█████╗ ██████╗  ██████╗ ██╗███████╗
██╔══██╗██╔══██╗██╔════╝ ██║██╔════╝
███████║██████╔╝██║  ███╗██║███████╗
██╔══██║██╔══██╗██║   ██║██║╚════██║
██║  ██║██║  ██║╚██████╔╝██║███████║
╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═╝╚══════╝

  the all-seeing OSINT collector   ·   v0.9.1

Argis

The all-seeing OSINT scanner. Map a username across 500+ platforms with media enrichment, identity correlation, breach checks, impersonation detection, and footprint drift tracking — in one async CLI.

Named after Argus Panoptes, the hundred-eyed giant of Greek myth: every platform, watched at once.

pip install argis
argis scan johndoe

Table of Contents

• Demo
• Why Argis
• Use Cases
• Quick Start
• Installation
• Features
• Intelligence
• Media Pipeline
• Commands
• Documentation
• Responsible Use
• Contributing
• Security
• Star History
• License

Demo

argis scan johndoe — 509 platforms, async, streamed to the terminal as results land.

The GIF above is a stylized mockup for illustration. For real footage of your own build, record one with asciinema, VHS, or Terminalizer and drop it in at assets/demo.gif.

Why Argis

Sherlock and Maigret answer does this handle exist here? Argis answers everything after that: it correlates identities, flags impersonators, tracks drift over time, self-heals its own site rules, exports to HTML/PDF/Neo4j/XMind, and layers in recon, breach, and media tooling — one pipeline instead of five separate tools.

Use Cases

Personal security audit — argis me you shows everywhere your handle exists, checks for breached emails and impersonators, and scores your exposure with a ranked shrink plan.

Continuous monitoring — argis monitor johndoe --interval 86400 --webhook <url> watches an account daily and pushes an alert the moment something changes.

Brand & handle protection — argis guard yourbrand generates the full homoglyph / typo-squat space around your handle and flags lookalike accounts before they gain traction.

Authorized security investigations — scan a handle in scope for your engagement, pipe results into Neo4j, cross-reference via the MCP server, and export a PDF for case documentation.

OSINT pivoting — resolve a handle's identity cluster, outbound links, and geo-hints to map how a public account connects to the rest of its footprint.

Infrastructure recon — argis recon example.com runs port scanning, service detection, DNS resolution, WHOIS, and geolocation from one CLI, for hosts you own or are authorized to assess.

Quick Start

pip install argis
argis --version                           # confirm the install
argis scan johndoe                        # surface every account
argis scan johndoe --dossier report.html  # build the full HTML dossier
argis scan johndoe -P report.pdf          # PDF report
argis me johndoe                          # full self-assessment
argis investigate johndoe --html report.html # run 50-agent deep investigation
argis echo johndoe                        # track identity drift over time
argis web                                 # launch the browser UI

Installation

pip install argis                    # base install
pip install "argis[web]"             # + web UI (uvicorn)
pip install "argis[intel]"           # + avatar matching for link/guard
pip install "argis[screenshots]"     # + OCR and screenshots
pip install "argis[vision]"          # + face detection
pip install "argis[insightface]"     # + offline DeepFace matching
pip install "argis[render]"          # + headless browser for JS-gated profiles
pip install "argis[mcp]"             # + MCP server
pip install "argis[pdf]"             # + PDF generation
pip install "argis[dev]"             # + test suite
pip install "argis[all]"             # everything

Requires Python 3.10+. Supports Windows, Linux, and macOS.

Features

Intelligence

Every username scanner answers one question: does this handle exist here? Argis Intelligence answers what comes after.

