Stop Begging for API Keys: Metabigor Maps Target Infrastructure for Free

You know the drill. You find a promising OSINT tool, clone the repo, and hit the first wall: "Please enter your Shodan API key." Then it wants a Censys key. Then a VirusTotal key. Before you've run a single command, you've filled out three registration forms and you're still not sure the tool is even worth it. That's exactly the friction Metabigor eliminates—it maps target infrastructure using only free, keyless sources, and it's surprisingly capable for what it gives up.

What It Does

Metabigor is a command-line tool that helps you map a target's digital footprint—network ranges, subdomains, related domains, open ports, CDN vendors, and even leaked code—without requiring you to register for a single API key. It's written in Go and distributed as prebuilt binaries via npm and Homebrew, so you don't need a Go toolchain just to try it.

The core workflow is simple: you give it a target (an ASN, domain, IP, or organization), and it queries free public sources to return structured data. For example, metabigor net AS13335 pulls the IP ranges behind Cloudflare's ASN, while metabigor cert hackerone.com digs up subdomains from certificate transparency logs via crt.sh. IP enrichment uses Shodan's InternetDB, which is free and requires no key. GitHub code search runs through grep.app. Even the URL collection feature mines web archives and WARCs for endpoints.

What's clever is how consistently the tool behaves across all its commands. Every command accepts targets the same four ways—as arguments, with -i, from a file with -I, or piped via stdin. Every command supports the same output formats (text, flat, json, csv). Once you learn one command, you effectively know them all.

Why It's Cool

The no-API-key philosophy isn't just a convenience—it changes how you can use the tool.

• It's actually free. Not "free tier with a 50-request daily limit" free. The sources Metabigor uses—crt.sh, Shodan InternetDB, grep.app, web archives—are genuinely public. You're not burning through credits or hitting rate limits that force you to wait around.

• It's pipeable by design. The flat output format gives you the bare primary value (just the IPs, just the domains), which makes Metabigor a perfect building block in a larger recon pipeline. You can chain commands together or feed results directly into other tools without parsing noise.

• The input handling is thoughtful. Stdin is only read when no target was given another way, so running metabigor net AS13335 inside a script never blocks waiting on input. The -i flag exists for targets that look like flags (like --endpoint-url). These are small touches that show the author has actually used this tool in real workflows.

• CDN/WAF detection is genuinely useful. The cdn --exclude command helps you separate Cloudflare-fronted addresses from potential origin servers. That's a real, practical step in infrastructure mapping that most recon tools leave to you to figure out manually.

• It clusters and pivots. The related command finds other domains a target owns via certificate logs, reverse WHOIS, and analytics IDs. The cluster command groups IPs by ASN. These aren't just lookup tools—they help you build a picture of the infrastructure, not just a list of addresses.

How to Try It

Getting started takes about thirty seconds. Install via npm or Homebrew:

npm install -g @j3ssie/metabigor
# or
brew install j3ssie/tap/metabigor

Then run the 30-second tour:

metabigor net AS13335                  # network ranges behind an ASN
metabigor cert hackerone.com           # subdomains from certificate logs
metabigor ip 1.1.1.1                   # open ports and CVEs for an IP
metabigor related tesla.com            # other domains the target owns
metabigor cdn --exclude -I ips.txt     # candidate origin servers

You can pass multiple targets at once, mix input methods, and pipe results into jq or other tools:

metabigor cluster 1.1.1.1 -i 8.8.8.8 -I more-ips.txt
cat domains.txt | metabigor cert
metabigor net --input "$TARGET" -f json

If you'd rather build from source, clone the repo and run make build—you'll get a binary at ./bin/metabigor. Or grab a prebuilt binary from the releases page. The full documentation and source are on GitHub.

Final Thoughts

Metabigor isn't trying to replace a full commercial OSINT platform—it's a focused, pragmatic tool that removes the biggest barrier to entry (API key management) and gets out of your way. It's best suited for security researchers, bug bounty hunters, and anyone doing recon who wants quick answers without signing up for yet another service. The consistency across commands and the pipe-friendly output make it the kind of tool you'll reach for reflexively once it's installed. It won't do everything, but for what it does, it does it without asking for anything in return—and that's a rare thing in this space.

Follow @githubprojects for more developer tools and open source projects.