Primary question: Do you need 465+ email/username account checks, cross-scan pivoting, and native MCP AI-agent integration in one MIT-licensed CLI?
RepoDaily adoption score
RepoDaily rates this as 91/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 2 command/install signal(s) were detected.
Trending momentum is +464 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 5 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 5 alternative(s), and 4 type-specific section(s) support differentiation.
License source or license wording is present.
8 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
user-scanner (v1.5.1.1) is a Python OSINT suite that takes one identifier — an email address or a username — and maps it across 465+ scan vectors: 175+ email-integrated sites and 290+ username platforms. Written by Kaif and released under MIT, it landed at #7 on the 2026-08-31 trend list with 464 stars in the period, and the README carries a Trendshift badge, suggesting the attention is not a single-day spike.
What separates it from classic account-enumeration scripts is the pivot engine. Initial scans scrape metadata — avatars, bio text, follower counts, UID numbers, seller statuses — and mine handles, profile links, and exposed email addresses from the results, then automatically re-scan those secondary targets. A wildcard-based permutation and alias generator catches alternative handles and typosquat variants, and the --hudson flag layers Hudson Rock infostealer breach-log correlation on top of account discovery.
The second differentiator is agent integration. Beyond the main CLI, the package ships a second entry point, user-scanner-mcp, which runs a Model Context Protocol server. Claude Desktop, Cursor, Antigravity, and other LLM clients can drive autonomous scans and recursive pivots without shell access. Reports export to multiple formats, including PDF with profile photos via the pdf extra (reportlab, pillow, svglib).
Engineering-wise it is a disciplined small project: flit-built, Python 3.10+, an httpx/curl_cffi parallel engine with automated TLS fingerprint impersonation, and a CONTRIBUTING.md that defines an exact module contract so contributors can keep growing the vector count. It is tested on Windows, Linux, and Termux, and a Discord server (discord.gg/tVNrKVXb49) backs the user base.
Why it is trending now
- 464 stars in the period and rank #7 on 2026-08-31; the README's Trendshift badge (repository 16556) points to sustained momentum rather than a one-off spike.
- Native MCP support is still rare in OSINT CLIs. With user-scanner-mcp, Claude Desktop, Cursor, and Antigravity agents can run scans and recursive pivots directly.
- --hudson folds Hudson Rock infostealer breach-log correlation into the same run as account enumeration, collapsing two manual steps into one flag.
- A precise contribution contract — async def validate_<service>(email: str) -> Result with httpx.AsyncClient — lets the 465+ vector count grow from community modules instead of a paid feed.
- Termux support means mobile-first investigators can run the full suite from a phone, alongside tested Windows and Linux paths.
Problem it solves
- Account enumeration is fragmented: username checkers and email signup probers are usually separate tools. user-scanner merges both under one CLI (user_scan sync validators plus email_scan async flows).
- Pivoting is manual: a hit that leaks a second handle or email normally means re-running a tool. The cross-scan engine treats mined handles, profile links, and exposed addresses as new targets automatically.
- Alias blind spots: scanning one handle misses typosquat variants. Wildcard-based permutation generation expands the search space.
- Raw CLI output is not casework-ready. PDF export with profile photos turns scan hits into a shareable deliverable.
- LLM agents had no sanctioned way to run OSINT scans; the MCP server exposes the scanner as a callable tool instead of a human-only terminal program.
How it works
- Input one identifier — an email or username — and the scanner fans out across 465+ vectors: 175+ email-integrated sites and 290+ username platforms.
- Email modules under user_scanner/email_scan/ run async multi-step flows: fetch signup pages, extract CSRF tokens, submit probe payloads, and classify responses. The documented Mastodon example treats the text 'has already been taken' as a confirmed registration, using httpx.AsyncClient with timeouts and redirects.
- Username modules under user_scanner/user_scan/ are synchronous availability validators consumed by the main username scanner.
