIBUTING.md)
for setup, verification, and contribution requirements; coding agents should
also read [AGENTS.md](https://github.com/blisspixel/recon/blob/main/AGENTS.md).

Use [issues](https://github.com/blisspixel/recon/issues) for bugs and feature
requests. Keep public examples reserved and synthetic; never post evaluated
company domains, tenant IDs, or per-domain results. See the
[private reporting paths](https://github.com/blisspixel/recon/blob/main/docs/data-handling-policy.md#private-non-security-reports)
and [security policy](https://github.com/blisspixel/recon/blob/main/SECURITY.md).
Intended for [defensive use](https://github.com/blisspixel/recon/blob/main/docs/legal.md).

## License

[Apache 2.0](https://github.com/blisspixel/recon/blob/main/LICENSE).
