MaigretSAFE
MCP server for maigret, a powerful OSINT tool that collects user account information from various public sources.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://smithery.ai/server/mcp-maigret)
A Model Context Protocol (MCP) server for maigret, a powerful OSINT tool that collects user account information from various public sources. This server provides tools for searching usernames across social networks and analyzing URLs. It is designed to integrate seamlessly with MCP-compatible applications like Claude Desktop.
⚠️ Warning
This tool is designed for legitimate OSINT research purposes. Please:
- Only search for information that is publicly available
- Respect privacy and data protection laws
- Follow the terms of service of the platforms being searched
- Use responsibly and ethically
- Be aware that some sites may rate-limit or block automated searches
Security
This server implements several security measures to prevent command injection attacks:
Input Validation
- Usernames: Only alphanumeric characters, underscores, hyphens, and periods are allowed (max 100 characters)
- URLs: Must be valid HTTP/HTTPS URLs without shell metacharacters
- Tags: Only alphanumeric characters, underscores, and hyphens are allowed
Safe Command Execution
- Uses
execFile()instead ofexec()to prevent shell interpolation - All command arguments are passed as arrays, not concatenated strings
- Docker commands are executed without shell interpretation
Reporting Security Issues
If you discover a security vulnerability, please report it by opening an issue or contacting the maintainers directly. We take security seriously and will respond promptly.
Requirements
- Node.js (v18 or later)
- Docker
- macOS, Linux, or Windows with Docker Desktop installed
- Write access to the reports directory
61071ffd3222OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-maigret -- npx -y [email protected]
{
"mcpServers": {
"mcp-maigret": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
parse_url | read | Parse a URL to extract information and search for associated usernames |
search_username | read | Search for a username across social networks and sites |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, @types/node, typescript
Gates applied: no_behavioural_pass.
61071ffd3222full audit observations/trust-audit/mcp-server/burtthecoder__maigret.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 61071ffd3222 | SAFE | B | 89 | first audit |
Questions
What is the Maigret MCP server?
MCP server for maigret, a powerful OSINT tool that collects user account information from various public sources.
What tools does Maigret expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Maigret safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Maigret need?
No credential environment variables were found in its source, so it appears to need none.
How does Maigret run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-maigret at 1.0.13.
How current is this page?
The grade is for one exact copy of the source (61071ffd3222), read on 2026-10-06. The repository is watched and re-audited when it changes.