EN PT ID

Shadowbroker MCP 2026: OSINT Dashboard for Social Creators

Home › Blog › Shadowbroker MCP OSINT Dashboard

July 3, 2026 · 11 min read · by ThreadGrab

If you write for X Articles, Bluesky long-form, and LinkedIn Newsletter, you already know the pain: the most interesting conversations are scattered across three platforms, three feeds, and three different discovery surfaces. Tracking them in a single browser tab means switching contexts all day. Tracking them across three tabs means losing 40% of what you meant to revisit.

What if a single MCP server could pull X posts, Bluesky threads, LinkedIn updates, RSS feeds, GitHub releases, and 10+ other sources into one real-time dashboard — and let your AI agent (Claude Code, Codex CLI, Cursor) query it on demand?

That is exactly what Shadowbroker does. It is a 2026 MCP-powered OSINT (open-source intelligence) dashboard built by a single developer (BigBodyCobain on GitHub) that wraps 15+ social, code, and news sources behind a unified MCP interface. For social content creators, it is a working reference implementation of something we have been writing about for months: use MCP to break the platform silos.

Today we will walk through what Shadowbroker is, why it matters for X / Bluesky / LinkedIn writers, how the MCP integration actually works under the hood, and how to adapt the same pattern for your own creator workflow — even if you do not want to install Shadowbroker itself.

What Shadowbroker Actually Does

Shadowbroker is, at its core, a thin aggregator. Each source it pulls is wrapped as a Model Context Protocol (MCP) tool — the same protocol that powers Claude Code, Codex CLI, and Cursor's tool-use features. Once running, it exposes a uniform interface where your AI agent can call something like:

search_x(query="AI agents social workflow", limit=20)
list_bluesky_feed(handle="threadgrab.bsky.social", limit=10)
fetch_linkedin_post(url="https://linkedin.com/posts/...")
read_rss(url="https://hnrss.org/newest", limit=15)

Each of those functions is a real MCP tool registered by the Shadowbroker server. The AI agent in your editor does not need a custom API integration per platform — it just calls the tool and gets a structured response back.

The 15+ sources Shadowbroker currently wraps (per the project's README as of July 2026) include:

The list is a deliberate cross-domain mix: social platforms, dev news, academic research, factual reference. That is the OSINT ethos — treat the entire open web as a queryable surface.

Why This Pattern Matters for Social Content Creators

If you write for X Articles, Bluesky long-form, or LinkedIn Newsletter, your real workflow is not "post to platform X." It is:

  1. Discover what people are saying right now (the research phase)
  2. Filter for what is worth a long-form piece (the curation phase)
  3. Draft a response / angle (the writing phase)
  4. Cross-post the result to multiple platforms with platform-specific formatting (the distribution phase)

Step 1 is where Shadowbroker's pattern shines. Today, most creators run that discovery phase in a browser with 12 tabs open. Each tab is a separate UI, a separate auth session, a separate mental context. The same conversation on X, Bluesky, and LinkedIn looks like three different events.

What Shadowbroker does — and what the broader MCP ecosystem is starting to do — is collapse that discovery into a single interface your AI agent can query. Instead of switching tabs, you type into Claude Code or Cursor:

Use the shadowbroker MCP tools to find the 5 most-discussed
posts about "agent reliability" across X, Bluesky, and LinkedIn
in the last 48 hours. Group by sentiment and return URLs.

The agent calls the relevant MCP tools, gets a structured response, and gives you back a single digest. You stay in the editor the entire time.

Setup: Running Shadowbroker Locally

Shadowbroker is an open-source project. The setup is intentionally light: Python 3.11+, a few packages, and an MCP client (Claude Code, Codex CLI, or Cursor). Per the GitHub README:

git clone https://github.com/BigBodyCobain/Shadowbroker.git
cd Shadowbroker
pip install -r requirements.txt

# Configure your MCP client (Claude Code example)
# In ~/.claude.json or your project's .mcp.json:
{
  "mcpServers": {
    "shadowbroker": {
      "command": "python",
      "args": ["/path/to/Shadowbroker/server.py"]
    }
  }
}

For Claude Code users, that JSON goes in your project's .mcp.json. For Codex CLI, it goes in ~/.codex/config.toml under [mcp_servers.shadowbroker]. For Cursor, you configure it in Settings › MCP › Add new global MCP server.

