Maigret: open-source username OSINT across 3,000+ sites (soxoj/maigret)

Maigret is a Python-first OSINT utility: feed it a username, and it fans out across a maintained catalog of social and niche sites, collecting public profile signals and packaging them into reports you can hand to an analyst or a ticket. The canonical repo is soxoj/maigret (~23k GitHub stars at the time of writing—refresh the page; the number moves).

This post is a capability overview for blue teams, researchers, and engineers who already think in terms of SOTL-style “find the same handle elsewhere” workflows—not a playbook for abuse.

TL;DR

Where Maigret sits in the toolchain

Maigret is complementary to manual triage and commercial OSINT suites (the upstream README’s Used by section names several vendors—verify current integrations on their sites). For teams, Maigret is the hackable variant you can script in CI or notebooks.

• Breadth-first enumeration — quickly answer “does this handle exist on major and long-tail sites?”
• Metadata harvest — pull bios, links, and cross-IDs that seed recursive searches (Maigret documents expansion from discovered usernames).
• Reporting — one command can emit investigator-friendly HTML/PDF instead of a wall of logs.

Profile parsing is powered in part by socid_extractor for structured IDs from public pages.

Features that matter operationally

Site database hygiene. Maigret ships a bundled dataset and can fetch updates from GitHub (README: roughly once per 24 hours when online). Site-specific claimed vs unclaimed test pairs and --self-check exist so maintainers can tame false positives—a chronic issue in any username checker.

Tag and geography filters. --tags photo,dating or --tags us narrow the blast radius when you already know the persona’s likely vertical.

Permutation mode. --permute builds handle variants (e.g. from name parts), useful for typo-squat and alias hunting—also easy to misuse; pair with policy.

Parse a URL. --parse boots a search from an existing profile URL, handy when onboarding from a single IOC.

Deployment patterns

CLI on an analyst laptop — simplest path for IR retainers.

Docker — soxoj/maigret:latest for batch jobs; soxoj/maigret:web when you want a shared UI on a jump host (bind localhost or put it behind SSO; never expose raw OSINT UIs to the public internet without controls).

Embeddable library — README positions the CLI as a thin wrapper over async APIs you can import; see Read the Docs for library usage and options.

Ethics, law, and enterprise reality

Maigret is neutral tooling. The README’s disclaimer is explicit: lawful, educational use; you own GDPR/CCPA/employment obligations. For employee monitoring or vendor due diligence, run everything through legal and data-retention policy—public does not mean permissionless in every jurisdiction.

False positives still happen: shared usernames, bots, and homoglyphs can implicate the wrong person. Treat hits as leads, not verdicts.

Related on explainx.ai

• Agent skills security — why automated tooling needs governance
• What is MCP? — wiring structured tools into agent loops without leaking scope
• Claude mythos preview — model-assisted defensive workflows in context

Sources

• Repository: github.com/soxoj/maigret
• Quick start: maigret.readthedocs.io — Quick start
• Documentation: maigret.readthedocs.io
• Site list: sites.md in repo
• socid_extractor: github.com/soxoj/socid_extractor
• PyPI: pypi.org/project/maigret
• No-install option: Telegram bot (per README)
• Maintainer commercial contact: [email protected] (per README)

Site counts, Docker tags, and CLI flags change frequently. Treat this article as May 6, 2026 context—read maigret --help and the upstream CHANGELOG before production rollouts.