Summary

Adds search_hudsonrock, a new OSINT tool that queries Hudson Rock's Cavalier API for credentials exposed via infostealer malware (RedLine, Lumma, Raccoon, Vidar, StealC, …). Auto-routes by input shape — emails → /search-by-email, domains → /search-by-domain, usernames and E.164 phone numbers → /search-by-username — and works without an API key against the free public endpoint (50 req / 10 s rate limit). HUDSONROCK_API_KEY, if set, is sent as Authorization: Bearer … for commercial-tier access. Closes #4.

Why

Infostealer-corpus checks fill a coverage gap that search_breach (HaveIBeenPwned) doesn't address: HIBP indexes credentials that have been published as breaches, but a substantial fraction of compromised credentials surface only in malware botnet logs that are sold privately. For email and domain investigations this materially increases recall, and the domain mode returns useful aggregate signals (compromised-employee count, top stealer families, victim-AV breakdown) for assessing organisational exposure.

What's in the diff

New tool module

• openosint/tools/search_hudsonrock.py — async run_hudsonrock_osint(query, timeout_seconds); _classify() selects the endpoint from input shape; separate formatters for the domain-aggregate response and per-record (email/username) responses; output redacts top-logins and masks victim IPs as returned by the API. Follows the project's tool-contract convention: never raises across the API boundary, returns descriptive error strings on failure.

Interface registration (per the integration checklist in CONTRIBUTING.md)

• openosint/agent.py — Anthropic tool definition + dispatch entry in _TOOL_MAP; SYSTEM_PROMPT now suggests search_hudsonrock alongside search_breach for credential-exposure investigations.
• openosint/mcp_server.py — Tool(...) entry in list_tools() and dispatch branch; module docstring updated to reflect 17 tools.
• openosint/cli.py — openosint hudsonrock QUERY [-t SECONDS] subcommand.
• openosint/repl.py — display row in _TOOL_INFO_ROWS.
• openosint/web_server.py — _TOOL_CATALOG entry (Identity category) + _RUNNERS mapping; tool surfaces in the web UI sidebar and the AI chat tool-use path.

Version + docs

• Version bumped to 2.20.0 across openosint/__init__.py, pyproject.toml, and .mcp/server.json (both the top-level version and the package entry).
• README footer was at 2.19.0 and is now in sync with the rest. _VERSION in web_server.py was already at 2.20.0.
• .env.example: new HUDSONROCK_API_KEY entry with a comment explaining the public-vs-commercial-tier behavior.
• README.md: feature line (16 tools → 17), env-var table row, Integrations table row pointing at hudsonrock.com.
• CHANGELOG.md: [2.20.0] entry under Added / Changed.

Drive-by cleanups inside the new file (flagging transparently — happy to split into a separate commit/PR if maintainers prefer)

• _EMAIL_RE had [\w-]+ in the domain class, rejecting any multi-level domain (user@mail.example.com failed _is_valid_email()). Changed to [\w.-]+; the TLD [a-z]{2,} anchor and re.IGNORECASE flag are preserved. Note: the same flaw exists at openosint/web_server.py:757 inside _demo_chat_stream — left untouched here to keep this PR scoped to the integration; can be a follow-up.
• _fetch_hudsonrock previously called _raise_for_status(resp.status) and then re-checked resp.status == 404 to return {}. The two checks were redundant: _raise_for_status silently returned on 404, then the caller detected 404 again. Collapsed into a single explicit 404 short-circuit in the caller; _raise_for_status now only raises, matching its name.

Test plan

# unit tests for the new tool — 25 tests
pytest tests/test_hudsonrock.py -v

# full suite, confirming no regression
pytest
# → 233 passed, 2 skipped (the 2 skipped depend on optional binaries)

# lint + format
ruff check openosint/      # → All checks passed!
ruff format --check openosint/   # → 31 files already formatted

# manual smoke against each interface
openosint hudsonrock user@example.com         # CLI, email shape
openosint hudsonrock example.com              # CLI, domain shape
openosint hudsonrock johndoe                  # CLI, username shape
openosint hudsonrock +14155552671             # CLI, phone-as-username shape
openosint                                     # then in REPL: "check infostealer exposure for example.com"
openosint web                                 # exercise via the web UI tool card and AI chat
python openosint/mcp_server.py                # invoke search_hudsonrock from an MCP client (Claude Desktop / Claude Code)