There is no Docker image, no SaaS signup, no API key exchange for most sources. X is the partial exception: Shadowbroker can use the public search API without auth for limited queries, but heavy usage will need bearer tokens (which the project documents in the README).

The Core Idea: Treat the Open Web as One Queryable Surface

What makes Shadowbroker interesting is not the source list — any developer can wrap 15 HTTP APIs. What is interesting is that the project commits to a uniform MCP surface. The agent does not need to know whether it is calling X, Bluesky, Hacker News, or arXiv. The tool name and arguments are normalized.

This is the same insight that drives a lot of 2026 MCP development: the value of MCP is not the protocol itself, it is the normalization. Without normalization, an agent needs a custom tool per platform. With normalization, the agent can chain cross-platform queries with no additional code.

For a social content creator, that means the same agent prompt that asks "what is trending on X" can also ask "what is the academic take on this" by switching the tool name. The agent itself does not need to know that one tool hits X and the other hits arXiv. It just calls them and synthesizes.

Setup Walkthrough: A Concrete Creator Workflow

Let us walk through what a real creator session looks like with Shadowbroker running. The scenario: you are writing a Bluesky long-form post about AI agent reliability tools and want to anchor it in current cross-platform discussion.

Step 1: Discovery across platforms. In your editor, you ask:

Use the shadowbroker MCP server to gather:

1. The top 5 X posts from the last 72 hours matching
   "agent reliability" or "agent eval"
2. The top 5 Bluesky posts from the last 72 hours with the
   same keywords
3. The top 3 Hacker News threads from the last 7 days
4. The 2 most recent arXiv papers on the topic

Return as a single table with platform, URL, summary, and
engagement count.

Behind the scenes, the agent calls 4 MCP tools, each of which hits a different source. The response is a normalized table. The whole discovery phase takes under a minute, and you never leave your editor.

Step 2: Cross-reference and quote-pull. You pick the most interesting sources from the table. Then:

For each row in the discovery table, fetch the full text of
the top post / thread / paper. For X and Bluesky, pull the
post body. For HN, pull the top 3 comments. For arXiv, pull
the abstract. Save the result to ./research-brief.md.

Now you have a markdown research brief that you can read, annotate, and draft from. The brief is portable: it is just a file. You can commit it, share it, or feed it into a different LLM for the actual draft.

Step 3: Draft. This is where you, the human writer, take over. The discovery and quote-pull are mechanical. The synthesis — picking a hook, finding the angle, choosing the structure — is the part MCP cannot do for you. But the inputs to that synthesis are now an order of magnitude richer, because you saw 15 sources in 60 seconds instead of 3 sources in 30 minutes.

Step 4: Cross-post with platform-specific formatting. Once you have the draft, the distribution phase is its own MCP story (we covered that in our X Hosted MCP article and the OpenRouter MCP server article). Shadowbroker handles ingestion; X / OpenRouter MCPs handle routing and posting.

How Shadowbroker Compares to Other MCP Servers

Shadowbroker is one of a growing list of MCP servers targeting social content creators. The 2026 landscape has three main archetypes:

ServerFocusSourcesBest For
Shadowbroker OSINT (ingestion) 15+ (X, Bluesky, HN, arXiv, GitHub, RSS, …) Cross-platform discovery, research, fact-gathering
OpenRouter MCP LLM routing (writing) 100+ models via OpenRouter Multi-model drafts, model-A-vs-B comparisons
X Hosted MCP Distribution X (Twitter) API only Direct posting to X from the agent

These three MCP servers are complementary, not competing. Shadowbroker is the upstream ingestion layer. OpenRouter MCP is the middle routing layer (which model writes the draft). X Hosted MCP is the downstream distribution layer (how the post actually reaches the timeline). A serious creator stack in 2026 will likely run all three — each solves a different problem.

For our readers who are already using OpenRouter MCP for multi-model drafting, Shadowbroker fills the missing piece on the ingestion side. You no longer have to leave the editor to do discovery.

Limitations and Honest Caveats

Shadowbroker is a single-developer project. That has implications:

None of these are dealbreakers for the target audience. The point of Shadowbroker is not to be a newsroom OSINT platform. The point is to be a creator's research assistant — small, fast, local, no signup.