- The cross-scan and pivot engine scrapes metadata — avatars, bios, follower counts, UIDs, seller statuses — and mines handles, profile links, and exposed emails as new targets, then pivots automatically.
- Optional layers activate by flag or extra: --hudson queries Hudson Rock infostealer logs; permutation mode expands wildcard-based alias variations; curl_cffi impersonates TLS fingerprints to sustain high concurrency.
- Results land as multi-format reports, including PDF with profile photos (reportlab/pillow/svglib), or flow through the MCP server to an AI agent.
Architecture read: two scan engines, one Result contract
- CONTRIBUTING.md splits the codebase in two: user_scanner/user_scan/* holds synchronous username availability validators, while user_scanner/email_scan/* holds asynchronous, multi-step email flows organized in category subfolders such as social/, dev/, community, and creator.
- Every email module must export async def validate_<service>(email: str) -> Result, use httpx.AsyncClient with sensible timeouts and follow_redirects, and carry a docstring documenting API keys, rate limits, and a responsible-use note.
- The shared Result type lives in user_scanner.core.result; the reference Mastodon module returns Result.taken on 'has already been taken' and Result.error on IP flags or 429 responses.
- pyproject.toml defines two console entry points: user-scanner = user_scanner.__main__:main and user-scanner-mcp = user_scanner.mcp.server:main — the second is the MCP server binary.
- Module files must be named after the platform in lowercase — github.py, reddit.py, x.py, pinterest.py — so vector coverage maps one-to-one onto the file tree.
Command surface: entry points, flags, and dependency pins
- Two console scripts ship with the package: user-scanner for interactive CLI scanning and user-scanner-mcp to expose the suite to MCP-capable AI clients.
- --hudson switches on Hudson Rock infostealer breach-log queries for high-priority target correlation.
- Throttling surfaces through module errors: on HTTP 429 the Mastodon module returns a 'Rate limited; try using the -d flag' error, documenting a delay flag for rate-limited runs.
- Requires Python >= 3.10; the core dependency set is pinned tightly: httpx[http2]>=0.27,<0.29, socksio>=1.0,<2, colorarma>=0.4,<1 replaced by colorama>=0.4,<1, curl_cffi>=0.7,<1, rich>=13.
- Optional extras gate heavier features: pdf (reportlab>=4, pillow>=10, svglib>=1.5) for PDF reports; mcp (mcp>=1.2.0,<2) for the agent server; dev (pytest, pytest-cov, pytest-anyio) for contributors.
Integration surface: MCP agents, breach intel, and reports
The MCP server is the headline integration. Once the mcp extra is installed, user-scanner-mcp runs a Model Context Protocol endpoint that Claude Desktop, Cursor, and Antigravity can call, letting an agent chain scans and recursive pivots on its own. This converts a terminal-only tool into a composable agent capability — something most OSINT tools in this category still lack.
Breach context comes from Hudson Rock: --hudson checks the scanned identifier against infostealer malware breach logs, which helps prioritize targets whose credentials may already be circulating. Reporting closes the loop with multi-format exports, including PDF output that embeds profile photos through the reportlab/pillow/svglib stack in the pdf extra.
Maintenance risk: single author, decaying target surface
- Version 1.5.1.1 with a single named author (Kaif, kaifcodec@gmail.com) and an MIT license dated 2025.
- The 465+ vectors stay useful only while platform signup pages and APIs keep their current shapes; module rot is structural in this category, and the project's answer is a documented contribution contract rather than a paid data feed.
- Test and lint infrastructure exists: pytest config sets testpaths = ["tests"], dev extras pull pytest-cov and pytest-anyio, and ruff lint rules are configured — though tests/ are excluded from the flit sdist.
- Community signals are decent for a young project: a Discord server, a Trendshift badge, and two commercial sponsors (WebVetted and Noimosiny) whose paid platforms sit directly upstream of the free tool.
Who should pay attention?
Good fit if
- OSINT analysts and threat researchers mapping a subject's footprint from a single email or username.