These tools are built for defensive / self-OSINT: verifying your own data, disambiguating accounts that already share your public handle, and surfacing people impersonating you — see Responsible Use for the intended scope.

investigate — deep multi-agent intelligence

Runs a comprehensive analysis on a target using 50 specialized AI agents organized into 5 squads (Core Identity, Social Intel, Professional, Deep Web, and Specialists). Generates an advanced HTML dossier or Markdown report aggregating all AI agent findings.

argis investigate johndoe --html report.html

doctor — self-healing site database

sites.json rots silently: a platform tweaks its markup or 404 behavior, a rule breaks, and nobody notices for months. doctor re-runs every rule against a known-real and known-fake username and flags what's broken.

argis doctor                                # health-check every rule
argis doctor --only GitHub,Reddit,Steam     # spot-check a few
argis doctor --report health.md --json health.json --exit-code

Ships with a weekly GitHub Action. Also flags duplicate rule names in sites.json.

link — identity correlation

Runs a scan, pulls each found profile's avatar, display name, bio, outbound links, and emails, then clusters accounts into identity groups. The largest cluster is you; anything sharing the handle but scoring below threshold is flagged as a namesake or impersonator.

argis link johndoe
argis link johndoe --threshold 0.7 --category social,media
argis link johndoe --no-avatar

Scoring blends avatar perceptual hash (dHash), name/bio similarity, shared links, and shared emails.

guard — impersonation early warning

Nobody impersonates you with your exact handle: they register john_doe, j0hndoe, johndoe_official, or the homoglyph jоhndoe (Cyrillic o). guard generates the confusable space around your handle, scans every variant, and scores each hit against your real profile.

argis guard johndoe --list                   # preview the variant space
argis guard johndoe --reference https://github.com/johndoe
argis guard johndoe --threshold 0.65 --category social

echo — coordinated identity drift

A normal diff compares two scans. echo analyzes the full saved history and groups changes that happened in the same window: rebrands, avatar migrations, contact pivots, multi-platform expansion or retreat.

argis scan johndoe          # baseline, then scan again later
argis echo johndoe
argis echo johndoe --window 24 --min-confidence 70
argis echo johndoe --json -o johndoe-echo.json

Reports an identity stability score, identity epochs, event confidence, affected platforms, and full before/after evidence in JSON.

Media Pipeline

Argis captures profile photos and classifies each image so the dossier shows real avatars, not platform chrome.

argis scan johndoe --dossier report.html     # dossier with captured media
argis media-review johndoe                   # interactive confidence dashboard (opens browser)
argis media-apply johndoe-media-review.json  # save your accept/reject decisions
argis scan johndoe --dossier final.html      # dossier now uses only approved media
argis media-clear                            # reset all decisions to automatic

Each image is classified as PROFILE_AVATAR, PROFILE_BANNER, PLATFORM_LOGO, GENERIC_THUMBNAIL, DEFAULT_AVATAR, UNKNOWN_MEDIA, or REJECTED. Only validated profile avatars count toward stats, correlation, and risk.

Commands

Discovery

Intelligence

Reconnaissance

Tracking

Analysis

Utilities

argis scan johndoe                            # basic scan
argis scan johndoe --category coding,social   # filter by category
argis scan johndoe --site GitHub              # just one platform
argis scan johndoe --exclude Facebook,Twitter # skip specific platforms
argis scan johndoe --status FOUND             # show found only
argis scan johndoe --min-confidence 60        # only high-confidence hits
argis scan --file usernames.txt --export csv  # batch scan
argis scan johndoe --diff                     # compare vs last scan
argis scan johndoe --emails                   # extract emails
argis scan johndoe --notify                   # desktop notification
argis scan johndoe --proxy socks5://127.0.0.1:9050
argis scan johndoe --tor --timeout 15 --concurrency 10
argis scan johndoe --http2                    # HTTP/2 multiplexing
argis scan johndoe --retry --no-retry         # control retry behaviour
argis scan johndoe --json-stream              # JSON lines output
argis scan johndoe --screenshots              # capture profile page screenshots
argis scan johndoe --screenshots --show       # render in terminal
argis scan johndoe --list                     # list platforms to scan (dry)
argis scan johndoe --dossier report.html      # full HTML dossier
argis scan johndoe -P report.pdf              # PDF report
argis scan johndoe -T report.txt              # TXT report
argis scan johndoe -C report.csv              # CSV report
argis scan johndoe -H report.html             # HTML report
argis scan johndoe -M report.md               # Markdown report
argis scan johndoe -X report.xmind            # XMind mindmap
argis scan johndoe -G graph.graphml           # GraphML export
argis scan johndoe --neo4j import.cypher      # Neo4j import script
argis scan johndoe -J ndjson                  # NDJSON export
argis scan johndoe --ai                       # AI-powered risk analysis
argis scan johndoe --ai-model claude-3-opus   # custom AI model
argis scan johndoe --webhook https://discord.com/api/webhooks/...

