FalconEye

Free

The README and the live page both present FalconEye as free. The SPDX field on 19 Oct 2026 was AGPL-3.0. No seat price, credit pack, or checkout was printed on the toolkit page this listing opened. The one money figure in the README is the typical cost of an LLM call, about $0.003, for the four tabs that call Claude Haiku 4.5. That is the project's estimate of a model call. It is not a FalconEye subscription, and it was not measured from this review. AGPL-3.0 is a strong copyleft. The README says a modified version offered as a network service has to offer the modified source to users of that service. Self-hosting still needs your own Docker host and, if you enable those four tabs, your own Anthropic key. Do not turn the $0.003 line into a price for the other fifteen tabs.

The README calls FalconEye a free, self-hosted OSINT investigator's toolkit and names 19 investigative tabs: crypto wallet tracing, phishing kit fingerprinting, domain intelligence, Telegram OSINT, IP reputation, email header forensics, Google dork generation, script decoding, URL expansion, QR decoding, company dossiers, reverse image search, username enumeration, Have I Been Pwned checks, ransomware tracking, attack surface management, phishing domain hunting, a route map, and a sock-puppet generator. It says ten of the tabs are also exposed as MCP tools. The username section says the check uses vendored WhatsMyName and Sherlock data across 965 platforms, with adult sites off by default. The attack-surface section says it is for domains you control. The sock-puppet section says the personas are fictional and are not impersonation. This listing does not repeat a procedure for either of those tabs.

• Version 3.39.0 on both pages. The README says 3.39.0. The GitHub release v3.39.0 was published 2026-10-18. This listing does not split them.
• Nineteen tabs, ten of them MCP. Those counts are the README's on 19 Oct 2026. The live nav listed the same tab names. It was not used as a second count.
• The domain frame is the form. Domain Intelligence asks for a domain and says results are cached for 6 hours. No lookup result is filed.

1. 1

   Read the AGPL-3.0 notice before you put a modified copy on a network.

2. 2

   Use the live toolkit or the self-hosted install, and keep the README's $0.003 line attached to the LLM tabs only.

3. 3

   Treat an attack-surface check as something you run on a domain you control.

• You need the version before you clone the toolkit. On 19 Oct 2026 the README said current version 3.39.0 and the GitHub release v3.39.0 was published 2026-10-18T11:29:04Z. The SPDX field was AGPL-3.0. The README says 19 investigative tabs and a username check across 965 platforms. Those counts are the README's. The live nav was not used as a second census.
• A reader wants a domain record from the live page. Chrome's first load of falconeye.osintph.info showed the toolkit, and the Domain Intelligence panel was the form: RDAP, DNS, certificate transparency, and ASN, with results cached for 6 hours. A later visit hit a Cloudflare check. The filed frame stops on the form. Do not invent an RDAP row.
• The LLM line is about to be briefed as the price of the whole toolkit. The README says four tabs call Claude Haiku 4.5 and prints a typical cost per LLM call of about $0.003. That estimate stays on those tabs. The attack-surface tab is documented for domains you control. The sock-puppet tab is documented as fiction. This page does not add a procedure for either.

Hard cases

The case where the first result is easy to over-read.

Questions

Titled sources. These public pages are what the quotes on this listing come from.