OSINT investigator
Graphline
Give Graphline an email, a phone number, a username, a name or a domain. It goes through the public web, follows whatever it turns up, and draws the whole thing as a graph you can read in one look.
- Year
- 2026
- Stack
- Next.js, React, React Flow, Claude
- Status
- Open source, MIT
Why it exists
Someone tried to scam me. He messaged me and left his email address in the message. I wanted to know who it belonged to, and there was no simple way to check.
You can look an email up by hand. I did. You end up with a Gravatar, a GitHub account, a domain registered to a name that might be his, and twenty open tabs. Nothing tells you whether any of it is the same person.
Graphline does that part for you. You give it one thing and it keeps pulling on whatever it finds until there is nothing public left. What comes back is a graph, and I like that far more than a list of links. You look at it once and you can see how someone is spread across the internet.
It works just as well on yourself, which is how I mostly use it now. Run your own email and you find out what a stranger could put together about you.
How it works
- 01
You give it one thing
An email, a phone number, a username, a name or a domain. That is the whole starting point.
- 02
It crawls instead of searching
It starts with your own sites and emails, reads them for anything else it can use, then chases the handles it picks up along the way, including ones you never typed in.
- 03
It stops at other people
A page that only mentions you gets shown but never read for more leads. Otherwise a search that starts with you ends up somewhere in a stranger's accounts.
- 04
You watch it happen
Results come back over a live stream, so the graph fills in while the search is still running. Nothing sits behind a loading spinner.
- 05
Then it writes it up
Claude turns what was collected into a readable report, using only what the crawl actually found. With no API key at all you still get the same report, written by a plainer non-AI writer.
What's in it
The graph
Everything it found and how the pieces connect, on a canvas you can drag around. Click any node and you can see which source produced it.
Three levels of certainty
Confirmed means there is actual proof of ownership, like a Keybase signature or an email that signed a public commit. Likely means separate sources point the same way. Same handle means someone with that username exists there and nothing more.
An exposure score
A number out of 100 for how easy someone is to find, with a breakdown of what is pushing it up. Useful when you run it on yourself.
Thirteen sources
GitHub and its commit history, Gravatar, Keybase, a username check across about 25 sites, a page scraper, domain records, DNS, certificate logs, the Wayback Machine, breach data, phone lookups, web search and Hunter.
No keys needed
All of that runs without a single API key. Two free ones, a search key and a GitHub token, widen the results a lot, and it drops back to keyless on its own when a quota runs out.
Your searches stay yours
Past investigations sit behind an anonymous session, so you only ever see and delete your own.
Rules it follows
It says when it is guessing
A matching username proves nothing. Every account carries its certainty level in the graph and in the report, because a guess dressed up as a fact is worse than no answer.
Some sites are skipped on purpose
Instagram, TikTok, Telegram, X and Steam say yes to every username you ask about. Checking them would fill the graph with people who are not you.
Public data only
It never tries to log in anywhere. Everything it reads is already open to anyone. What it hands back are leads worth checking, not conclusions about a person.
Locked down
It follows links that other people control, so every address it fetches is checked first and refused if it points back at the server itself. There are rate limits per visitor and a cap on how much runs at once.
How it was built
I didn't write a line of the code. I made every other decision in it.
Claude wrote the code. I did the rest: what it should do, what it should not do, how each part behaves, how it looks. Then I went through what came back and fixed what was wrong, again and again, until it was the thing I had in my head.
The part I spent the longest on was getting it to admit when it is unsure. A long confident list of accounts looks impressive and is wrong half the time. I would rather it found less and got it right.
- Product, design, every decision
- Me
- The code
- Claude
- Time
- About 14 hours
- Tokens
- About 20M
Where it stands
There is no hosted version right now, so it runs from the repo. Clone it and start it and you have the whole thing. A search takes a minute or two, so it needs a normal server rather than the serverless kind that would cut it off partway, and there is a Dockerfile in there if you want it on Render, Fly or Railway.
Built with AI
GraphlineJobless