User Scanner
User Scanner 详解：带防御边界的邮箱与用户名 OSINT
介绍 User Scanner 的扫描向量、交叉透视、MCP、报告和隐私边界。
你将学会
- Explain module, pivot, report, and MCP layers
- Run a bounded scan and interpret uncertainty
- Apply authorization, rate-limit, and data-retention controls
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- User Scanner combines email and username modules with pivoting and structured reports.
- Concurrency, proxies, and MCP access need explicit scope, rate limits, and data minimization.
- Results are leads to verify, never automatic proof of identity or authorization.
The short answer
User Scanner 是一个 Python OSINT 套件，可围绕邮箱和用户名查询多个公开平台。README 描述了 465+ 扫描向量、交叉扫描、PDF/JSON/CSV 报告、代理验证和 MCP 服务。
Those capabilities are reconnaissance tooling, not proof of identity or permission. A positive registration result can be stale or belong to another person, and a pivot can expose sensitive information. Use the tool only for a documented, lawful investigation or a profile you own, minimize collected data, and obtain human review before acting on a result.
Run a bounded scan
The README recommends installing from PyPI with `pip install user-scanner`, optionally adding the MCP extra. A virtual environment keeps dependencies isolated. Start with a synthetic username or an account you control, use one category or module, and export JSON so the raw observations can be reviewed without repeatedly querying every platform.
The command surface separates username (`-u`) and email (`-e`) scans, category/module selection, bulk files, report formats, and proxy options. `--cross-scan` performs additional pivots; keep the depth low, prefer verified links when available, and record the timestamp, module set, proxy policy, and tool version in the case notes.
Architecture and agent integration
The high-throughput engine uses `httpx` and `curl_cffi` for concurrent requests and TLS fingerprint impersonation, while a module registry supplies platform-specific checks. The cross-scan engine turns discovered handles, profile links, or public email addresses into secondary targets, and the MCP server exposes these workflows to Claude Desktop, Cursor, Antigravity, or Open WebUI.
Concurrency and proxy rotation improve coverage but increase rate-limit, terms-of-service, and data-protection risk. Bound parallelism, honor robots and provider policies, avoid credentialed access, and store only the fields required for the stated purpose. An AI client should summarize evidence, not invent confidence when a module returns an ambiguous response.
When User Scanner is a good fit
Use it for defensive exposure checks, self-audits, authorized incident response, or research where public-source collection is explicitly permitted. Its structured reports and module selection make a repeatable review easier than ad-hoc browser searches.
Do not use it for stalking, doxxing, credential discovery, harassment, or bulk collection of people who have not consented. Protect exported reports, set retention limits, and document the legal basis and reviewer for every investigation.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Install in a Python virtual environment and read the project's usage and ethics guidance.
- 2
Run one low-depth scan against a synthetic or owned identity.
- 3
Export JSON, record module/version/timestamp, and manually verify representative results.
- 4
Encrypt reports, set retention, and require authorization before any broader scan.
可复制示例
python3 -m venv .venv
source .venv/bin/activate
pip install user-scanner
user-scanner -u example-handle -m github -f json -o results.json
# Keep cross-scan depth and concurrency bounded for authorized work.常见问题
Does a hit prove an account belongs to someone?
No. Module responses can be stale, ambiguous, or shared. Verify with independent, lawful evidence and a human reviewer.
Can an AI agent run User Scanner?
The README documents an MCP server, but expose it only in a controlled environment with explicit scope and redaction rules.
资料来源
- User Scanner README (captured 2026-08-31)来源核查 2026-08-31
- User Scanner repository来源核查 2026-08-31