argis scan-image screenshot.png               # OCR for usernames/URLs
argis scan-image screenshot.png --scan        # auto-scan extracted handles

argis scan-face photo.jpg                     # detect faces
argis scan-face photo.jpg --search             # open reverse search in browser
argis scan-face photo.jpg --search --engine tineye
argis scan-face photo.jpg --identify           # auto-identify + scan
argis scan-face photo.jpg --identify --offline # DeepFace offline only
argis scan-face photo.jpg --crop               # save face crops

argis setup-celebrity-db                       # download reference images
argis setup-celebrity-db --force                # redownload if cached

argis me johndoe                              # full assessment
argis me johndoe --skip-impersonation         # skip lookalike scan
argis me johndoe --max-variants 30

argis echo johndoe
argis echo johndoe --window 24 --min-confidence 70
argis echo johndoe --json -o johndoe-echo.json

argis recon example.com                       # basic scan
argis recon example.com -sv -os -df -tr       # version + OS + scripts + traceroute
argis recon example.com -ax -pt '*'           # aggressive, all ports
argis recon example.com -gl                   # geolocation
argis recon -ag 192.168.1.0/24                # ping sweep
argis recon -ud example.com                   # UDP scan
argis recon -ox scan.xml -on scan.txt example.com

argis monitor johndoe --interval 30           # check every 30 seconds
argis monitor --file users.txt --webhook https://hooks.slack.com/...

argis web                                     # launch on http://127.0.0.1:8000
argis web --host 0.0.0.0 --port 8080

argis mcp                                     # stdio (Claude Desktop / Claude Code)
argis mcp --transport sse --port 8080         # SSE (web clients)

Documentation

Full docs at mohilisop.github.io/argis | Website: argis.dev

Responsible Use

Argis is built for auditing your own exposure, defending your own handle or brand, and authorized security work — not for tracking private individuals without their knowledge or consent.

• Only run scan, link, guard, echo, monitor, or scan-face --identify against handles, faces, or domains you own or are explicitly authorized to assess.
• Depending on your jurisdiction, using these features against someone else without consent may violate anti-stalking/harassment law, computer-misuse statutes (e.g. the U.S. CFAA, UK Computer Misuse Act), platform terms of service, or data-protection law (e.g. GDPR/CCPA) — that risk sits with the operator, not with Argis.
• link and guard are identity-disambiguation tools (which accounts are you vs. an impostor), not deanonymization tools for figuring out who an anonymous stranger is.
• Respect target sites' robots.txt and rate limits; Argis's retry/backoff is there to be a good citizen of the platforms it queries, not to defeat their protections.
• The maintainer does not support, and takes no responsibility for, use of Argis for stalking, harassment, doxxing, or unauthorized surveillance.

If you maintain a fork or downstream tool built on Argis, please carry this section forward.

Contributing

Contributions are welcome:

1. Fork the repo and create a feature branch (git checkout -b feature/my-change).
2. Run argis doctor and the test suite before opening a PR — pip install "argis[dev]" && pytest.
3. Keep new site rules in sites.json covered by a doctor health check.
4. Open a PR describing what changed and why.

Bug reports and platform-rule fixes (a site rule silently broke) are especially appreciated — argis doctor --report health.md is the fastest way to spot those before you file.

Security

Argis is designed for defensive / self-OSINT use. If you discover a security vulnerability, please do not open a public issue — see SECURITY.md and security.txt for responsible-disclosure instructions and contact details.

Star History

License

MIT