User Scanner 架构：模块、并发、透视、报告与 MCP

Model the engine as contracts

将模块、传输、pivot、报告和 MCP 视为独立契约。cross-scan 是带深度、验证、去重和父子证据的图遍历，不是单个请求。

A module response should carry platform, target type, status, URL or identifier, timestamp, and uncertainty. The engine should not collapse `not found`, timeout, blocked, and ambiguous into one boolean.

Follow a pivot edge

An initial username or email scan can emit handles, profile links, or public addresses. The cross-scan engine classifies those links, applies depth and verification policy, queues secondary modules, and records parent/child relationships. This is a graph traversal, not a single request.

Bound breadth and depth, de-duplicate normalized targets, and keep an audit record of why each edge was accepted or rejected. A recursive pivot must not silently expand the investigation scope.

Connect reports and MCP

PDF, JSON, and CSV writers project the same observation graph into different consumers; PDF may include profile photos while JSON is better for pipelines. The MCP layer exposes scan, email, and module-discovery tools to compatible clients, so schemas and errors must remain stable and redacted.

Keep the client as an orchestrator of evidence, not an authority that invents identity confidence or widens permissions.

Review failure boundaries

Concurrency, TLS fingerprinting, proxies, provider changes, and module-specific parsers can fail independently. Test timeouts, rate limits, malformed responses, duplicate pivots, partial exports, and MCP cancellation; each should leave a named, recoverable state.