- Red teamers doing reconnaissance inside authorized rules of engagement.
- Investigators who want breach context fused with account discovery via --hudson.
- Builders wiring LLM agents to real tools: the MCP server makes scans callable from Claude Desktop, Cursor, and Antigravity.
- Mobile-first users: tested on Termux as well as Windows and Linux.
Skip for now if
- Anyone probing third parties without authorization — modules hit live signup endpoints, and the legal exposure is real.
- Shops that need an SLA-backed commercial platform; the project's own sponsors (WebVetted, Noimosiny) occupy that tier.
- Compliance-restrictive environments: curl_cffi TLS fingerprint impersonation and probe traffic can violate target-site terms.
- Environments pinned below Python 3.10.
Risks and cautions
MIT-licensed, pip-packaged, and precisely documented, but OSINT probing carries inherent legal exposure, and vector accuracy depends on one maintainer keeping 465+ modules aligned with live sites.
- Email modules probe live signup flows; unauthorized scanning of third-party identifiers can breach site terms and local law.
- TLS impersonation via curl_cffi raises the odds of IP flags — the Mastodon module explicitly handles a 'Your IP has been flagged' response.
- Single-maintainer project (Kaif); no release notes or changelog beyond the 1.5.1.1 version pin appear in the reviewed files.
- Vector decay is structural: every platform redesign can silently break a module.
- Every scan broadcasts the target identifier to 465+ third-party sites; consider what that reveals about your investigation before running it.
- The CONTRIBUTING.md Mastodon example embeds a probe payload with a hardcoded example password string — standard for signup probes, but code auditors should note it.
- The license is unambiguous MIT (Copyright (c) 2025 Kaif), so internal use and modification are permitted.
- The base install keeps a small dependency footprint (httpx, curl_cffi, socksio, colorama, rich); heavier stacks arrive only through the pdf and mcp extras.
- CONTRIBUTING.md requires every contributed module to document rate limits and include a responsible-use note in its docstring.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
| You only need username enumeration across social networks and want the most battle-tested single-purpose tool | Free, open-source | |
holehe | Your starting point is an email and you only need to know which sites it is registered on | Free, open-source |
Maigret | You want deep username profiling and report output rather than combined email coverage | Free, open-source |
blackbird | You want email plus username search in one run without the MCP agent layer | Free, open-source |
WebVetted | You need a managed commercial investigation platform with breach intel, AI analysis, and an identity graph instead of a CLI | Commercial (a sponsor of user-scanner) |
What this trend reveals
MCP-native OSINT is still scarce
Most OSINT CLIs predate the agent era. user-scanner ships a dedicated user-scanner-mcp entry point and an mcp extra, so agent platforms get a ready-made scanning capability without shell wrappers.
Install the mcp extra, point Claude Desktop or Cursor at user-scanner-mcp, and confirm a scan round-trips through the agent.
Vector accuracy is the real moat
465+ vectors only matter if they stay correct. The validate_<service>(email) -> Result contract with httpx.AsyncClient keeps per-module cost low, which is how coverage compounds in this category.
Pick five platforms you know well, scan accounts you control, and count accurate hits versus false positives before adopting.
Breach fusion collapses triage steps
--hudson puts Hudson Rock infostealer correlation in the same run as account enumeration, removing a manual cross-check between two separate data views.
Run one identifier you own with and without --hudson and compare the report delta.
RepoDaily verdict
user-scanner compresses an entire OSINT loop into one MIT-licensed Python package: 465+ email and username vectors, automatic pivoting from mined handles, Hudson Rock breach correlation behind --hudson, PDF reporting, and a native MCP server that turns the suite into an agent-callable tool. The costs are structural to the category — legal exposure on third-party targets, rate limits and IP flags from live probing, and a 465-module surface that one maintainer must keep aligned with ever-changing signup pages. For authorized investigation work it earns a spot near the top of the toolkit; for anything touching people who have not consented, it should not run at all.