It queries GetContact without the Android app
The 705-line GetContact CLI sends profile, tag, quota, and captcha requests to GetContact's private service. It has an interactive menu and separate commands for automation. A search can print a display name, email, tag count, or raw JSON. Batch mode reads a CSV, waits 1.5 seconds between requests by default, records failed rows, and continues.
The repository has 2 files and about 706 lines of source. Its size makes the behavior inspectable, but does not make it official. The README calls it a research project, says it is unaffiliated with GetContact, and explains that it imitates the Android app. That experiment still touches a real account and other people's phone data.
The 24-second install is easier than account enrollment
Our sandbox installed 35 packages in 24 seconds and used 37 MB on disk. The README asks for Python 3.9 or newer plus requests and cryptography; it provides no requirements file or package installer. You run gtc.py directly, while repeatable dependency pinning is left to the user.
Useful output requires services and account material our secret-free sandbox did not supply. The generate command registers an imitated Android device, performs a Diffie-Hellman exchange, then requests WhatsApp verification through VerifyKit. Existing credentials can be added manually. The saved file contains a token, device identifier, and derived encryption value, enough to use the account according to the README.
What happened when we ran it
Our run at commit 72f8b61 installed in 24 seconds, pulled 35 packages, and occupied 37 MB. The build also succeeded in 22 seconds. The fresh Debian container had 3 CPUs, 8 GB of RAM, Python 3.12, no secrets, and no privileged access. The code and dependency setup completed in that environment.
There was no test script or target, so we skipped tests. Pip-audit reported 0 known vulnerabilities. The checkout occupied 0 MB at the lab's rounding precision and contained 2 files, roughly 706 source lines, 0 CI workflow files, no Dockerfile, and no tests directory. This does not check a real login, lookup, captcha, or WhatsApp enrollment.
Every lookup leaves personal data on disk
Each command creates 1 timestamped file in results/, even when it prints the answer to the terminal. JSON mode changes the extension, and batch mode writes CSV. GTC_RESULTS_DIR can move the directory, but the README says there is no automatic deletion. Phone numbers, names, tags, emails, and error text may remain in backups or developer folders.
Credentials live under ~/.config/gtc unless GTC_CONFIG_DIR changes it. The 705-line script attempts to set credentials.json to mode 600 on POSIX. It prints newly generated account values before saving them, while command-line imports can put a token in shell history. Use a test account, restrict the result directory, and remove both outputs after the authorized task.
Two HTTP 403 reports expose the private API cost
The code identifies itself as GetContact 8.4.0 and carries fixed signing values, device details, endpoints, and VerifyKit headers. The README says an upstream change to the app version or signing constants requires editing the script. Issues 1 and 3 soon reported an HTTP 403 during VerifyKit account setup.
The maintainer replied to both reports on August 24, 2026, saying the problem was solved. Commit 72f8b61 changed the VerifyKit request format that day. Both issues remained open when fetched, and the repository had no tagged release. A 22-second build cannot tell an operator when a private endpoint changes its accepted headers again.
No license or tests blocks ordinary production review
GitHub reported no license, and the commit tree contains only 2 files, README.md and gtc.py. There is no dependency manifest, CI workflow, tests directory, Dockerfile, or release tag. A company cannot infer permission to copy, modify, or redistribute code merely because the repository is public. Ask the author for a license before using any part in another product.
Documentation is detailed for Indonesian readers. It covers every command, CSV headers, file locations, environment variables, encryption, quotas, captcha recovery, and known limits. English-only teams get no maintained guide, and 0 automated tests means protocol corrections have no visible regression suite. The docs explain the experiment, but cannot replace executable checks around credential storage and response parsing.
PhoneInfoga avoids the GetContact account dependency
The 35-package client has two useful comparisons. TruecallerJS offers a CLI and Node.js or TypeScript API for Truecaller lookups, including bulk search, under an MIT license. PhoneInfoga uses external scanners and search engines instead of a GetContact account. Its README calls it stable but unmaintained and says results may be irrelevant or unverified. Choose it when public-source metadata is enough, and choose no lookup tool without permission to process the number.
An August 24 fix shows attention, not maturity
The repository was created on August 20, 2026 and last pushed on August 24. GitHub showed 533 stars and 3 open issues with no open pull requests on August 31. The maintainer answered two operational reports and shipped a matching fix. Seven days of public history, no releases, and no test suite are too little evidence for a stable dependency.
Our 24-second install makes GetContact CLI cheap to inspect in a sandbox. Running it against real services is the consequential step because it joins an account credential, private API impersonation, and saved personal data in one 705-line script. It may suit a controlled study with consent. For a production lookup pipeline or casual curiosity about strangers, walk away.