Building Your Own: The Pattern, Not the Project

The bigger takeaway from Shadowbroker is not the project itself. It is the pattern: wrap N HTTP APIs as MCP tools, normalize the surface, expose them to your agent. You can do this with 20 lines of Python and 2 hours of work, even if you do not use Shadowbroker.

A minimal example for a single source (Bluesky) would look like:

# my_social_mcp.py — a minimal MCP server for one platform
from mcp.server import Server
from mcp.types import Tool
import httpx

app = Server("my-social")

@app.tool()
async def search_bluesky(query: str, limit: int = 10) -> list:
    """Search recent Bluesky posts for a query string."""
    url = "https://public.api.bsky.app/xrpc/app.bsky.feed.searchPosts"
    r = httpx.get(url, params={"q": query, "limit": limit}, timeout=10)
    return r.json().get("posts", [])

That 10-line server is a real MCP server. Wire it into Claude Code, and you can call search_bluesky from your agent. The same pattern works for X (with bearer token), Reddit (public JSON), HN (Algolia), and most RSS feeds. You do not need a 15-source mega-server to get 80% of the value.

Start with the 1-2 sources you actually use for research. Add more when the workflow proves out. The MCP ecosystem is at its best when the tools you build match the work you actually do, not the work some generalist dashboard guesses you do.

FAQ: Common Questions From Social Creators

Is Shadowbroker free?

Yes. The project is MIT-licensed on GitHub. You run it locally; there is no hosted service, no signup, no usage cap. The only cost is whatever API keys you bring yourself (e.g. an X bearer token if you want to go past the public rate limits).

Do I need to use Claude Code to benefit from Shadowbroker?

No. Any MCP-compatible client works. The big three in 2026 are Claude Code, OpenAI Codex CLI, and Cursor. All three can register Shadowbroker as an MCP server. The agent layer is interchangeable.

How does Shadowbroker differ from Zapier or IFTTT for social aggregation?

Zapier and IFTTT are trigger-based automation: a new post matching a rule causes a downstream action. Shadowbroker is agent-queryable ingestion: the agent asks for a digest on demand, in real time, with structured results. The mental model is different. Zapier moves data between apps. Shadowbroker gives an LLM a unified view of the open web.

Can I use Shadowbroker for posting, or is it read-only?

Read-only. Shadowbroker is an ingestion / research tool. For posting, layer in a different MCP server — X Hosted MCP for X, the Bluesky API for Bluesky (write your own thin MCP wrapper), and similar for LinkedIn. We covered the X side in our X Hosted MCP article.

How do I avoid X rate limits?

Get a bearer token from the X developer portal. Shadowbroker reads it from the X_BEARER_TOKEN env var. The free tier gets 100 reads per 15 minutes; the basic paid tier gets more. For most creator research sessions, that is plenty.

Is there a hosted version of Shadowbroker?

Not as of July 2026. The project is explicitly local-first. The maintainer has noted interest in a hosted tier but has not committed. If you need shared-team OSINT, you would deploy Shadowbroker on your own infrastructure (a small VM is enough).

Does Shadowbroker work on Bluesky custom feeds?

Partially. The Bluesky tool can fetch a public profile's feed (e.g. threadgrab.bsky.social) and can search the public firehose. Custom feeds (the algorithmic ones users compose) require their own feed URI and are not yet wrapped. For most creators, the public feed is what you want anyway.

Wrap-up: One Pattern, Many Sources, Zero Tab-Switching

Shadowbroker is one of the clearest 2026 examples of the MCP pattern paying off for individual creators. The promise of MCP was always: one protocol, many tools, agent-friendly. Shadowbroker is the most concrete realization of that promise for social content creators — 15+ sources, one normalized surface, no tab-switching.

You do not have to install Shadowbroker to benefit from the pattern. The takeaway is: wrap the open web in MCP tools, expose them to your agent, and let the agent do cross-platform discovery in seconds. Whether you build your own 1-source server or run a 15-source mega-server, the productivity unlock is the same.

For ThreadGrab readers specifically, the natural pairing is Shadowbroker for ingestion + OpenRouter MCP for multi-model drafting + X Hosted MCP for distribution. That three-layer stack covers the full creator loop from research to publication, all from inside your editor, all without leaving the keyboard for the browser.

Read the related pieces for the other layers of the stack: OpenRouter MCP for multi-model drafting, X Hosted MCP for direct agent posting, and our Caliper AI agent reliability article for the eval / drift tracking layer that closes the loop.