What happened when we ran it
Our Python 3.12 sandbox installed 92 packages in 52 seconds and used 203 MB on disk. The build succeeded in 9 seconds. commit 149acb1 was a 7.5 MB checkout with 164 files and about 19,856 source lines, while pip-audit reported 0 known vulnerabilities.
Pytest failed after 18 seconds: 369 of 447 tests passed, 64 failed, 5 skipped, and 14 ended in collection or setup errors. The log tail names Cloudflare web-gate checks and several general checking cases. It also says an async fixture named cookie_test_server had no plugin or hook to handle it. That message explains one setup error, not the other failures, so our run cannot assign a single cause to the suite result.
Maigret turns username hits into reviewable reports
Maigret checks a username across more than 3,000 sites, with a default run covering the 500 highest-ranked entries. It can extract profile details, follow discovered identifiers, and export HTML, PDF, CSV, JSON, XMind, Neo4j, or an interactive graph. Ordinary searches require no site API keys.
The breadth helps an investigator move from a possible account to a structured set of leads. It also creates noise: sites change, common usernames collide, and response patterns can misclassify an account. Narrow filters and manual verification matter more than scanning every entry.
Python installs quickly; the web still fights back
The basic path is as clean as advertised: use Python 3.10 or newer, install the PyPI package, and run maigret USERNAME. There are official Docker variants for the command line and web interface, plus a downloadable Windows executable. Developers can call the asynchronous search function from Python instead of wrapping the command, which is the better route for a durable internal workflow.
The complexity arrives at the edges. PDF reports are an optional install and need operating-system graphics libraries. Tor and I2P modes assume their gateways are already running. Sites protected by JavaScript challenges can be routed through a separate FlareSolverr instance, but the README labels that Cloudflare bypass experimental and warns that its behavior may change without compatibility guarantees.
The bundled web UI is excellent for exploring the relationship graph and downloading reports. It is not a finished multi-user service. The README explicitly says the one-click Render deployment has no login and can be used by anyone who knows its URL. Put authentication, request limits, and an acceptable-use policy in front of it before making it reachable outside a trusted network. A request for a proper authenticated REST API is still open, so service integrations should currently use the Python library or build their own boundary.
Results are leads, not identity proof
Username reuse is useful evidence, but it is not proof that two profiles belong to the same person. Common handles collide, profile pages change, and websites sometimes return the same response for existing and nonexistent users. Maigret uses claimed and unclaimed response markers, status codes, redirects, and page data to make that decision, yet the database is only as accurate as the current behavior of thousands of independent sites.
A July 2026 issue gives the right warning: the Telegram bot's automated probe marked three random usernames as claimed on one forum. Current pull requests also repair integrations when an API times out or a profile route stops exposing structured data. This is healthy maintenance, but it demonstrates why consequential findings need to be opened and checked manually. The self-check command helps maintainers find broken definitions; it does not remove uncertainty from a finished report.
The optional AI mode sends a generated Markdown report to an OpenAI-compatible chat endpoint for a short investigation summary. It introduces an API key, a third-party or local model, privacy decisions, and another source of mistaken inference. Keep the underlying links and distinguish extracted facts from model-written conclusions.
Reporting is where Maigret earns its place
The export range is a genuine advantage. HTML and PDF suit a human handoff, CSV and newline-delimited JSON fit analysis pipelines, and the graph output makes connections easier to inspect. Neo4j export writes an idempotent Cypher script, so repeated imports do not have to duplicate the same entities. Keyword highlighting can also elevate profiles that mention terms relevant to the investigation.
Maigret is especially strong when the first match reveals another identifier. Recursive searching can turn scattered public clues into a connected dossier, and the library interface lets a team attach its own review and storage process. The responsible workflow is to start narrow, preserve source URLs, verify important matches, and expand only when the evidence justifies it. Running all sites and accepting every green result produces volume, not certainty.
Release 0.6.5 fixed reports and site checks
The repository was pushed on August 25, 2026, the same day version 0.6.5 was released. GitHub listed 23 open issues and pull requests. False-positive probes for Aqa, JoyReactor, Codédex, Coderwall, and DEFCAD were updated between August 23 and 25, which shows both current maintenance and the recurring cost of tracking thousands of independent sites.
The numbered v0.6.5 release now occupies GitHub's latest slot, removing the confusing development-build pointer described in an older issue. Windows evaluators should still consider the earlier Defender report on the standalone executable; pip or an inspected source build avoids relying on that binary.
Maigret is an unusually capable tool for turning username reuse into structured research. Its breadth guarantees ongoing breakage at individual sites, and our 64 failed tests make that risk concrete. Pick it when recursive discovery and varied exports matter, then preserve source URLs and manually confirm every match that affects a person.